Among the many, many different things you can buy from a vending machine – you name it, there’s probably a machine selling it – it seems privacy may not be one of them.
Various new technologies and software tools have been incorporated into the hundred-plus-year-old invention, turning a simple sales device into an intelligent product dispensing and sales management system, one that keeps track not only of products for sale and income received but also the customers who make the purchases or interact with the device.
Yes, the machines watch us closely – some even monitor the air that we breathe.
Vending machines are super high-tech devices now: they’re equipped with computing capability and data analysis tools; wired and wireless connectivity to the cloud; Internet and social media platform connectivity; video cameras and various types of motion and activity sensors (aka Anonymous Video Analytics, or AVA); advanced payment, fulfillment, and identification systems; high-resolution digital touch- and display screens, as well as a wide range of environmental scanning and object identification technologies (NFC, RFID, etc.).
And some smart vending machines not only scan the environment, they can change it.
No matter their specific technical configuration, smart vending machines are being developed to enable better customer-engagement and brand awareness in situ. More sales on the spot. Ideally, the interactive technology and media connectivity engages and educates customers about available products and services, helping to make their purchase decisions simple, easy and spontaneous.
Vendors use the smart tech in their machines to keep track of the customer journey, documenting the entire experience with customer demographics, sales data, usage patterns, purchase trends and other location-specific information.
Machines can help save on labour costs and inventory management efforts as they collect data that fed into a comprehensive enterprise resource planning (ERP) tool, so that vendors can analyze key business metrics, often in real time.
Those are among the reasons why the Global Intelligent Vending Machines market reached some $10 billion in 2017 and is expected to hit almost $40 billion by 2026, driven by the integration of computing technology and increased user interactivity.
The Vending of Privacy
But government regulation and investigation by privacy authorities may throw up an ‘Out of Order’ sign as vending machine functionality comes into direct conflict with privacy rules and regulations protecting our personal data.
One of the most recent examples of how vending machines can threaten personal privacy comes from the campus of the University of Waterloo in Kitchener, ON. Some machines there sell chocolate and other candies; others apparently have additional capabilities. Earlier this month, a student spotted an error message on one machine’s display screen, showing what seemed to be evidence of an on-board facial recognition app and the machine’s apparent AVA capabilities.
As a result, two complaints have been filed with the Office of the Information and Privacy Commissioner of Ontario over the incident (university officials say the offending vending machines are being removed), sparking, as the Commissioner put it, “widespread discussion and concern about the use of potentially privacy-invasive technologies at Ontario’s post-secondary institutions.
“Because my office is currently looking into complaints about this incident,” Commissioner Patricia Kosseim said, “I am not at liberty to speak about it. We will let our investigation reveal the facts as they are and carefully consider whether the use of these vending machines complies with Ontario’s public sector privacy law as it currently stands.”
Her office would do well to consider precedent as well: in 2020, peers from the Offices of the Privacy Commissioners of Canada, Alberta, and British Columbia looked into the use of similar technology by Cadillac Fairview, operator of several large shopping malls in Canada.
The privacy regulators concluded that technology deployed in the malls generated and retained visitors’ demographic data without valid consent, data that included their age and gender, as well as biometric information with a unique numerical representation of facial characteristics that could theoretically be used for personal identification.
At a dozen shopping malls across Canada, hidden inside digital information kiosks, were small cameras and other AVA-type technologies. Apparently, hours and hours of video and hundreds of images were collected, an activity that regulators said contravened federal and provincial privacy laws.
(Again, in this case as at the University, the presence of such technology was only discovered when an individual noticed an error message on a display screen – this one referenced well-known “FaceEncoder” and “FaceAnalyzer” AVA-type tools inside Cadillac Fairview digital information kiosks )
The commercial use of AVA technology is legal in Canada. However, cases like Cadillac Fairview from 2020, and perhaps U Waterloo in 2024, have caused privacy regulators to remind industry participants of their obligations under current federal and provincial privacy rules, and to underscore that key privacy principles, such as data use and retention limitations, operating transparency and accountability, and particularly user consent, must be followed.
One company that has taken such reminders and cautionary takes to heart and makes no bones about its use of AVA technology in digital kiosks and public facing machines is movie theatre operator Cineplex.
Cineplex posts signs and stickers on its machines, and publishes details on its website, to keep the public informed about the presence of anonymous video analytic systems at its property entrances, exit ways and other places. High-use personal spaces such as bathroom entranceways or children’s play areas are avoided, the company says.
The systems, Cineplex describes, “use a camera sensor to anonymously estimate your age and gender in order to build automatic reports about the audience or to trigger more relevant advertising and content”, among other described purposes. Cineplex emphasizes that “[n]o images or identifying information about you are collected or stored” and that “[o]nly strictly authorized personnel have access to the secured camera sensors and related technology.”
Access to other intelligent kiosk technologies may not need to be so closely, uhh, watched: smart vending machines that can purify the air and reduce the ambient temperature offer tangible environmental benefits, not privacy violations.
It’s a digital out-of-home (DOOH) media solution called CityBreeze, which purifies and cools the air around it using moss or green grass.
According to the manufacturer, Green City Solutions, each CityBreeze is capable of filtering 50,000 cubic feet of air per hour, while also reducing the surrounding temperature by several degrees.
The units can display real-time air quality data, but behind the 75” LCD screen is a patch of green stuff which breaks down harmful carbon and nitrogen oxides from the air as it evaporates water across its surface to cool the surrounding area.
Wi-Fi hotspots, e-charging stations, even product vending solutions can be added to the kiosks; there’s no word on whether the unit will also take pictures of all the cool, relaxed people nearby.
-30-