I once told my colleagues that I didn't think they could find a photo of me on the web.
5 minutes later, one of them came up with a pic: it was a group photo of the company staff, taken a few weeks earlier (with me skulking at the back; I never wanted to be in the photo). It was in an article on the company blog.
Volume and lack of metadata is effective anonymity for most people in most circumstances if they've avoided doing anything that creates a public presence. But most people probably have photos at least on the web even if they didn't put them there.
