At Critical Link, we stock our kitchen with snacks – free snacks – so we’re a vending machine free environment.
Not that I have anything against vending machines.
Who among us hasn’t stood in front of one, looking through row upon row of goodies, debating whether to hit E2 (M&M’s) or B6 (Doritos), and hoping after you pressed your magic number (B6) that your snack (Doritos) gets released and you don’t have to wrestle with the machine to shake it loose?
But I haven’t given much thought to vending machine technology since they replaced the mechanical pull knobs with the state-of-the-art pushbuttons way back one.
As it turns out, vending machines have gotten smart. Really smart. Facial recognition smart.
I learned this after coming across an article about Canada’s University of Waterloo, which is replacing M&M/Mars branded smart vending machines on its campus with dumbed-down machines that aren’t gathering facial recognition data.
The issue emerged when a Waterloo student, innocently hoping to buy some M&M’s, saw an error message pop up that read “Invenda.Vending.FacialRecognitionApp.exe,” indicating that there’d been an app failure to launch.
This prompted the student to post a pic of the error message on Reddit and ask why a candy machine would have facial recognition.
The Reddit post sparked an investigation from a fourth-year student named River Stanley, who was writing for a university publication called mathNEWS.
Stanley sounded the alarm after consulting Invenda sales brochures that promised “the machines are capable of sending estimated ages and genders” of every person who used the machines—without ever requesting their consent. (Source: ArsTechnica)
When Silver reached out to them for a comment, Adaria Vending Services, which stocks and services the machines in question, they responded:
“…what’s most important to understand is that the machines do not take or store any photos or images, and an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface—never taking or storing images of customers.”
Further adding that the machines comply with the EU’s strict General Data Protection Regulation privacy law.
Invenda, which makes the machines, pointed out that their sensing app, despite its name (Invenda.Vending.FacialRecognitionApp.exe) is used for detection and analysis of “basic demographic attributes” and data like how long someone spends making their choice.
“The vending machine technology functions as a motion sensor, activating the purchasing interface upon detecting individuals, without the capability to capture, retain, or transmit imagery. Data acquisition is limited to assessing foot traffic at the vending machine and transactional conversion rates.”
I would think that much of the useful information you can get out of a vending machine can be gotten the old-fashioned way: counting the volume purchased of different items when the machine is being restocked. But more nuanced information would, of course, be useful to both Invenda and M&M/Mars. Analysis might yield intelligence on where to position the more valued items. Info on gender and age (which I’m assuming are among the basic demographics gathered) of those who look but doesn’t purchase could help them figure out how to capture the business of those non-purchasers.
Still, I don’t blame the students for not wanting vending machines smart enough to do surveillance on their campus.
The University of Waterloo, by the way, is a big STEM school, known for science, computer science, engineering, math…You gotta love the fact that it was the techies who jumped on this case and sleuthed it out!