[German]An unpleasant story that went public come to light in Canada. An error message on the display of a vending machine from which you can buy sweets such as MMs or Mars bars prompted a student at a Canadian university to investigate. The result: vending machines from the Swiss company Invenda, which are installed in Canada by M&M or Coca-Cola, may contain cameras to recognize people. Anyone who buys something from the vending machine is recorded and evaluated by the camera. The aim is for the machine to be able to show the buyer targeted advertising on the display.
Invenda vending machines from Switzerland
The Invenda Group from Switzerland specializes in the manufacture of intelligent vending machines for retailers, vending machine operators or consumer brands. The manufacturer advertises these vending machines, which are equipped with a large display, on its website.
The vending machines are supposed to be intelligent and take the business to a new level in the digital age, as advertised on the manufacturers' websites. This is a topic that nobody normally deals with, apart from a few insiders.
An error message with consequences
At the University of Waterloo (Canada), a number of smart vending machines from Invenda have been installed. The vending machines are printed with M&M (Mars Wrigley) motifs on the front and allow students to buy Mars bars, chocolate and other M&M sweets via a large display.
In early February 2024, River Stanley, a fourth-year student at the university, came across a vending machine that was malfunctioning and displaying the error message "Invenda.Vending.FacialRecognitionApp.exe – Application Error" shown in the following tweet.
The student and probably some of his fellow students then began to investigate, as the Invenda.Vending.FacialRecognitionApp.exe entry in the error dialogue indicated that the machine was using facial recognition, which had failed. The research revealed that the vending machines do indeed have integrated facial recognition.
The comprehensive description of the vending machines can be downloaded here as a PDF. On page 6, the manufacturer writes that the vending machine analyses data in order to provide customers with the best possible sales success. This goes as far as recognizing the gender and age of users who have bought something from the vending machine. The vending machine is also likely to recognize people passing by in order to show them advertising tailored to their type on the display.
We wouldn't have realized if there hadn't been an application error. There is no warning here," said River Stanley, who investigated the matter for an article in the university magazine mathNEWS. After the photo of the error message was posted online, it went viral among the students. They began covering up a small hole in the machine, believing that the camera was located there. "Students have been using tape, chewing gum and post-it notes to cover up the sensors for the past two weeks," Stanley said.
Student Dilpreet Sandhu was shocked: "I'm shocked because it's a vending machine and I don't think they need facial recognition.". Enquiries to the company Adaria Vending Services Limited, which installs the vending machines at the university, did not lead anywhere. The company stated: "Please note that we are a fulfilment service provider and do not own or manufacture these machines, nor do we have access to this type of data from the machines."
The machines are owned by MARS and come from the manufacturer Invenda. However, the students quickly discovered that the machines were equipped with demographic data collection and analysis functions. From then on, the story went viral and the media sought comment. MARS did not respond to the enquiries. The Swiss company Invenda told Stanley in an email that the software integrated into the smart vending machines to recognise demographic data works completely locally. "There is no storage, communication or transmission of images or personal data," it continued.
The intelligent Invenda vending machines can recognise the presence of a person as well as their estimated age and gender. The company's website states that the "software processes the digital image maps derived from the optical USB sensor locally in real time without storing this data on permanent storage media or transferring it to the cloud via the internet."
Invenda informed Stanley that the software complies with the European Union's data protection regulation. However, I would put a question mark next to this, as it must be possible to recognize and identify people. Student Stanley wonders whether this approach is legal in Canada and where else the technology is being used.
In 2020, an investigation by Canada's federal privacy commissioner found that embedded cameras in Cadillac Fairview's digital information kiosks used facial recognition technology to record over five million images of customers in shopping centres without their knowledge or consent. Stanley believes that these machines and their functions violate data protection laws. This is particularly true because of the lack of explicit, meaningful consent.
The students are now demanding that the university remove the vending machines. The University of Waterloo (the name says it all) is now reviewing the process and options. CTV has published more details on this story here.
