If you actually read the full text of the law, it states:

" "Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples, [...] "

So if it's just pictures of faces, then it's okay. If, however, at any point in the pipeline the actual facial geometry is calculated or stored, that might be a violation.