> Are there any less obviously aggressive tactics we can use?

If you are in the US, and hopefully in a state that is open to blocking this sort of thing, be very vocal and persistent with your state reps about the issue. Get others to join. I am curious if this will be legal within the Illinois Biometric Information Privacy Act or a couple other states with similar laws