A set of smart vending machines at the University of Waterloo is expected to be removed from campus after students raised privacy concerns about their software.
The machines have M&M artwork on them and sell chocolate and other candy. They are located throughout campus, including in the Modern Languages building and Hagey Hall.
Earlier this month, a student noticed an error message on one of the machines in the Modern Languages building. It appeared to indicate there was a problem with a facial recognition application.
“We wouldn’t have known if it weren’t for the application error. There’s no warning here,” said River Stanley, a fourth-year student, who investigated the machines for an article in the university publication, mathNEWS.
A vending machine at University of Waterloo displays a facial recognition app error. (Reddit)
A picture of the error message was posted online and students quickly started sharing it around. Since then, many have tried to cover a small hole on the machine that they believe houses a camera.
“What students have been doing over the past two weeks is coming up with sticky tack, with chewing gum, with post it notes, doing anything to cover these sensors,” Stanley said.
“[I’m] kind of shocked just because it’s a vending machine, and I don’t really think they need to be taking facial recognition,” student Dilpreet Sandhu said.
Sandhu said once she found out about the machines, it made her question if there are other places this technology could be being used.
“It is a university campus, so I feel like the general demographic is young adult. You know, late teens, early twenties,” Sandhu said.
In an email, the company that provides the machines, Adaria Vending Services Limited, said: “Please be advised that we are a fulfillment service provider and do not own or manufacture these machines, nor have any access to this type of data from the machines.”
The machines are owned by MARS and the manufacturer is Invenda.
“Students started investigating,” Stanley said. “Over the next day, people are finding these sales processes where you can see this particular model vending machine comes with demographic data sensing capabilities.”
MARS did not respond to requests for comment from CTV.
Invenda also did not respond to CTV’s requests for comment but told Stanley in an email “the demographic detection software integrated into the smart vending machine operates entirely locally.”
“It does not engage in storage, communication, or transmission of any imagery or personally identifiable information,” it continued.
According to Invenda’s website, the Smart Vending Machines can detect the presence of a person, their estimated age and gender. The website said the “software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”
Students quickly spread word about the vending machines online, sparking the push to cover the holes and question what other machines have similar technology.
Invenda told Stanley the software is compliant with the European Union privacy law General Data Protection Regulation, but Stanley questions if it’s legal in Canada.
In 2020, an investigation from the federal privacy commissioner found embedded cameras inside Cadillac Fairview’s digital information kiosks used facial recognition technology to record over five million images of shoppers at malls without their customers’ knowledge or consent.
“The fact that it has been demonstrated to be against privacy legislation and in particular the lack of expressed meaningful consent to be against privacy legislation – that was something that I felt needed to be heard,” Stanley said.
The University of Waterloo said it is dealing with the situation.
“The university has asked that these machines be removed from campus as soon as possible. In the meantime, we’ve asked that the software be disabled,” University of Waterloo spokesperson Rebecca Elming said.
Stanley said if the University does not follow through with removing the machines, he will file a complaint to the Information and Privacy Commissioner of Ontario.