How many people have a picture with their contact information for friends and family? My guess is a metric fuckton. Since they're allowed to access "contact information" then a few cross references of a different picture of you along with your name and phone number should be more than enough to add facial recognition data to your shadow profile. They can already guess who is in a picture of your friends. Why would this be any different?