The University of Waterloo eventually removed the vending machines from campus after the reports of the tech made headlines.

While not everyone expects to have their face scanned by vending machines, the practice may actually be more common than you think.

Facial recognition tech is getting much cheaper and more popular, Chris Russell, a professor at the Oxford Internet Institute, told Business Insider.

"It's just very easy and cheap to put the tech into other systems, which means they turn up everywhere," he said. "It's going to get more and more common."

In the case of the machines removed from the college campus, Russell said it didn't look as though they were actively using the facial recognition capabilities.

"Based on the error message, it looks like it's hooked into a huge bunch of additional code which could do facial recognition but is not turned on," he said.

No one knows for sure how widespread the use of facial recognition technology is — or how private companies are using it.

However, its most common use is likely for advertising.

Russell said the main advantage of installing the tech is being able to tell advertisers that ads are being personalized for specific customers.

"They target particular ages and particular genders, and they can guarantee that they will start the ad as someone walks up the screen," he said.

Companies are more likely to use the tech as a motion sensor rather than a sinister surveillance tactic. They are also not likely to be storing any data picked up from the facial recognition technology.

In the case of the smart vending machines, the company that provides them told BI that they were "fully GDPR compliant." The regulation is part of the EU's privacy legislation that determines how corporations can collect citizens' data.

The company, Adaria Vending Services, reassured customers that "an individual person cannot be identified using the technology in the machines," adding the machines do not take or store any photos or images.

A representative said the tech in the smart vending machines acts as a type of motion detector that activates the purchasing interface.

This kind of use is relatively harmless — so long as everything works properly.

However, issues could arise if malicious actors access the underlying technology.

Although most companies using the technology will destroy the data, using facial recognition at all means these machines could potentially become "a hidden web camera" connected to the internet, Russell said.

"This is an attractive target for hackers," he said. "Potentially, you can imagine that hospitals might install these vending machines or places like abortion clinics.

"When you consider this, it's a very easy way to target and surveil."