What value does a recognition have? Is it just metadata they can act on in the moment? AKA age, height, race, gender? Are you ok with them knowing it is you by name or a assigning some UID to you as a person and keeping metadata? What about a hash of your facial pattern? How do they know if they've seen you before?
To a lot of FR programs they want to be able to analyze their customer breakdown. They want to know more than just crowd information. Given that we regulate the storage of medical information so highly right now, and you can infer based on purchase practices whether an individual has certain medical issues, I can see regulation being needed. But it raises a lot of questions about how to realistically regulate a system like this.
I'm by no means saying "don't regulate." but we need to be thoughtful about how we proceed so that regulations have few loopholes and protect citizens from both corporations leaking data and the government tracking individuals needlessly.