"user A's ability to tag user B in a photo is controlled by user B."
On Facebook, it looks there's something alike - especially since it increases the reliability of identification, and minimize the effect of people loading and tagging fake images and people to deceive the system (I would suggest to tag everything, including cats, dogs, pigs, cows and crocodiles as "Mark Zuckerberg", altough I'm sure he's already have some built-in protection).
But to let B know user A tagged him or her, the system still has to process every face it finds. Are the data that doesn't match a user discarded, or are still used to build shadow profiles, albeit with less reliability about who is who?
This issue is a big one, because usually you don't go around with your face hidden - unless you're some Muslim women - it could become a new kind of unisex fashion, if Facebook & C. are not stopped in time...