Facial recognition software discovered in college campus vending machines

Daniel Sims

Posts: 1,370   +43
Staff
A hot potato: Collecting personal biometric data through facial recognition or other methods for advertising purposes has long been controversial. However, most people don't expect a vending machine to gather this type of personally identifying information (PII). Surprisingly, someone discovered an M&M machine on a Canadian university campus doing just that without students' knowledge nor consent.

The University of Waterloo in Ontario, Canada, began removing its vending machines after discovering facial recognition technology on one of them. The machine's operators and manufacturers deny collecting or selling biometric data, but a prior case in the country gives students reason for alarm.

Student and Redditor "SquidKid47" posted a photo of an error message on one of the college's M&M machines showing that a program called "Invenda.Vending.FacialRecognition.App.exe" had crashed. A subsequent investigation by a campus newspaper sparked outrage among students, prompting the school to order the campus's vending machines' removal.

Vending machine manufacturer Invenda advertises analytic services that provide operators with data on purchasing habits based on estimated age and gender, indicating that the machines have biometric recognition systems. The university outlet suggests the company could send customer data to M&M's parent company, Mars.

Believing the vending machines host small cameras, students began covering them with items like chewing gum and Post-it notes while demanding their removal. The school's administration hasn't offered a clear timeline regarding the removal and replacement of the machines.

Adaria, the machine's operator, claimed it only has motion sensors to activate it (wake it up) when it detects a person. Invenda and Adaria said that the machines don't take, store, or transmit any photos or videos of customers. However, Invendia admits it locally processes "digital image maps" from a camera.

According to a GDPR-compliant process, Invenda's general advertising claims to only record anonymized data. Still, another company in Canada was caught using similar technology to break privacy regulations on a massive scale.

An official investigation by privacy officials in 2020 found that, in 2017 and 2018, Cadillac Fairview used cameras hidden in kiosks to collect the images of over five million shoppers in malls across Canada without their knowledge or consent. While there is no direct connection between Cadillac Fairview and Invenda, recalling the incident sparked debate among Waterloo's students on whether to take Invenda or Adaria at their word.

Permalink to story.

 
An "outrage" would involve burning all those machines right on the spot, and rightfully so!

Otherwise, this all sounds like a bunch of p-ssies... oh, it's not good, oh, it is bad ...

south-park-mc-mackey.gif
 
Last edited:
If people start smashing these machines on sight, demanding the tech be removed, the tech will be removed. Just sayin'. Learn from the French!
So long as you and the French are willing to accept consequences for your actions. Personally, unplugging and refusing to buy any vending M&Ms seems far more effective, along with publicizing the issue and extracting whatever civil remedies are available. I don't intentionally break things, not even when I was a child.
 
If people start smashing these machines on sight, demanding the tech be removed, the tech will be removed. Just sayin'. Learn from the French!
I think you would have been happier in 1800s England:

"...The first major instances of [smashing the new weaving looms] took place in 1811 in Nottingham, and the practice soon spread across the English countryside. Machine-breaking Luddites attacked and burned factories, and in some cases, they even exchanged gunfire with company guards and soldiers. The workers hoped their raids would deter employers from installing expensive machinery..."

 
An "outrage" would involve burning all those machines right on the spot, and rightfully so!
An ATM machine snaps of photo with every transaction, and rightfully so. And if you walk into -- or even just through the parking lot -- of any Quick-Mart type store that sells the same products as these vending machines, you'll be not just photographed, but videotaped as well. Why should this be any different?
 
An ATM machine snaps of photo with every transaction, and rightfully so. And if you walk into -- or even just through the parking lot -- of any Quick-Mart type store that sells the same products as these vending machines, you'll be not just photographed, but videotaped as well. Why should this be any different?
That data is stored for security and not sent off to a 3rd party to do with as they please.
 
We can't track all the tracking... Govs regulation is allways catching up... Privacy cause is a lost one, they should at least somehow pay us for all the tracking... Give me free Deezer or ad free youtube and we are even, track me good.
 
If people start smashing these machines on sight, demanding the tech be removed, the tech will be removed. Just sayin'. Learn from the French!

Getting kicked out of university and given the value of the machines going to prison not jail seems a bit of an over-reaction.

Sucks to live in Western Canada as who even knew there were vending machines that only sole M and Ms?

I could buy the idea that there was a use for this data and it needed to include facial recognition if the why of that part could be explained.

Is there a will buy M and Ms at any cost facial look and if so considering they did not seek permission so cannot do post analysis interviews if there is and they were seeing it how would they know?

I'd rather learn from the Portuguese whose charts of the coastline here are so precise they cannot be bear to this day. At least there is something non-criminal to learn from that
 
That data is stored for security and not sent off to a 3rd party to do with as they please.

Plus and this is probably key as far as can you do this without consent - banks have signs, Places without signs have clear cameras. Although they often also have signs as they are trying to deter crime and signs help. Low hanging fruit all around.

The third party is huge too.

In order to get biologics for my arthritis due to not being a billionaire my province seems to have decided even for older one where the price has dropped a lot they pay 75 percent and the company pays the other 25 percent. This is often unaltered by extended health due to protections against the cost of catastrophic illness and if you qualify for a surprisingly expensive medication you have one.

You wind up enrolled in a program that in it's terms where the data is stored coulld change so even if the company does not use the US for data storage ( I think super lax laws including allowing for it to be moved to other jurisdictions is why non- US companies seem to a lot ) it might change,

My arthritis can kill me but it doesn't get more private than detailed medical given people have known who I am from papers that only fiocus on one thing - if only being a medical mutant was better compensated.

I use automated tellers after hours or did when you couldn't pay even the Ice-cream truck with a debit card, Still some cash matters, It is in my best interest that if hold ups are happening the offenders are caught so they don't thinjk it is a good idea,

If we had these magical machines with just M and Ms in Western Canada one ethical standard beyond awareness and consent is the subjects benefitting, Not one so big to say the other things don't matter but I do benefit from crimes in those alcoves being quickly solved and they tend to be,,.

There could be legitimate uses of cameras in vending machines given some purchases hang more than others - so in the machine - but biometrics don't change. Only having not the same word from any one making a statement is no assurance it is even for use by the Mars company ,

 
Back