[nryoo]

The EU angle is interesting but the more immediate concern is the opt-in/opt-out framing. Google historically defaults these features to on and buries the toggle — did they actually make face data access opt-in from the start, or is this another "we'll notify you and assume consent" situation? The GDPR enforcement gap between announcement and actual compliance has been wide enough to drive a truck through.