I think the degree to which there’s an expectation of privacy is a bit of a distraction from the core issue: Facebook is not claiming that you have any sort of legal agreement with them simply by appearing in your friend’s photo. They’re still going to use it to construct shadow profiles, of course, but if it somehow came up in court they’d say it was your friend’s responsibility to secure rights. It’s not great but what these manufacturers are doing seems to be even worse than Facebook, which is somewhat impressive.