A photo itself is not a violation. An identifying photo on the other hand could be.
"Identifying" a purpose could range from simply clustering visually similar photos using any number of non-machine-learning, non-biometrically-aware image processing algorithms, to using DNNs like FaceNet, or using the old eigenvector facial recognition algorithms of the 90s.
As soon as I upload a photo I took of you to a photo hosting system that has any kind of search functionality at all, the risk is raised that you can be categorized and identified somehow. Really, "consent" was broken not by the company, but by the uploader.
I really think the genie's out of the bottle on photos now. So many people are constantly photographing on their phones, and so many are uploading them to publicly accessible feeds all over the internet, that a federated crawler could already be built to track you, in fact, I think there's already some social media monitoring services that offer this.
If you're out in public, you should pretty much assume you have no privacy with regards to your imagery, GDPR isn't gonna save you. You can control your own photos, but you can't control what other people do of photos taken of you.
I suppose you can object and campaign for the EU to setup its own Great Firewall or something along those lines and only allow companies to operate within its borders which adhere to stringent rules around posted imagery. Good luck with that.
Europe isn't China, and the distribution of those photos isn't an existential threat to the government, so a Great Firewall is overkill.
Facebook has assets, operations, and revenue that originates in Europe that could be easily targeted with little controversy to gain compliance. If that doesn't work, Europle could always try to make the executive decision-makers personally liable. I'm sure Zuckerberg wants to be able to visit Europe in the future without being arrested.
That said, I don't take it as a given that will always be the case. I can imagine future US companies offering services that run sufficiently afoul of current or future regulations in the EU and other jurisdictions that it makes sense to just not offer them there.