They can require ID but it can't be the only method so if they don't pass face I can imagine that being the default