I’m not exactly shocked that it could exist. But this usage (beyond the scope of processing barcodes) seems like it couldn’t be construed to fit into the normal avenues of data collection under a privacy policy. Also with regard to training specifically, this policy was created in late 2020 so I don’t know how it would cover generative models.