You surrender basic identifying information when you apply for a club card, and they have your picture to go with it right then.

Many people also surrender their information - and their friends' identities - when they click on faces on Facebook. Facebook has a massive facial recognition database. That information is sold to others. Remember - on Facebook, you are NOT a customer. You are the PRODUCT.