In Brazil companies must have the purchaser's (natural person or company) tax ID for invoicing purposes. Point-of-sale in-person sales transactions don't require invoicing, just receipts, but any other commercial transaction does. Even returning merchandise that was bought with a receipt will require an inbound invoice and a CPF. Thanks tax evaders.

Maybe 30 years ago one could think of their CPF as a number to keep mostly private, but since a large part of the economy now goes through digital channels, a CPF is simply a person identifier rather than something secret.

Nobody trusts CPFs to be a secure identifier anymore. The backstop currently rests on biometric validation on B2C scenarios. For more secure purposes (like contracts) we have digital signatures backed by the gov.br infrastructure, which are widespread but requires acceptance by both parties, and also digital signatures backed by PKI like e-CPF and e-CNPJ that carries full validity by law and are equivalent to notarized signatures. Very few people have e-CPFs though.

To be honest, that information is already out there, people can track you by your full name already. The tech analogy is: CPF is just the primary key id in the Brazilian PERSON database, everyone gets one, and you use it on any API a person is needed (literally and figuratively). It should be public by design, just like a piblic crypto key, or a username handle

So you don't understand. Also not every country is a shithole that knowing even a SSN can result in identity fraud.