Facial recognition error message on vending machine sparks concern at university
kitchener.ctvnews.ca
kitchener.ctvnews.ca
They collect demographics on WHO is purchasing what items including gender, age, etc. They use this information for targeting advertising (inc. with "partner media brokers").
They're also proud that when users install their app, it uses "gamification" to increase sales (whatever that means).
See here, they're super proud of it too:
https://a.storyblok.com/f/184550/x/e7435c019e/brochure-svm_g...
Rather, it throws out a series of guesses and confidence values of a person's age, gender, and race, and allow the planogram (and OOH advertising) to change dynamically based on that information.
Which is not necessarily great, but also an entire order of magnitude less invasive than every interaction any casual user has on the internet with any ad ever. Or, frankly, with any POS system recording a repeat purchase from your credit card, from which motivated vendors can back into the rest of the demographic data.
I'm not excusing it, but while the error reads "facial recognition", it's more "stereotyping enablement platform," which, while only marginally better, is probably still better.
It's also hilarious to think of the thing displaying the green M&M if you're a "probable" woman, and the red or yellow M&M if you're a "probable" man, and seeing how long it'd take for anyone to correlate the change.
In theory they can do something like "Why do you look so sad? Maybe a Mars can cheer you up!". This can be done while being GDPR complient but people don't like that. It creates a feeling that everything is watching you.
Privacy is not about hiding things, it is about controlling what you want to show.
I'm not saying it's not used as a racist trope. I'm saying it's amazing how Americans managed to be racist enough to make such a non-issue racist.
Check, check, check. Yum! TIL that I could pass for black in America. OK, maybe not.
Unfortunately grape soda is almost impossible to find in Madrid, I've only tried it a couple of times, first in Rota Base, and loved it.
Because of this, it became associated with black people, and thereby with criminality, low education and poverty among the dominant culture that created this sort of pattern-matching.
> Albino student: "Hey, where'd you get that watermelon?"
> Student with watermelon: "Dude, I'm black."
I think it was around then I first learned of the watermelon / friend chicken stereotype (I didn't get why everyone laughed when he said this), but "grape soda" is a new one to me.
And you're a European? As a fellow European (balkans) I can comfortably say that many European cultures are racist as hell, to a degree that would make even quite a few Americans blush. I'd be careful about feeling any superiority over supposed European sophistication even in Western Europe.
Ask nearly anyone there about gypsies, jews or arabs in a context where they think they can speak honestly and privately. The kind of shit that gave Europe at least one huge holocaust and god knows how many pogroms before that hasn't entirely gone away, it's mostly just better camouflaged and with some of its sharper edges cut away.
I guess the European equivalent would be the racism against gypsies with the distinction being that it's less prominent for simple demographic reasons owing to us trying to genocide them for centuries. Of course this makes it all the more shocking to Americans when it does come up because of how flagrant it is.
But yeah, Europeans are no less racist than Americans. I'd go even so far as to say milquetoast non-racism (e.g. corporate DEI, the typical "one of each color" groups of people in stock images etc) is more widely accepted in the US than here in Europe given how many racist comments I see any time an ad includes a brown person. I think however that that has less to do with being less racist and more with being more "politically correct" (in the original sense -- i.e. saying what you're supposed to say, not what you believe).
The whole notion of not even being allowed to see the same ads as your fellow man in a public space because you are involuntarily shunted into some kind of cohort is disgusting, regardless of what is being used to decide that.
Imagine walking somewhere and seeing all the digital ad screens around you switch to basket ball events or Kentucky Fried Chicken where they were showing tailor made suits just a second before. (Or ads for a pre-emptive rectal exam or mobility aids.)
I don't see how it is. The mere processing of my personal information (age, gender, race – doesn't matter that it's only a guess/estimate) without my explicit consent or any contractual need should already represent a violation of GDPR.
Is a picture of my face necessary to sell me a chocolate bar ? I would say not, and if they take it without asking consent before I would say that it is not GDPR compliant.
They improve absolutely nothing from a buyer's perspective. Every step of the transaction is made worse. You can't glance at the entire inventory. You never know how much of an item is left. The machine does not reliably know how much of an item is left. Every interaction lags. And in return I get ads and mini games. Just so some C-suite cretin (guess what the C in C*O stands for) can show his little cretin friends how innovative his farts are.
It is late. I am hungry. My train departs in 2 minutes. Please, I just want a bloody Snickers.
These companies are a blight.
