Were Facebook's lawyers asleep at the wheel for this one? It seems like they could have thrown in a clause about "pictures uploaded may be subject to facial recognition software" and no one would have batted an eye. How is it possible that they dropped the ball so hard here?
I wouldn't be surprised if they had that. They also could've added a clause that Facebook now owns your house, and it'd probably be roughly as interesting to a court.
The fact is that many things buried in EULAs and whatnot are not really enforceable nor constitute consent. Some things have to be agreed to more explicitly than putting them on page 50 of your fine-print.
It's especially problematic when companies start doing something you didn't directly sign up for or couldn't have expected to happen when you did. I don't think that many people who signed up for a social network in 2015 expected that their photos would later be scanned. It might surprise people even now.