Not everybody who approaches the machine or walks past it is really consenting to their appearance being logged and analysed though - not to mention that "we don't store data" is only true if the security is effective and no exploits manage to weaponise the camera now staring back at you as you try to make a purchase.

Ultimately vending machines are completely passive sales anyway, the collection of demographic data about who is buying from the machine are a little useless because it's not like the machine can work on its closing techniques for coin based candy sales.

If you don't have access to the source code then you don't know what it's doing. If there's economic incentives to take my picture and tie my face to my name then I'm going to assume "trust us, it's anonymous" means "we buy and sell your data" (at least).

If you'll grant there are people in power who would want a surveillance state and businesses routinely sell data to governments then you don't get to dismiss this out of hand. We have to draw the line somewhere, even if marketing people with a stalker mentally don't see the line.