Regulating the storage and processing of private biometric data might be a more realistic approach than regulating technology - that database of millions of people's faces is pretty much the only boundary between recognizing your ten friends and mass surveillance; the tech is quite similar but the data matters a lot.