Your Kid's Face Is the New Lunch Card — And Nobody's Guarding It

A student at the University of Waterloo walked up to a vending machine to buy a snack. The machine threw an error code on its screen. And that error code revealed something nobody had told them — the machine had been scanning their face the whole time.

If your kid buys lunch at school, this story is

If your kid buys lunch at school, this story is about you. Across the world, schools are rolling out vending machines that don't just take your money. They read your child's face. A recent case in the United Arab Emirates put this in the spotlight — snack machines in schools using facial recognition to track who's buying what. The pitch sounds helpful. Promote healthier snacking. Keep food available around the clock. But every time that machine looks at a child, it's collecting biometric data — a digital map of their face. So the question that runs through this whole story is simple. Who owns that data, and where does it go?

Let's start with the machine itself. These aren't just snack dispensers. Privacy researchers say these systems log demographics on every purchase — the buyer's apparent age, their apparent gender, what they picked. And some of that information gets shared with advertising partners to target ads. So your eight-year-old's candy habit becomes a marketing profile. That's not a security camera at the front door. That's a data pipeline pointed at a child.

The bigger problem is who controls the storage. When a school buys one of these systems, the school usually doesn't own the rules. The vendor does. The vendor decides how long your child's face stays on file. The vendor decides what counts as — quote — inventory optimization. So if you asked the principal how long the system keeps your kid's facial scan, there's a real chance they couldn't tell you.

Why can this happen at all

Now, why can this happen at all? Because in the United States, no federal law regulates the collection of facial recognition data. None. Policy researchers count just two states and around nineteen cities that have banned government use of this technology. Most schools sit in a gap with almost no rules. And schools are motivated buyers — worried about safety after school shootings, looking for a tech fix. A vending machine is a softer way in than a surveillance camera. But it carries the exact same risk. The same stored faces. The same loose retention.

Europe is moving the other direction. The European Union's A.I. Act became law on 8/1/2024, and it fully kicks in by August of twenty twenty-six. It bans the kind of indiscriminate face-scraping used to build big recognition databases. For courts and compliance teams, that's a global ratchet — vendors selling to international schools will have to raise their standards everywhere. For the rest of us, it means the protections your child gets might depend entirely on which country their school's vendor also sells to.

And here's the part that should stick with you. Those Waterloo students? The machines got pulled — not because a regulator stepped in, but because students saw an error code and started asking questions.