The machines use the charitably named "demographic sensor" which is obviously the embedded camera linked to a "facial recognition" application, BUT, it doesn't appear that it actually recognizes (or records) faces. Meaning, it's not linking your face to any online identity, or recording your face at all. In fact, the company is European and claims that their entire platform is GDPR compliant, which is... probably true?
Rather, it throws out a series of guesses and confidence values of a person's age, gender, and race, and allow the planogram (and OOH advertising) to change dynamically based on that information.
Which is not necessarily great, but also an entire order of magnitude less invasive than every interaction any casual user has on the internet with any ad ever. Or, frankly, with any POS system recording a repeat purchase from your credit card, from which motivated vendors can back into the rest of the demographic data.
I'm not excusing it, but while the error reads "facial recognition", it's more "stereotyping enablement platform," which, while only marginally better, is probably still better.
It's also hilarious to think of the thing displaying the green M&M if you're a "probable" woman, and the red or yellow M&M if you're a "probable" man, and seeing how long it'd take for anyone to correlate the change.