Right. That's Facebook's compromise on privacy. EPIC is suing them over even that.[1]
Face.com did facial recognition on Facebook with no limits back in 2010.[2] Then Facebook bought them and killed the broad face recognition.[3]
There are other face recognition companies now, but they're keeping a lower profile about how broad their database is. Except for Findface[4] in Russia. They loaded up the entire photo database of Vcontact, a social network in Russia. 70% success in identifying random young people on the St. Petersburg metro.
I tested Findface and it was unable to find my Vkontakte account, despite a copious amount of photos on my account there. It did, however, find a huge number of Russians that I would say look exactly like me. Also, strangely, a couple of Vkontakte accounts that had Agent Gibbs as profile pics. It's a pretty cool app!