I am certain that someone will say, "In public there is no expectation of privacy". Would any law prevent an organization from creating a facial recognition sy

I am certain that someone will say, "In public there is no expectation of privacy". Would any law prevent an organization from creating a facial recognition system that could track the identity and location of all people, for anyone to use? I envision an API call that could query children by age, gender, physical characteristics, whether they are with an adult or alone. What could go wrong?