It can be banned explicitly as a regulation on surveillance cameras. Like:

- The footage must be secured / only stored locally, and can only be used in legal proceedings or liability, and can be stored for maximum 1 (or a different number) year

- It cannot be sold or used to train AI or processed for marketing or other purposes without consent of all involved (in practice impossible).

- And no people cannot "agree" to things by just entering the premises or view

- It is illegal to make decisions based on illegally obtained (as per above) analytics, like refusing entry/membership/service, with a private right of action