When a Snack Machine Becomes a Surveillance Device: Lessons from Ontario’s “Smart‑Vending” Privacy Probe

The call that started it all

Last winter a University of Waterloo student posted a photo of a vending machine crash screen: “Invenda.Vending.FacialRecognition.App.exe”. That glitch—viral within hours—was my first clue that an everyday snack stop might be harvesting faces along with toonies. Within weeks Ontario’s Privacy Commissioner opened Privacy Complaint Report PX24‑00001, and a full‑blown investigation followed.

Following the evidence trail

Digging in, I mapped a four‑layer vendor chain:

1. University of Waterloo (site owner)
2. Adaria – campus vending contractor
3. MARS – hardware supplier
4. Invenda – “Invenda OS” + Quividi facial‑analytics module

Each layer pushed telemetry to a cloud dashboard that logged age, gender, dwell‑time, mood, beard vs. glasses, and distance from camera—all without signage or consent.

Why the Commissioner ruled it illegal

The IPC found that even low‑resolution feature maps are “personal information” under FIPPA. Because no notice was given, the collection breached s. 38(2) (authority to collect) and s. 39(2) (notice) of FIPPA. Worse, the University’s procurement team never asked the privacy questions that would have uncovered the tech.

What this means for campuses, municipalities, and any public body

If a device “looks” anonymous but profiles users in the background, you still need statutory authority, notice, and safeguards. Don’t assume a vending contract is low‑risk just because the product is chocolate. Investigators, lawyers, and privacy officers must team up before installation—afterwards, you may be explaining to students (or ratepayers) why their face was scanned for a can of pop.

If your vending machine can watch you, what else is quietly collecting data in your workplace? In a world where surveillance hides in everyday tech, investigators must act as the front line between convenience and covert spying.