Disclaimer: Not a lawyer.

I think companies with a physical office in the US, where they also have a operating presence, are exempt. But looks like you still have to report that you are exempt.

If you are not exempt, you need to provide your name, address, date of birth, and an ID. That is all.

At this point, it looks like FOIA is not applicable for this information, so privacy is not impacted.