I'm suspicious having seen how the GDPR is effectively being circumvented by making nonessential cookies more or less opt-out, and by making the process so annoying that the average person doesn't care enough to do it. It's a lot easier to enforce "not allowed" than "do it in a user-friendly way".

Plus, in a public place, how do you only apply facial recognition technology to a single person? It seems like in most cases, you must first apply it to everyone else nearby to discriminate them from anyone who opted in.