I misunderstood. Would you eliminate Facebook and the existing ALPR data aggregators? I am wondering how such restrictions would be possible.

You would come up with a decent legal definition of a surveillance camera with a distinction from a person taking pictures. You would add disclosure provisions, if an observed person could reasonably be expected to see and make a choice (say entering a business) there would be one set of rules, when a person couldn’t see a notice or make a choice (say a camera on a vehicle) there would be much more restrictive rules.

You would make it a crime to violate the rules but administered like and possible to sue in civil court for victims. The crime would be on the owner/operator of the camera and special provisions would be added for storage providers.

Would that prevent Facebook from doing recognition on photos of strangers taken by users? Would that make existing ALPR aggregators illegal?

Yes, we can imagine some set of laws that would make the aggregation impossible. I don't see how they could be effectively created and enforced.