But selfies would be pretty unambiguous, no? Maybe even enough to get the ball rolling on a class-action, if enough Californians requested their data and got back a bunch of selfies.

I'd also like to see what would happen if Europeans reported them to their data protection agencies. Nothing will happen to the company, since it's in the US, but it might make the life of the execs hard if they ever wanted to do business in Europe.