A picture of a person is personal data (Art. 4, (1)). Applying an algorithm to it in order to guess age/sex is processing it (Art. 4, (2)). Therefore, the GDPR applies and you need a lawful basis, per Article 6.

If you reply it doesn't apply because the stored information is anonymized, I quote UK's ICO:

"You should also note that when you do anonymise personal data, you are still processing the data at that point."