I may be naive and misunderstanding, but if a private entity is using facial recognition on their property, that doesn't appear to be prohibited? Like if a gym wanted to do a face scan to "log you in" that seems like that'd be permissible? I'm not a lawyer. I found the actual draft:

D.“Places of Public Accommodation”

1.means: Any place or service offering to the public accommodations, advantages, facilities, or privileges whether in the nature of goods, services, lodgings, amusements, transportation or otherwise.

2.does not include: An institution, bona fide club, private residence, or place of accommodation that is in its nature distinctly private.

https://static1.squarespace.com/static/5967c18bff7c50a0244ff...