People can take your picture, but there are longstanding legal privacy protections in place for how that picture can be used (for instance, commercial use is restricted). What I'm arguing is that those existing protections are no longer sufficient, and restrictions for use should include requiring having permission to include the pictures in databases as well.

But none of this is terribly relevant to the issue at hand. In this case, an actual transaction and apparent deception is involved.

EDIT: I guess you're reacting to my "it can't be" comment. That was an expression of personal outrage at the idea of being placed in a powerless position, not an assertion of fact. All kinds of really terribly things are possible, obviously.