The University of Waterloo violated Ontario’s privacy legislation by allowing vending machines equipped with face detection software to operate on campus without properly informing users or obtaining consent. That is the conclusion of a recent investigation by the Information and Privacy Commissioner of Ontario (IPC), which found that the machines collected biometric and demographic data in ways that breached legal requirements.
Face detection without consent
In total, 29 smart vending machines were installed across the university’s main campus under a contract with a third-party vendor. While the machines did not perform facial recognition – they could not identify specific individuals – they did use facial detection to estimate the age and gender of users during transactions. According to the IPC, that demographic data constitutes personal information when collected without notice or consent, making the university’s use of the technology a violation of the Freedom of Information and Protection of Privacy Act (FIPPA).
The IPC found that the university’s procurement process failed to assess the use of biometric technology in the machines. The commissioner’s report states that the university did not identify or evaluate the presence of face detection tools during vendor selection, and as a result, did not implement the privacy safeguards required under the law.
Although the machines’ operators claimed the demographic data was intended only for statistical purposes, the IPC emphasized that the absence of user awareness and institutional oversight amounted to an unauthorized collection of personal data. In response to the investigation, the University of Waterloo has removed all 29 machines from service.
Broader concerns about biometric data
The incident adds to growing concern about the use of biometric systems in public and semi-public spaces. In Ohio, a beer vending machine in Columbus that uses facial biometrics to verify a buyer’s age has raised questions about proportionality and consent. In the United States, a class action lawsuit against Coinbase is proceeding after the company collected facial scans from users without fully disclosing its practices. And in Canada, the British Columbia Supreme Court recently dismissed a class action over facial recognition kiosks used in shopping malls, citing legal technicalities that left privacy questions unresolved.
The University of Waterloo case illustrates how even non-identifying biometric data can trigger legal obligations. The IPC’s findings underscore the importance of conducting privacy impact assessments, reviewing technology supply chains, and ensuring meaningful user notice when deploying systems that collect or process personal information.
–
By Ji-seo Kim
