How can it possibly be legal to 3D face scan a child, especially if it needs to be authenticated by a remote server somewhere.

I can only ever see option 1 working