Stunned Students Discover Vending Machines Secretly Using Facial Recognition Tech

A Canadian university will remove several M&M-branded smart vending machines from campus after an error message on one machine revealed to students that it was secretly collecting facial recognition data without their consent.

Students attending the University of Waterloo became aware of the technology after a Reddit user posted an image of the error message displayed on a machine earlier this month. 

The message read, "Invenda.Vending. FacialRecognition.App.exe — Application error."

River Stanley, a fourth-year computer science and business student, investigated the incident and wrote about the discovery in the campus journal MathNews.

***Please sign up for CBN Newsletters and download the CBN News app to ensure you keep receiving the latest news from a distinctly Christian perspective.***

"The natural question that follows there is, 'Why does it have a facial recognition app? How can this error even exist?'" he said. "We wouldn't have known if it weren't for the application error. There's no warning here."

Students on campus began to share the story and it has sparked outrage. 

"[I'm] kind of shocked just because it's a vending machine, and I don't really think they need to be taking facial recognition," student Dilpreet Sandhu told CTV News.

"It is a university campus, so I feel like the general demographic is young adult. You know, late teens, early twenties," she added. 

Stanley learned that Mars, the owner of M&M's, owned the machines, but the machines are provided by Adaria Vending Services and manufactured by Invenda Group, a Switzerland-based company. 

When pressed about the machine's facial recognition feature Invenda told MathNews, "the demographic detection software integrated into the smart vending machine operates entirely locally."

"It does not engage in storage, communication, or transmission of any imagery or personally identifiable information," it continued in a statement.

Adaria Vending Services also told MathNews that "an individual person cannot be identified using the technology in the machines."

"The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface — never taking or storing images of customers," the statement said. 

However, according to the Invenda website, the Smart Vending Machines can detect the presence of a person, their estimated age, and gender.

The University of Waterloo pledged in a statement to remove all 29 Invenda machines "as soon as possible," and that in the interim, it had "asked that the software be disabled."

"We thank our students for bringing this matter to our attention," said university spokesperson Rebecca Elming. 

In the meantime, students have gone to great lengths to protect their identity while the school works on removing the machines.

"What students have been doing over the past two weeks is coming up with sticky tack, with chewing gum, with post-it notes, doing anything to cover these sensors," Stanley said.