Exactly. All the company gets is probably anonymized aggregate data like "Product X is bought by men 40% and women 60%", which would pass the GDPR and any privacy protection laws. The point is that we don't have access to the software so we have to trust them about doing (only) that kind of aggregations. Furthermore, as we don't trust companies anymore, we fear that cameras are used for other not innocuous purposes.
By the way, does any 3rd party inspect the software of all those machines with cameras, before they are allowed to be installed? Probably not so it's their word against the suspicions of privacy wise people, until something goes wrong and some kind of investigation starts.
By the way, does any 3rd party inspect the software of all those machines with cameras, before they are allowed to be installed? Probably not so it's their word against the suspicions of privacy wise people, until something goes wrong and some kind of investigation starts.