Commercial speech is substantially less protected under First Amendment case law. You can't prohibit random individuals from declaring themselves a citizen journalist and recording people, but I think it would be entirely possible to pass a law saying private companies may not assemble facial recognition databases for sale to third parties.