[closewith]

It's unlawful as it means you lose the household exemption, and so need a legal basis for the processing. You also need to inform others of the data collection in advance, the purpose for which the data is collected, and the contact details of the data controller.

Private ANPR-equipped vehicles are rare (and outright illegal in some EU states), but when you see them they'll have large decals with the above information on all sides.

Facial recognition is considered biometric data, which is special category data under the GDPR and forbidden to process except in very strict circumstances. Apart from law enforcement/government, it is more or less impossible to lawfully process biometric data with informed consent from the data subject. The household exemption does not apply.