In the EU they have.

Pictures of people, especially once they are identified, are person related data. And there are strict rules on how companies can collect / generate / process / transfer this kind of data.