I agree with that assessment.
To my mind, the act of capturing faces in and off itself isn't even the reason why he was investigated. Consent from members of the public is an entirely separate discussion.
This boils entirely down to him not having formal consent from Apple. He simply walked into the store and quite literally installed a small application on each Macbook without Apple's consent.
> I remember being a bit nervous on the first visit.
> Not because I thought I was doing anything wrong, or because I was worried about getting "caught". It was more like stage fright. It was a performance, and there was no telling what would happen next. I had made preparations, and I was excited to see the results.
> I walked into the store and pulled out my sketchbook. I made a map of the store, including all the tables, and counted how many computers were at each table. Each store has something like 50 machines. More than half were in use. I went to the first open computer and typed in a short URL to download the app. I looked around to double check that there were no terms of service I was missing. If there were, and if it said anything about "installing applications", I would have had to go back home and write an HTML5 or Flash version.
> The app was maybe two megabytes, and took 15 seconds to download. Sometimes I would open another tab and load Flickr or Open Processing so I had an excuse if someone asked why I was comparing every single computer. In the process, I learned there are in fact some minor differences between Java on the different machines.
> What was probably 10 minutes felt like 30. I looked at my sketchbook to make sure all the open computers were checked off, and decided that was enough. Hundreds of photos had already started pouring in. Before leaving, I sat on a bench for a few minutes to watch people. Thinking about their posture, their gestures, their expressions. Months later a friend would tell me, "those faces are synonymous with the faces we have when we are alone". We all really looked the same. I checked the upload page from my iPod to confirm that everything was running, and left the store.
Moreover, at some point, one of those devices was being serviced by a technician. His application took pictures at that time.
https://www.wired.com/2012/07/people-staring-at-computers/
All of that in and of itself would have been enough to be considered "crossing red lines and boundaries". It's staggering how he believed that taking pictures of persons was the bigger legal liability he was exposing himself to.
If anything, if he'd understood the importance of obtaining consent for using a publicly available terminal, the better option would have been taking his project to a public institution - public library, university, town hall,... - and have the application installed having up front legal consent and support from the collaborating institution.