It's worse -- these CPF numbers have nothing special but a simple checksum at the end. It is trivial to generate them and, if we get a used one, check the actual owner from our IRS website.
So we can assume everyone with bad intentions will simply use one from anyone else and the law will have no effect on criminals but will terrorize people who need/want to keep their PII private. Also, I suppose everyone will infringe that law at some level, opening the door to selective prosecution of "undesirables" or someone opposing the powers that be.