I don't see how you can enforce no face scanning if you allow security cameras.
If we define face scanning as specifically doing facial-recognition over multiple cameras, stores and/or time, then it's quite clear and simple.
A store could easily have security cameras operating without issue. They don't need to do any more smarts on it.
It's where you draw the line on smarts that's the thing.
- Person-shaped-object crossed from public-area to private area (eg through a staff-only door) without a corresponding door swipe event.
- Person-shaped-object appears to take an object off a shelf and put it in their bag/pocket.
- Specifically tracking a person over multiple cameras in one visit as they navigate the store, without associating with an identity
- Using facial recognition to recognise the same person over multiple visits/stores, and being able to track their activity over all of those visits.
There could be arguments for some of these being permitted without it being a total invasion of privacy.
Make it illegal. Give rewards for anonymous tips that lead to prosecution like it already exists for IRS tax fraud tips.