It's the "good ads" argument -- this machine can guess your age/gender and offer up items most purchased by your demographic, all the while feeding that data back to the vendor. Who wouldn't love that? :-/
More seriously, this has been a standard capability in vending machines, fast food menu systems, and digital signage in general for over a decade. Check out this ad from 2012 for Intel's AIM Suite for an example of how this stuff is pitched: https://youtube.com/watch?v=KdMIp2vQjG8
"Is the viewer a teenage girl? Then change to content to highlight a back-to-school shoe sale a few doors down. Is it a senior male? Then why not tell him about the golf club sale at the sporting goods store?"
But those cameras aren't there because of the vending machine. That is just a convenient platform. This is about ads, and tracking, and data brokering. We had digital ad screens placed on the platforms at train stations in the Netherlands with a camera hole a few years ago, and the advertising company swore that those cameras would not be activated, for now, until the legal side was resolved, or until they could get away with it without anyone noticing.
It feels icky.
Whereas classic vending machine inventory systems requires an human person to track the re-fills or sales.
A happy medium would be no stupid cameras, but with electronic tracking and reporting of what is sold. That has to be a thing that can be done, right?
Sorry?
You order by the # of the item.
This is recorded in NVRAM/sent to cloud nowadays.
There is absolutely no need to involve any human being in the process of tracking sales.
I wouldn't trust this automatic data for shit. When's the last time you used a vending machine that did not have any problems? The classic meme of people beating on a machine because something got stuck. How is that inventory managed? Does the inventory decrement every time someone pushes buttons to vend an item? Is it tracked by weight? Who enters the weight?
This seems like a system ripe for abuse by the manufacture on needing maintenance like the McDonald's soft server machine.
The guy with a clipboard counting how many Diet Coke cans are missing hasn't been the way these things are managed since probably 2003.
That's exactly how the vending machines at my workplace operate. No screens or weird tracking (as long as you avoid the stupid "pay on your phone with our app" option). The machine knows exactly how many of what items it has dispensed and when without any of that nonsense.
I'm fine with a machine taking my observable physical characteristics and using that to select ads for me. I'm also fine with ads that are not so much targeted as self-selected.
It's the use of non-observable, non-public info to build and reference an advertising profile where I start to object. It's creepy, and the ads are somehow less relevant.
[0] https://www.cnn.com/2022/03/12/business/walgreens-freezer-sc...
“This is the future of retail and shopping,” Avakian said.
If this is our future of "education", these parasitic, data grubbing companies can fuck right off along with any larger company that supports them.
Nothing whatsoever about this in the least bit improves the time you spend grabbing something from a cooler. It's blatant enshitification of a very basic buying task that need not involve any further interface, and it so obviously does nothing but try to squeeze more money from said basic interaction for nobody's benefit except Walgreens, the companies paying for their grubby little digital visuals, and the scum-loaded company that's selling this garbage to them.
I can almost imagine a future in which even the tissue of toilet paper comes covered in "engagement" ad visuals impregnated into its material through some sort of micro-display technology. At last in that case it would get exactly the engagement it most deserves and afterwards go where it really belongs.
Countless hours wasted and it is still worse than a glass panel in every way.
Not unlike orchestrating a dozen microservices and three Dooms worth of code to render a simple form to the three users a typical application has.
> We apologize, but your web browser is configured in such a way that it is preventing this site from implementing required components that protect your privacy and allow you to view and change your privacy settings. This functionality is required for privacy legislation in your region.
> We recommend you use a different browser or disable the “EasyList Cookie” filter from your “Content Filtering” settings (found under “Settings” -> “Shields” in the Brave Browser).
We spent all this money to replace inefficient open refrigerators with glass door ones just to undo it for advertising...
> "Customizable UI design - Product selection can be extended to include products not physically in the machine. Consumers can store them in Invenda Wallet [a mobile app] and redeem them somewhere else."
Somehow managing to turn a convenience-driven impulse buy into an additional chore to redeem later.
At the end of the day, there must be some angle I'm not understanding or these features wouldn't actually drive sales. I wonder if the idea is to vend digital products? Drive traffic to nearby physical stores through some kind of targeted digital coupon? Has anyone seen this kind of thing in the wild?
But even that is madness.
I think the era of vending machine is mostly over, but nobody is admitting it.
Why? Aren't they more practical than ever?
Place it somewhere where there are enough people that haven't tried it before and trick them into buying something they don't want. No one will ever use it more than once.
The most scammy make it so you can only load the card in multiples of ten but the machines all cost prime amounts.
But at least this practice does make their spying ways more obvious.
