Businesses have shown an enormous appetite for hoovering up personal information. Why are you sure that businesses won't use an alternative verification app that stores the names and dates of births, shares them with their marketing partners, etc.?
GDPR. No legit company would take such a risk in EU, legal and PR ramifications would be massive.
Maybe in your corner of the EU that's true. In mine GDPR is well regarded as joke.
The problem with the GDPR is that it is only as good as the authority enforcing it. There are complex rules (from memory about a third of the text, but it is a while since I read it all and this was the bit I was least interested in) on which authority is the one in question that means you can somewhat choose your authority, and some of them are not enforcing it at all. This is how Facebook and Google etc are able to do things that clearly violate it I think.