Always strive to learn something useful. --Sophocles

This is a question being asked at the University of Waterloo (Canada) right now as the machines are being planned for removal.

If you're into IT like I am, or like reading computer security newsletters that show error screens of crashes or failure to loads, a student noticed a screen at one such vending machine on campus that showed a classic Windows error dialog that said "Invenda.Vending.FacialRecognitionApp.exe", and he asked the question 'WTF is facial recognition software doing on a vending machine?' Subsequent casual browsing of Invenda's web site found a sales brochure that "... promised "the machines are capable of sending estimated ages and genders" of every person who used the machines without ever requesting consent." While Canada may not have Europe's GDPR, their privacy laws come pretty darn close, especially on facial recognition. And the fecal matter impacted the rotary impellers.

Now, I'm going to play Devil's Advocate here as a programmer. They could be using this app to simply detect 'Hey! Someone is standing in front of the machine! Let's turn on the lights and do our little dog and pony show and try to entice them into buying something!' without storing or transmitting any biometric information whatsoever. It could be 100% innocent and they're using the tech just to detect someone staring at the machine.

Do I believe this?

Nope. I'm sure the app could do this, but if this is what they were using this for, you'd think someone would have +1 point of IQ to say 'Hey, maybe we should rename the app to FaceDetectApp.exe, just in case the name of the app leaks out'. But they didn't. And most vending machines have cell phone systems built-in to tell the managers what supply levels are, validate credit cards, and sometimes send diagnostic info if the machine needs repairs. It would be trivial to send biometric data. Modern vending machines are very sophisticated computers these days.

The article mentions a previous Canadian facial recognition scandal where a mall operator was covertly scanning people walking around a mall (or perhaps several) and collected biometric face data of over FIVE MILLION people! He was forced to erase those databases.

https://arstechnica.com/tech-policy/2024/02/vending-machine-error-reveals-secret-face-image-database-of-college-students/

https://yro.slashdot.org/story/24/02/24/0012232/vending-machine-error-reveals-secret-face-image-database-of-college-students

The New York State Attorney General is investigating that the practice of MSG is discriminatory, especially with the notorious false rate of positives vs minorities and women.

MSG replies 'Nuh uh.' Their main rebuttle is that such a small class of people are affected, i.e. a very small subset of attorneys.

What I'm curious about is we all recognize the 'We may refuse service to pretty much anyone if we want' right of businesses to ban people. But that's usually for specific behavior: theft, starting a fight, etc. The use of facial recognition by MSG - as reported - is blocking people whom MSG management has simply said 'we don't like these people' - even though they still sell them the ticket, they just won't let them in the door. It's not much different from an Alabama diner in the '50s with a sign that says 'No Coloreds', just a different type of class - attorneys that are not directly involved in litigation vs MSG as opposed to skin tone.

https://arstechnica.com/tech-policy/2023/01/msg-probed-over-use-of-facial-recognition-to-eject-lawyers-from-show-venues/