It's likely your phone, specifically Apple, Google, or Facebook location services. A bluetooth beacon in the vending machine gets the identity anyone standing near (and everyone walking by!) directly from any number of advertising vendors, including the big three scumbags mentioned. Even if the identity code is "anonymous", the machine knows it's you because it's the same "anonymous" code as last time -- so not really anonymous and easily demasked with enough datapoints.
Could be facial recognition too, but the above method has been used for more than a decade now and is everywhere since it's built in to all ecommerce platforms.
If it is facial recognition then it probably just stores datapoints like the distance between your eyes (etc...) and doesn't know who "you" are until you pay with a card.
I think all of the marketing and advertising industry is bullshit. It's manipulation and propaganda made to appear normal and proper. If it all suddenly went away nothing would happen other than a mad scramble for jobs and alternate revenue sources.