I think what is potentially more interesting is hashing or running OCR against photos slowly over time. Even scanning photo metadata and collecting the geolocat

I think what is potentially more interesting is hashing or running OCR against photos slowly over time. Even scanning photo metadata and collecting the geolocation of all of them seems like a relatively small amount of data (the type that wouldn't trash your data plan) for significant value. If you hash a photo and it gets uploaded somewhere you can potentially tie a private account to a public one. With geolocation you could potentially find people who have taken a picture on or near a military base. You could collect people within commuting distance. Photos of receipts or legal documents could inform you of financial statuses. With facial recognition you could create a social graph. You can get a lot of information just by processing the photos without them ever leaving your device. Timestamps and device info (including devices of friends who send you photos), could potentially be weaponized against a person a well.