I think this doesn't go far enough. The problem isn't just okcupid, problem is the data. Any company they sold face data to should be required to delete it, it should be treated as receiving stolen property that must be returned. The users of the site did not consent to have their faces shared with the database companies, so the only true redress for the users is to get those faces out of the database.