That's literally why we have GDPR. This will be very illegal and the law itself specifically bans user identification with camera on top of the stuff protected by GDPR.

The enforcement of GDPR is more or less nonexistent for big companies. Even if they get fined, that is just cost of business for them.

In the text nothing prevents the manufacturer to stream the vide of your face to their servers all over the world and do the image processing there. It would even comply with GDPR if everybody pinky promised they not using that data for anything else.