Facial recognition tech is probably coming to a lot more vending machines

• Smart vending machines were found to be using facial recognition technology on a college campus. 
• The vending machines were removed from the campus after the news made headlines.
• One expert says the tech is likely to become even more common and has some serious risks.

The apparent use of facial recognition technology found in several smart vending machines caused a stir on a college campus last week.

Claims the machines were using facial recognition tech first gained traction when the Reddit user SquidKid47 posted a photo earlier this month. A writer for the student publication MathNews later investigated and published a report on the claims.

The University of Waterloo eventually removed the vending machines from campus after the reports of the tech made headlines.

While not everyone expects to have their face scanned by vending machines, the practice may actually be more common than you think.

Facial recognition tech is getting much cheaper and more popular, Chris Russell, a professor at the Oxford Internet Institute, told Business Insider.

"It's just very easy and cheap to put the tech into other systems, which means they turn up everywhere," he said. "It's going to get more and more common."

In the case of the machines removed from the college campus, Russell said it didn't look as though they were actively using the facial recognition capabilities.

"Based on the error message, it looks like it's hooked into a huge bunch of additional code which could do facial recognition but is not turned on," he said.

Advertising

No one knows for sure how widespread the use of facial recognition technology is — or how private companies are using it.

However, its most common use is likely for advertising.

Russell said the main advantage of installing the tech is being able to tell advertisers that ads are being personalized for specific customers.

"They target particular ages and particular genders, and they can guarantee that they will start the ad as someone walks up the screen," he said.

Companies are more likely to use the tech as a motion sensor rather than a sinister surveillance tactic. They are also not likely to be storing any data picked up from the facial recognition technology.

In the case of the smart vending machines, the company that provides them told BI that they were "fully GDPR compliant." The regulation is part of the EU's privacy legislation that determines how corporations can collect citizens' data.

The company, Adaria Vending Services, reassured customers that "an individual person cannot be identified using the technology in the machines," adding the machines do not take or store any photos or images.

A representative said the tech in the smart vending machines acts as a type of motion detector that activates the purchasing interface.

Attractive hacking target

This kind of use is relatively harmless — so long as everything works properly.

However, issues could arise if malicious actors access the underlying technology.

Although most companies using the technology will destroy the data, using facial recognition at all means these machines could potentially become "a hidden web camera" connected to the internet, Russell said.

"This is an attractive target for hackers," he said. "Potentially, you can imagine that hospitals might install these vending machines or places like abortion clinics.

"When you consider this, it's a very easy way to target and surveil."