Canadian University Students Expose Secret Camera In Vending Machines

The University of Waterloo in Canada is discontinuing the use of smart M&M’s vending machines from their campus after students found that the machines were secretly equipped with facial recognition technology, without students’ knowledge or consent. The controversy came to light when a student shared a photo on Reddit showing an error message on the machine, ‘Invenda.Vending.FacialRecognitionApp.exe Application Error.’ The unexpected discovery raised concerns among students and many questioned about the necessity of facial recognition in a vending machine. River Stanley, a fourth year student, delved into the matter for an article in the university publication MathNEWS. As students came up with creative ways to cover the camera hole, the university decided to remove these machines due to privacy concerns.

Investigation revealed that the smart vending machines, owned by MARS and manufactured by Invenda, were supplied by Adaria Vending Services Limited. During the process, the student uncovered that while some data collected by the smart vending machines were harmless, such as sales and UI performance metrics, the company can also gather more detailed data. This information can be sent to relevant parties, including Mars. Invenda’s sales brochures indicate that the machines have the capability to send estimated data like, ages and genders of every user.

In response to the controversy, Adaria Vending Services stated, “Machines do not take or store any photos or images and an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface. In partnership with Mars and Invenda, these machines are fully GDPR compliant and are in use in many facilities across North America. Adaria does not collect any data about its users and does not have any access to identify users of these M&M vending machines.”

The report further highlighted a past controversy involving Canada’s privacy commissioner and shopping mall Cadillac Fairview. Years ago, it was revealed that some of the mall’s information desks had secret facial recognition software. An official investigation exposed that over 5 million Canadians were scanned without consent. As a result, the mall was forced to delete the entire database.

In a conversation with CTV, River Stanley said, “It is a university campus, so I feel like the general demographic is young adults. You know, late teens, early twenties. The fact that it has been demonstrated to be against privacy legislation and in particular the lack of expressed meaningful consent to be against privacy legislation – that was something that I felt needed to be heard.”

The student further raised concerns about Invenda’s commitment to transparency, particularly using facial recognition activities in the smart vending machines. He also suspects that the company may be openly violating Canadian privacy law. In response, the University of Waterloo has taken swift action and requested the removal of all 29 machines from Invenda. The university has also urged them to disable their software.