This brings up a very interesting and important question around differential privacy.

If I scrape millions of photos from Facebook (including yours) then train a differentially private model that can extract features from a new face, is that a privacy violation?

A differentially private model is one in which you cannot identify the inclusion of any single datapoint which means you cannot tell the difference between a model trained on the dataset and the same model trained the same dataset with the addition of your one datapoint.

You might argue it’s a privacy violation because the scraping process might involve people looking at your images but if that was fully automated and nobody ever looked at your images - the model can be trained then the data inmediately deleted...