Oh Good, Vending Machines Are Tracking Our Movements

As if you aren't hangry enough when visiting the vending machine for a quick snack, you might now have a reason to get even grouchier. Ars Technica reports students at the University of Waterloo in Canada noticed recently that an M&M's vending machine on campus was displaying an unusual dialog box on the order screen. It stated that there was an application error for a file named "Invenda.Vending.FacialRecognition.App.exe," and while I'm no software engineer, I do recognize the words "facial recognition app." And as you can imagine, those students aren't happy right now.

As noted in the Morning Brew newsletter, the student who originally discovered the vending machine error message posted about it on Reddit in a thread titled "hey so why do the stupid m&m machines have facial recognition?" The question spurred a flurry of annoyed responses, including "Any pre-law students wanna start up a class-action lawsuit?" and "I HATE THESE MACHINES!"

It turns out that cameras in the machines are tracking customers' movements in much the same way that self-checkout kiosks do. The software powering the M&M's vending machine is made by Swiss-based company Invenda, and a post on startup acceleration company Y Combinator's Hacker News forum does some deeper digging. It links to a PowerPoint presentation from Invenda that boasts that its machines can track the "age and gender of your customers," and that it can "recommend the products that you want to push based on age, gender, time of day."

One of the University of Waterloo's student publications, MathNEWS, suggests that not only is this creepy, it could constitute an invasion of privacy. (Go student journalism!)

After MathNEWS contacted Invenda directly, the company's founder and chairman told the publication that although the machines do engage in real-time data processing of customer images, no information on the customer is stored locally, nor is any of it transmitted offsite to another location.

"It is imperative to note that the Invenda Software does not possess the capability to recognize any individual's identity or any other form of personal information," the Invenda statement says in part.

But the "frequently asked questions" sheet that Invenda attached to its response to MathNEWS does state that after it anonymizes its data (which includes estimated ages and gender), the analyzed information is then handed off to the company's clients. So, sure, names and faces might not exactly be "known" to Big Vending Machine, but Big Vending Machine is certainly keeping tabs on which students are stress-eating which snacks through finals.

All this sleuthing has led to some real-world change: All 29 of the vending machines on university grounds will now be disabled and eventually be removed from campus. I think next time I'm peckish in public I'll try my best to stick to a more analog machine. Even though my snack might get stuck on a metal ring or lodged in the retrieval compartment on its way out, at least it won't be trying to upsell me on some Famous Amos cookies to pair with my bag of Cheetos.