"Oh, those are just all the snacks I badly wanted but were out of stock in the vending machine and I can redeem them at some vague time at some vague location. Why, did you want to buy them?"
Speaking only for myself, this would not be long-term profitable for the vending machine company, as the cost of them fixing the boot-sized hole in the machine would be far higher than the $2 they stole from me.
/s but...
I worked at a company in the late 2000s that moved to an office with automatic urinals. These were fairly novel at the time and had a matte black plastic unit with a flush handle that also had a shiny window made of dark, IR transparent plastic. It was clearly some kind of proximity sensor for the autoflush but some joker made an official “do not touch the cameras” sign that wound a few people up.
Is the "USB optical sensor" really a hidden camera, and "digital image maps" is images from the hidden camera?
If so, then are they also being weaselly in the rest of the sentence?
> without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”
This is the only related item I could find today:
"OMRON Develops Real-Time Facial Expression Estimation Technology"
Some workplaces did it too. It’s mostly gone now, but pieces still remain.
Shit was wack, yo.
In the UK we're already using it everywhere. Most stores and checkout systems have it. It's used in CCTV across the country. It's used by police to identify protestors. Schools in my area even install spyware on kids phones to monitor them and their families.
I can't imagine anyone would mind having being identified by a vending machine here lol... What's the risk?
This is a info collector which potentially disseminates information across the world, to sell better ads.
Meanwhile, categories of you are being made. Do you buy a soda every friday at 05:00? "Party Animal".
Or not. Who knows. Maybe they just spend the extra dollars on the software and camera because they really do want to lose money on it.
Wow - I have even more respect for the people who risk their lives to damage and tear down government surveillance cameras for the common good.
When I read the story that schools in my area had been installing spyware on students phones I assumed it was some kind of isolated thing. But my GF works in schools so I asked her if she knew of this app and she was like, "oh yeah, all the kids have it".
I found this utterly insane but she seemed to think it was a good thing if it could be used to protect kids. And I guess I get the argument, but you could say the same thing about the government installing CCTV in everyone's homes... You need to draw lines, especially when there's an expectation of privacy.
This is my concern with facial recognition in shops too. If I go into a shop I expect people to see my face, so a simple CCTV system seems fine. I even expect people who know me might recognise who I am, so again, if a human being I've interacted with before identifies me on the CCTV system I'm okay with this. What I don't think people expect is to be identified by some automated national biometric system which checks to see if you've ever stolen anything before so it can alert security, while also trying to understand your emotions and individual purchasing habits.
I used to work for a large highstreet retail org and was literally pitched on a system which could identify our customers and tell us how they feel about their shopping experience and their shopping habits.
But like I say, no one cares. I've spoken about this with people so often and they act like I'm some kind of privacy lunatic. That said, people here get very animated if someone can access data they've personally shared to Facebook and made publicly available.
We have to keep pushing for this stuff to become less and less normalised, and also for penalties to become more and more serious. When that happens, people will continue to feel more enpowered to fight this stuff. We should also make sure laws are clear that people have the right to "vandalise" such devices. In my opinion taking a bat to one of these things should at least be defensible in court.
However, the difference in this case is that the vending company (or someone along the chain) is using it to serve demographic ads to the customer of the vending machine. I still have to pay for the product and it's not changing non targeted ads to targeted ads (there were no ads before). I'm sure they aren't passing along some of the ad revenue to me since there's no competition (I'm sure all vending machines in the area are owned by the same company). So this is just a source of extra revenue for the company and serves no purpose to the user.
The way they're sticking ads on everything with or without tracking is pretty annoying. I hope they lose money with the tech they had to dev and install vs ad returns.
But if I found out they’re collecting the bloodwork pdfs my doctor sends and selling them to insurance companies, that would be objectively beyond any reasonable consent.
If you’re selling me M&Ms, I have a very very low tolerance for what I consider appropriate data collection.
I agree with the second point. Facial recognition for demographic stats seems kinda reasonable if it's anonymised properly, but people don't like their photo being taken without knowledge of it.
In summary (and, in fairness, these technical details are pretty far down the article):
> The machines are owned by MARS and the manufacturer is Invenda.
> MARS did not respond to requests for comment from CTV.
> Invenda also did not respond to CTV’s requests for comment but told Stanley in an email “the demographic detection software integrated into the smart vending machine operates entirely locally.”
> “It does not engage in storage, communication, or transmission of any imagery or personally identifiable information,” it continued.
