It would be pretty simple to determine if tokens are unique per person - I agree that for many listed use cases in their documentation its not amazing, but with specific government oversight and watchdogs for the specific Florida use case I think technically it makes sense. Morally, still not a fan.