That part happens, then when tagged with a name and or other data that is stored as well. So if a non user then signs up they are informed of the photos they are tagged in.
It’s unclear though if Facebook attempts to create an identity for the unknown person, or if it just ignores unrecognised faces until a new user uploads a photo of themselves. All of this should be laid out in Facebook’s privacy policies but it’s simply not there
From my understanding and from FB themselves they admit to non user tracking. They create a unique ID (fingerprinting) regardless if a user or non user and this ID is used as part of the FB tracking system. This is why there are extensions made that block the FB data gathering such as Facebook Container & Disconnect for Facebook
Every website that has a Facebook ‘like’ button reports back to Facebook on both users and non-users. This is one of many good reasons to employ an ad-blocker.
Even without a Like button, many websites have facebook cookies attached. Even the venerable ABC. Its disappointing. Basically, any website which has a facebook presence will have fb cookies.
Move along folks. Nothing to see here.