> According to Invenda’s website, the Smart Vending Machines can detect the presence of a person, their estimated age and gender. The website said the “software conducts local processing of digital image maps derived from the USB optical sensor in real-time, without storing such data on permanent memory mediums or transmitting it over the Internet to the Cloud.”
The most important thing to keep in mind about clauses like this is that at any time it's only one software update away from changing the behavior and suddenly starting to send everything. You'd never know. (And: That point in time may be in the past.)
Probably bullshit.
Firstly, "personally identifiable information" is usually defined very specifically, like 'we didn't record their social security number'.
Secondly, they send a bunch of information extracted from the image and they probably store the raw images on the machines which are then manually extracted at some point. Like photocopier that store a scan of everything put on the bed in its own hard-drive.
Guess you’ve never heard of twins?
Guess you’ve never heard of names? Or date of birth? Personal doesn’t mean unique.
>> Guess you’ve never heard of twins?
> Guess you’ve never heard of names? Or date of birth? Personal doesn’t mean unique.
Your parent commenter is contesting the "A face is a unique identifier" part. They are not contesting "A face is personal". Of course face should be PII but at the same time it is not a unique identifier, so your parent commenter is correct and you are correct too. But you are replying to an objection that was never made.
I just quoted the most relevant technical details of what is actually presented in the article given that so much of the initial commentary when I first saw this post were from people who clearly hadn't read the article.
at least that's my suggestion
if people collected my information and sent me a check in the mail every month for a decent amount, i might not be so annoyed.
It worked in Venice, and what a fine method of self expression!
I remember older generation tech used in digital signage applications that wanted to identify ages and genders to show them appropriate content, say apparel for example. It ran locally and was well meaning (enough).
Unfortunately in a world with Meta, ubiquitous telemetry, Ring doorbells, NSA, and data breaches and brokers, … we can’t trust anyone to do the right thing any longer.
So this type of benign-ish functionality, which would have been all local just two decades ago, unfortunately now can’t be trusted either.
Still, I’m very happy to hear a young person or two being concerned. Last trip to a college campus there was mandatory app and no cash accepted in many places.
In this case, the recognition doesn't do anything for the end user of the vending machine. It is purely data for other brokers to use. The vending machine didn't say to the user that people of their demographic were buying Diet Coke over normal Coke.
Slapping facial recognition on something that didn't have it before, without any obvious functionality or benefit for the persons face being scanned is very much cause for concern, in my opinion.
People were clearly concerned about it, because the nature of its services weren't all that clear to the end user. Students protested, it was investigated and found that no PII information to taken, great no further action required.
My point is that the situation was clearly cause for concern because we have a lack of trust in these technologies and those who use them.
Case in point from the article "the embedded cameras inside Cadillac Fairview’s digital information kiosks used facial recognition technology to record over five million images of shoppers at malls without their customers’ knowledge or consent."
By the way, does any 3rd party inspect the software of all those machines with cameras, before they are allowed to be installed? Probably not so it's their word against the suspicions of privacy wise people, until something goes wrong and some kind of investigation starts.
Was trying to make the point that there is a potential justification for the functionality, though tenuous.
And in that case my answer would be a decisive NO.
That is to say, my comment was meant to inform the concerned reader about other dastardly actors, not to excuse the behavior of the vending machine. (Not sure I have the authority even to make such an excuse.)
Putting epoxy on the camera inconveniences the vending machine owner, who has to replace it. They're the assholes who put the camera there in the first place, and when they replace the machine they can easily put in one with no camera.
If you're going to engage in civil disobedience, why not do it right?
The college doesn't care(or even know) about the facial recognition functionality, so presumably they don't care about this sticker either. If the sticker stops the machine from working, then the manufacturer would be called to fix it.
They don't address the real issues though: (1) the use of facial recognition (2) without users consenting to it (3) and the resell of the data.
But that's only a very immediate reactive response. A more proactive and impactful response would be to hurt the companies involved (e.g., bad PR, loss of sales, machine recall costs, legal problems), put fear into other companies doing things like that, and hopefully also prompt long-lacking better privacy legislation.
Hence, the noise.
And since screens can now output music (saw some high-tech article about it) it won't be long to also record sound.
You know, just to identify the topics which resonate with better ad viewing.
"Welcome back to McDonald's, Mr. Beattie, would you like your usual?" Nods head and grunts while sending text "Very good. I'll charge your card on record and send a notification when your meal is ready. Thank you!"
This will all require an integrated camera and microphone, and maybe other sensors as well. All turned on 24/7. This isn't science fiction, it's just a few years away from every day reality.
So, in other words, get used to it.