> PII may only be processed if you have explicitly consent for the exact purpose you want to use it for.

Not exactly. Consent is one of six allowed ways to process PII. It’s just that for advertising/tracking use its probably the only one that you can use.

And biometrics (which would include images of faces) are a special category of data with stricter restrictions.

Can you back your claim? Its true that the data is still personal but a lower level of protec to ion is applied. Except for children as i remember. There is need for notification but exceptions if not realistically feasible . Sorry on my phone with child sleeping in my arm.

Here is an article I could quickly come up with in English

https://iapp.org/news/a/publicly-available-data-under-gdpr-m...

Just saw that data used for biometric purposes is under special protection beyond typical pii. That seems to be the basis for current investigations.