including both users and non-users who had no opportunity to consent to the capture of this data.
Ah... yes. Even if it's opt-in, the people in your photos didn't opt in. It's like what's happening with 23-and-me to some extent. They could potentially use that biometric data to build a massive facial recognition database of millions of people who have never uploaded a single photo to Google.