> sending footage off to a remote location (possibly diff country) to process the file for faces is a trivial side step

That's probably a break of the GDPR so it will still be against EU law and they are taking the GDPR pretty much seriously, so getting caught is going to be a real risk.

I'm sure there will be at least some attempts, but the legal framework to stop those exists.