Vending machines had eyes all over this Ontario campus until the students wised up

An Ontario university is pulling dozens of vending machines that were tracking the ageand gender of customers in the latest example of pushback against technology that tests the boundaries of privacy rules.

The move comes amid opposition from University of Waterloo students, who became aware of the technology after a Reddit user spotted an on-screen error messageon one of the machines earlier this month, about an apparent problem with its facial recognition program.

"The natural question that follows there is, 'Why does it have a facial recognition app? How can this error even exist?'" said River Stanley, a fourth-year computer science and business student who broke the story in the campus journal mathNEWS.

The university says it has asked that all 29 machines, from the Switzerland-based company Invenda,be removed "as soon as possible," and that the software bedisabled in the meantime.

"We thank our students for bringing this matter to our attention," said universityspokesperson Rebecca Elming.

She did not respond to a followup question from CBCNews about whether the university was planning to change its procurement processif machines with facial analysis technology were showing up unbeknownst to administrators.

WATCH | Stanley says it's a problem students discovered the error by coincidence:

Error message outed campus vending machines with facial recognition

6 months ago

Duration 0:24

University of Waterloo student River Stanley says it's a problem that students only found out about the facial analysis vending machines by coincidence.

Invendasays themachines use facial analysis, not facial recognition, software, and that it isn't storing data or photos.

The company says its technology is mainly used to tell when a person is standing in front of a vending machine, and to changethe screen from "standby" mode, which shows ads, to "sales" mode, which shows different products.

Critics say that explanation isn't good enough, and that customers should know whether they're being watched and be given the choice to opt in.

"There was no [camera] marking on these vending machines at all," said Stanley.

Stanley investigated further, contactedthe vending machine operator and Invenda, andpublisheda story that was later picked up by CTV Kitchener.

Approximately 100 Invenda vending machines have been shipped to Canada, the company said, although it's not clear if all of them have been installed.

No one from Invenda was available for an interview Monday, a spokesperson said, but in an email the company emphasized that its software is used for people detection and facial analysis, not facial recognition (though the company's CEO has previously referred to it as "facial recognition" in a 2020 promotional video).

"People detection solely identifies the presence of individuals whereas, facial recognition goes further to discern and specify individual persons," the statement said.

The machines can "only determine if an anonymous individual faces the device, for what duration, and approximates basic demographic attributes unidentifiably."

The company said those "basic demographic attributes" include age and gender information that one privacyadvocate says would help retailers decide which products are most likely to sell.

"No point putting products in the vending machine that aren't going to sell, take up space and just cost money to throw out when they're stale," said Sharon Polsky, president of the Privacy and Access Council of Canada, who is based in Calgary.

"From a business perspective, it absolutely makes sense."

The technology is not currently commonin Canada, the Canadian Automatic Manufacturing Association said in a statement.

As retailers become hungrier for consumer insights and technology becomes better able to deliver those insights, retail analyst Doug Stephens says it's unlikely that even a significant consumer backlash will stop other companies from trying similar tactics.

"The genie is kind of out of the bottle here," said Stephens, founder of the Retail Prophet. "I don't see this [technology] as being something that's simply going to go away."

Stanley, the student,likened the situation to the real estate company Cadillac Fairview's use of similar technologyindirectory displays in some of its malls.

That company advanced a similar argument in its defence thatit used the technology to monitor foot traffic patterns and predict demographic information about mall visitors.

A joint investigation by the federal, Alberta and B.C. privacy commissionersfound in 2020that while Cadillac Fairview collected "numerical representations" of faces suitable for facial recognition, there was no evidence it used these representations to identify specific people.

But investigators took issue with how the images were stored, and said the company did not obtain meaningful consent from customers ahead of collecting their images. Cadillac Fairview said it stopped using the technology.

Polsky, for her part, wants to see a similar investigation into the Invenda machines and stricter privacy legislation overall. She also applauded the University of Waterloo students for figuring out the software embedded in their vending machines.

"It's terrific that people are noticing these affronts to our privacy and not just shrugging [their] shoulders and saying 'Not a big deal,'" she said.