I think the difference is not in how many people you can recognize, but what you do with the information.

* All existing laws should protect children, and protect people from discrimination. It should prevent the disclosure of health records. (So no AR apps that let you see who has what disease)

* The main concern is tracking people's location and movements and taking photographs and tagging people on social media sites.

* Some potential benefits are reducing crime and a "call parents" app that lets you call the parents of a misbehaving child without actually identifying the child to the person who has the app.

Regulating the storage and processing of private biometric data might be a more realistic approach than regulating technology - that database of millions of people's faces is pretty much the only boundary between recognizing your ten friends and mass surveillance; the tech is quite similar but the data matters a lot.

Yeah but this seems like a kind of pointless side-channel. Let's just assume that by the time this hits legislation the restriction will be on applying facial recognition and storing data on people's faces. Yeah we know you can implement it, we all did the coursera course on convnets.

The police already has the millions of faces databases. So does customs, border patrol, the IRS, and more.