I worked for a place that wanted to do face and gesture recognition with a Kinect in a kiosk. The devs had objections, but were ignored. We also didn't launch anything and the exec team got canned, so there's that.
It's entirely possible to activate the screen on "I think that's a face" as well as have some local-only software guess age/sex and mix with engagement data for analytics. Whether anything is captured, fingerprinted, stored, or uploaded... anyone's guess.
It's a little skeezy because it's non-obvious, but doing the anonymized metrics isn't more invasive than someone with a clipboard watching and taking notes on who buys or not.