So, effective November 17 Paypal is going to apply changes that will collect everything about you, under the sun.

[Abnredleg]

27. The user is the source if they voluntarily choose to be

And this consent can be given through the options within your account.

As to your general question about acquiring data elsewhere, the issue is that there is a web of legislation out there dealing with biometrics and privacy, so there is no single source that will answer your question. For instance, the Driver's Privacy Protection Act (DPPA) of 1994 forbids the sharing of details of your driver's license, to include photo, except under limited circumstances.

More generally, the The Privacy Act of 1974 restricts the dissemination of personal records without your personal consent.

https://www.justice.gov/opcl/overview-privacy-act-1974-2020-edition

There is no national law (several states have passed such legislation, however) specifically regulating the collection and use of biometric data by private companies but privacy laws in general require consent. The issue in the past is that sometimes that consent was buried in boilerplate language in agreements people rarely read.

In short, it's complicated. My take on Pay Pal is not that they are making changes, but clarifying existing policies.