Complaints filed with privacy commissioner over facial recognition vending machines

Two complaints have been filed with the Office of the Information and Privacy Commissioner of Ontario over facial recognition software in smart vending machines on the University of Waterloo campus.

The machines, located in places like the Modern Languages building and Hagey Hall, sell chocolate and other candy.

Earlier this month, a student spotted an error message that appeared to indicate that there was a problem with a facial recognition app.

A vending machine at University of Waterloo displays a facial recognition app error. (Reddit)

A photo of the message was shared online and, in response, students starting putting Post-it notes and other objects over what they thought was a camera.

River Stanley, a fourth-year student who investigated the machines for the university publication mathNEWS, said her peers still weren’t satisfied.

“Over the next day, people are finding these sales processes where you can see this particular model vending machine comes with demographic data sensing capabilities," she told CTV News on Feb. 22.

The machines are owned by a company called MARS. The following statement was sent to CTV News: "Mars takes the privacy of personal identifiable information extremely seriously and strictly complies to local, federal, and global privacy regulations and therefore, Mars only engages with partners who also meet this same standard. The vending machine technology, which uses motion sensors without collecting personal identifiable information, focuses solely on detecting presence, analyzing foot traffic patterns, and transactional conversion rates. "

The manufacturer, Invenda, told Stanley that “the demographic detection software integrated into the smart vending machine operates entirely locally. It does not engage in storage, communication or transmission of any imagery or personally identifiable information.”

Invenda’s website states that the vending machine can detect a person’s presence, their estimated age and gender. It also says the “software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”

The Office of the Information and Privacy Commissioner of Ontario has not said who filed the complaints.

“Given that we have open files on this matter, we cannot provide additional details at this time,” a statement to CTV News read. “However, until we have examined the circumstances, we urge all public institutions that are using, or contemplating using these machines to ensure that they comply with FIPPA regarding the collection, use and disclosure of any personal information. Ensuring compliance with privacy laws is not just a legal obligation but a commitment to safeguarding the personal information of Ontarians and ultimately maintaining their trust in public institutions.”

“The university has asked that these machines be removed from campus as soon as possible. In the meantime, we've asked that the software be disabled," University of Waterloo spokesperson Rebecca Elming told CTV News on Feb. 22.

A similar case happened back in 2020 when cameras were found embedded inside Cadillac Fairview’s digital information kiosks. Those machines were found to have recorded over five million images of shoppers without their consent.

- With reporting by Colton Wiens