Canada’s University of Waterloo is dismantling smart M&M’s vending machines from its campus. Students discovered that the machines were secretly performing facial recognition without students’ consent.
The scandal began when a student under the pseudonym SquidKid47 posted on Reddit a photo of the error message on a campus vending machine: «Invenda.Vending.FacialRecognitionApp.exe». It probably appeared after the machine failed to run a facial recognition program that no one expected to be present in the machine.
«Hey, why do stupid M&M’s machines have facial recognition?.
Fourth-year student River Stanley set out to investigate a post on Reddit, which he wrote about for the university publication MathNEWS. Stanley raised the alarm after reading brochures from the manufacturer, Invenda, which promised that «the machines were capable of sending the approximate age and gender» of every person who used the machines without asking for consent.
This disappointed Stanley, who discovered that the Canadian Privacy Commissioner had investigated the activities of a mall operator called Cadillac Fairview years ago after discovering that some of the malls’ information kiosks were secretly «using facial recognition software on visitors».
It was only through this official investigation that Canadians learned that «more than 5 million Canadians who did not give consent» had been scanned into Cadillac Fairview’s database, Stanley said. Cadillac Fairview was eventually forced to delete the entire database, but the implications of collecting similar sensitive facial recognition data without the consent of other Invenda customers like Mars remain unclear. Stanley urged students to demand that the university ban facial recognition vending machines on campus.
University of Waterloo spokesperson Rebecca Elming eventually confirmed CTV NewsThe school has asked that the vending machine software be disabled until the machines are removed. Elming says the machines will be removed as soon as possible. She is not aware of any similar technology being used on campus.
Adaria Vending Services, the company involved in the installation of the machines, told MathNEWS how they work:
«It is important to understand that the machines do not take or store any photos or images, and an individual cannot be identified using the technology in the machines. The technology only acts as a motion sensor that recognizes faces so that the machine knows when to activate the shopping interface».
According to Invenda’s press release, M&M’s candy maker, Mars, has been a key part of Invenda’s expansion in North America. Only after completing a $7 million funding round, including deals with Mars and other major customers such as Coca-Cola, has Invenda been able to push for expansive global growth that significantly expands the data collection and surveillance capabilities of its smart vending machines.
But University of Waterloo students like Stanley are now questioning Invenda’s «commitment to transparency» in North American markets, especially because the company appears to be openly violating Canadian privacy law, Stanley told CTV News.
Source: Ars Technica