• The University of Waterloo is expected to remove smart vending machines from its campus.
• A student discovered an error code that suggested the machines used facial recognition technology. 
• Adaria Vending Services said the technology doesn’t take or store customers’ photos.

A university in Canada is expected to remove a series of vending machines from campus after a student discovered a sign they used facial recognition technology.

The smart vending machines at the University of Waterloo first gained attention this month when Reddit user SquidKid47 shared a photo. The photo purportedly showed an M&M-brand vending machine with an error code reading, “Invenda.Vending. FacialRecognition.App.exe — Application error.”

The post drew speculation from some online users and caught the attention of a University of Waterloo student that tech news website Ars Technica identified as River Stanley, a writer for the local student publication MathNEWS. Stanley investigated the smart vending machines, discovering that they’re provided by Adaria Vending Services and manufactured by Invenda Group. Canadian publication CTV News reported that Mars, owner of M&M’s, owns the vending machines.

In response to the student publication’s report, the director of technology services for Adaria Vending Services told MathNEWS that “an individual person cannot be identified using the technology in the machines.”

“What’s most important to understand is that the machines do not take or store any photos or images, and an individual person cannot be identified using the technology in the machines,” the statement read. “The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface — never taking or storing images of customers.”

The statement said that the machines are “fully GDPR compliant,” referring to the EU’s General Data Protection Regulation. The regulation is part of the EU’s privacy legislation that determines how corporations can collect citizens’ data.

“At the University of Waterloo, Adaria manages last mile fulfillment services — we handle restocking and logistics for the snack vending machines. Adaria does not collect any data about its users and does not have any access to identify users of these M&M vending machines,” the statement said.

Invenda Group told MathNews that the technology does not store information on “permanent memory mediums” and that the machines were GDPR compliant.

“It does not engage in storage, communication, or transmission of any imagery or personally identifiable information,” Invenda Group’s statement read. “The software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”

MathNEWS reported that Invenda Group’s FAQ said that “only the final data, namely presence of a person, estimated age and estimated gender, is collected without any association with an individual.”

Amid the speculation, the University of Waterloo told CTV News that the school intends to remove the machines from campus.

“The university has asked that these machines be removed from campus as soon as possible. In the meantime, we’ve asked that the software be disabled,” Rebecca Elming, a representative for the University of Waterloo, told the outlet.

Representatives for the University of Waterloo, Invenda Group, Adaria Vending Services, and Mars did not respond to Business Insider’s request for comment sent over the weekend ahead of publication.

Facial recognition technology on college campuses is an ongoing tension point for students and staff members, with examples popping up globally. In May 2018, a school in China began monitoring students in classrooms with facial recognition technology that scanned every 30 seconds. Two years later, a woman on TikTok claimed she failed a test after a test-proctoring AI system accused her of cheating.

Tensions heightened in March 2020 when students at dozens of US universities protested facial recognition on college campuses, The Guardian reported.

“Education should be a safe place, but this technology hurts the most vulnerable people in society,” a student at DePaul University told the outlet.