Then make the act of selling it or storing it in a database with the intent to track people illegal?
“Intent to track” could be an approach, but the toll bridges near me use license plate scanners for payment, so I could see it not being that clear cut. There are likely other valid use cases, like statistical surveys, congestion pricing laws, etc.