The opt-in is at https://www.facebook.com/settings?tab=facerec -- I definitely remember intentionally opting in when it was added, and it's off on some of my throwaway accounts so I assume it wasn't auto-checked for everyone at some point.