People can take your picture, but there are longstanding legal privacy protections in place for how that picture can be used (for instance, commercial use is restricted). What I'm arguing is that those existing protections are no longer sufficient, and restrictions for use should include requiring having permission to include the pictures in databases as well.

But none of this is terribly relevant to the issue at hand. In this case, an actual transaction and apparent deception is involved.