Various research institutions have internal rules concerning ethics of experimentation on humans (e.g. process of institutional review boards), and various res

Various research institutions have internal rules concerning ethics of experimentation on humans (e.g. process of institutional review boards), and various research grants have stipulations that research funded by those grants must follow such ethics rules, and various research publication venues have rules that they will only publish research that followed the rules. That being said, that's essentially a "voluntary initiative" by these organizations implemented because they choose to follow these ethics guidelines. These ethics rules aren't universal or legally mandated for everyone so if a private company wants to do some unethical research with its own funds, if they don't want to publish the research but just use and sell it, then that company is not legally required or forced to follow any ethical restrictions. Within the limits of law, they can be as unethical as their owners are. The solution to lack of ethics is legal restrictions and enforcement of them. A few USA states have limitations on facial recognition. In EU, GDPR would apply for a situation like this.