Canada’s University of Waterloo is racing to remove M&M-branded smart vending machines from campus after angry students discovered the machines were secretly collecting facial recognition data without their consent.
The scandal began when a student under the pseudonym SquidKid47 posted an image on Reddit showing a campus vending machine displaying the error message “Invenda.Vending.FacialRecognitionApp.exe” after the machine failed to launch the facial recognition application. , and no one expected this to happen. The process of using a vending machine.
“Hey, then why do these stupid M&M machines have facial recognition?” mused SquidKid47.
The Reddit post sparked an investigation by a fourth-year student named River Stanley, who was writing for a college publication called MathNEWS.
Stanley sounded the alarm after reviewing the Invenda sales brochure, which promised that “these machines will be able to send the estimated age and gender of everyone who uses the machine” without asking for consent.
This dismayed Stanley, who discovered that the Canadian Privacy Commissioner a few years ago had investigated a mall operator called Cadillac Fairview and found that some mall kiosks were secretly “disguised” to unsuspecting customers. Use facial recognition software.”
Stanley reports that it was as a result of this official investigation that Canadians learned that “more than 5 million Canadians without their consent” had been scanned into Cadillac Fairview’s database. Cadillac Fairview was ultimately forced to delete its entire database, and the consequences of collecting similarly sensitive facial recognition data for Invenda customers like Mars without consent remain unclear, Stanley wrote.
Stanley’s report concludes by calling on students to demand that universities “ban facial recognition vending machines on campus.”
University of Waterloo spokesperson Rebecca Elming eventually responded, confirming to CTV News that the school had requested that the vending machine software be disabled until the vending machines could be removed.
Students told CTV News their faith in university administration has been shaken by the controversy. Some students claimed on Reddit that they tried to cover the vending machine cameras with gum or sticky notes while they waited for a response from the school. One student pondered “whether this technology could be used elsewhere” on campus.
Ermin could not confirm an exact timetable for the machines to be removed, telling Ars it would happen “as soon as possible.” Ermin declined Als’ request to clarify whether there are other areas on campus where facial recognition data is collected. She also wouldn’t confirm, as with any snack bars on campus, when students can expect the vending machines to be replaced by ones without surveillance cameras.
Invenda claims machines are GDPR compliant
The MathNEWS investigation tracked responses from the company responsible for smart vending machines on the University of Waterloo campus.
Adaria Vending Services told MathNEWS, “The most important thing to understand is that these machines do not take or store any photos or images, and the technology in the machine cannot be used to identify individuals. The technology acts as a motion sensor that detects faces, so the machine knows When the purchasing interface is activated, no image of the customer is captured or stored.”
Adaria and Invenda say students don’t have to worry about data privacy because the vending machines are “fully compliant” with the world’s strictest data privacy law, the European Union’s General Data Protection Regulation (GDPR).
“These machines are fully GDPR compliant and used in many facilities across North America,” Adaliya’s statement said. “At the University of Waterloo, Adaliya manages last-mile fulfillment services — we are responsible for replenishing snack vending machines. and logistics. Adaria does not collect any data about its users and does not have the authority to identify users of these M&M vending machines.”