Thank you. So it’s not just a doorbell, rather a remote controlled surveillance and communication system. That is a bit more complicated than a bell at the door.

Why would you need any software, server or phone for a simple door bell?

I don’t know about the US, but in Germany, by using a vending machine, you are implicitely and automatically consenting with the ToS of the vendor by your action.

In the article is a sound explanation: the machine is activated by detecting a human face looking at the display.

If this face recognition software only decides “face” or “not face” and does not store any data, I’m pretty sure this setup will be compatible with any data protection law.

OTOH they claim that these machines provide statistics about age and gender of customers. So they are obviously recognising more than just “face yes”. Still – if the data stored is just a statistics on age and gender and no personalised data, I’m pretty sure it still complies even with 1920s data protection habits.

I’m pretty sure that this would be GDPR conform, too, as long as the customer is informed, e.g. by including this info in the terms of service.