In Brazil companies must have the purchaser's (natural person or company) tax ID for invoicing purposes. Point-of-sale in-person sales transactions don't require invoicing, just receipts, but any other commercial transaction does. Even returning merchandise that was bought with a receipt will require an inbound invoice and a CPF. Thanks tax evaders.

Maybe 30 years ago one could think of their CPF as a number to keep mostly private, but since a large part of the economy now goes through digital channels, a CPF is simply a person identifier rather than something secret.

Nobody trusts CPFs to be a secure identifier anymore. The backstop currently rests on biometric validation on B2C scenarios. For more secure purposes (like contracts) we have digital signatures backed by the gov.br infrastructure, which are widespread but requires acceptance by both parties, and also digital signatures backed by PKI like e-CPF and e-CNPJ that carries full validity by law and are equivalent to notarized signatures. Very few people have e-CPFs though.

To be honest, that information is already out there, people can track you by your full name already. The tech analogy is: CPF is just the primary key id in the Brazilian PERSON database, everyone gets one, and you use it on any API a person is needed (literally and figuratively). It should be public by design, just like a piblic crypto key, or a username handle

So you don't understand. Also not every country is a shithole that knowing even a SSN can result in identity fraud.

You can't vote with just a CPF. The cards aren't issued since 2011, and they didn't have a photo or anything like that. At that time, they were considered tax identifiers only. They moved to printing the CPF number on receipt paper when somebody requested it at the post office when they reached 16-18 years old, usually at the same time when one would request their electoral registration or when requesting an employment booklet. It was a rite of passage to the adult life. More recently all newborns receive a CPF number when they are registered on their birth certificate.

In any case, you have to vote with a photo ID document and you have to scan a fingerprint that was previously enrolled in the electoral justice courts or whenever you renew a driver's license or photo ID. By now 88% of the population have their fingerprints collected for electoral purposes.

In 2023 a law was passed to deprecate state-level ID cards and numbers to use a single federal identifier, and since every economically active person in the country already had a tax ID, the government decided to use the same number.

I do think they cause unnecessary friction for non-residents though, because companies could simply accept passport numbers, as authorized by tax law, but I guess nobody gives this a thought.

they relax this during the f1 weekend. it's kinda of a joke.

already considered a paypal-like service just for foreigners, but then figured criminals would use it instead to evade tax/etc.

so they can setup recurring charges to your card. it's only for financial transactions. get over it.