Nine million faces, indexed for matching, readable by anyone with the URL. Nobody in the store was ever a customer.
No intrusion, no misconfiguration — a functioning business selling movement traces. From the traced person’s position the distinction is thin.