Facebook's facial recognition feature probably won't find too many smiles in Germany, where federal regulators are challenging the social network to change its ways, or face the consequences. On Tuesday, Hamburg's Data Protection Authority (DPA) sent a letter to the company, advising it to obtain user permission before harvesting biometric data, as outlined by EU privacy laws that require consumer consent. As it stands right now, users can opt-out of the photo-tagging function by tinkering with their privacy settings, but the DPA claims that's still too invasive, and has "repeatedly" asked Facebook to shut down the feature altogether. Zuckerberg & Co. now have two weeks to respond to the letter, and could face a fine of up to €300,000 (about $427,000) if a compromise isn't reached. In a statement, company spokeswoman Tina Kulow said, "We will consider the points the Hamburg Data Protection Authority have made... but firmly reject any claim that we are not meeting our obligations under European Union data protection law."