A hot potato: Collecting personal biometric data through facial recognition or other methods for advertising purposes has long been controversial. However, most people don’t expect a vending machine to gather this type of personally identifying information (PII). Surprisingly, someone discovered an M&M machine on a Canadian university campus doing just that without students’ knowledge nor consent.

The University of Waterloo in Ontario, Canada, began removing its vending machines after discovering facial recognition technology on one of them. The machine’s operators and manufacturers deny collecting or selling biometric data, but a prior case in the country gives students reason for alarm.

Student and Redditor “SquidKid47” posted a photo of an error message on one of the college’s M&M machines showing that a program called “Invenda.Vending.FacialRecognition.App.exe” had crashed. A subsequent investigation by a campus newspaper sparked outrage among students, prompting the school to order the campus’s vending machines’ removal.

Vending machine manufacturer Invenda advertises analytic services that provide operators with data on purchasing habits based on estimated age and gender, indicating that the machines have biometric recognition systems. The university outlet suggests the company could send customer data to M&M’s parent company, Mars.

Believing the vending machines host small cameras, students began covering them with items like chewing gum and Post-it notes while demanding their removal. The school’s administration hasn’t offered a clear timeline regarding the removal and replacement of the machines.

Adaria, the machine’s operator, claimed it only has motion sensors to activate it (wake it up) when it detects a person. Invenda and Adaria said that the machines don’t take, store, or transmit any photos or videos of customers. However, Invendia admits it locally processes “digital image maps” from a camera.

According to a GDPR-compliant process, Invenda’s general advertising claims to only record anonymized data. Still, another company in Canada was caught using similar technology to break privacy regulations on a massive scale.

An official investigation by privacy officials in 2020 found that, in 2017 and 2018, Cadillac Fairview used cameras hidden in kiosks to collect the images of over five million shoppers in malls across Canada without their knowledge or consent. While there is no direct connection between Cadillac Fairview and Invenda, recalling the incident sparked debate among Waterloo’s students on whether to take Invenda or Adaria at their word.