You don't need an Id. For example, you can crawl the internet for selfies and then try and tie that face with the person it belongs to. With enough datasets you can start to put together a database of relevant people enough that it's okay to do deeper validation for the people you did not collect a face for.
replyIn addition to being illegal under GDPR, that's not going to work very well.
replyI don't look like the other people whose name I share.
Famously, neither does this guy: https://iammarkzuckerberg.com
> you can crawl the internet for selfies and then try and tie that face with the person it belongs to
replyYeeeah .. this is not the sort of thing that GDPR ought to allow, though.