Could he do that though? I mean, hypothetically. I'm based in the EU so GDPR applies, and a picture of my face is definitely personally identifying info. So, unless I clicked something saying I consent to the data be stored/sold, I assume it would be illegal to do so.