Disclosure is insufficient to prevent aggregation. The same kind of people who sold browsing data to advertisers are selling this data. If you do not want to be tracked, you have to get those around you to not provide the data.

That would be why i listed many things more than disclosure.

I misunderstood. Would you eliminate Facebook and the existing ALPR data aggregators? I am wondering how such restrictions would be possible.

You would come up with a decent legal definition of a surveillance camera with a distinction from a person taking pictures. You would add disclosure provisions, if an observed person could reasonably be expected to see and make a choice (say entering a business) there would be one set of rules, when a person couldn’t see a notice or make a choice (say a camera on a vehicle) there would be much more restrictive rules.

You would make it a crime to violate the rules but administered like and possible to sue in civil court for victims. The crime would be on the owner/operator of the camera and special provisions would be added for storage providers.

Would that prevent Facebook from doing recognition on photos of strangers taken by users? Would that make existing ALPR aggregators illegal?

Yes, we can imagine some set of laws that would make the aggregation impossible. I don't see how they could be effectively created and enforced.