I don't know how related this is, but I used to work for the MMO/Gaming company Funcom. And if an account became compromised, we would ask that they send in a picture of their "government issued ID" to prove their identity. And as far as I was aware, this was perfectly legal to do so.