“The settlement carries no financial penalty. Three million users’ photos, demographic profiles, and location data were funneled to a facial recognition company with zero restrictions on use, and the regulatory consequence is a promise not to lie about it again.”