[yasp]

Taking someone's photo is different than storing their biometrics. The latter would violate laws such as https://en.wikipedia.org/wiki/Biometric_Information_Privacy_...

[toomuchtodo]

So avoid being subject to the US jurisdiction, if applicable. Do not store data or operate the system from within the US, or any country within US reach.

https://owasp.org/www-community/Threat_Modeling_Process