In-Store Computer Vision Analytics and Privacy: How to Design GDPR-Compliant Measurement
In-store computer vision analytics can measure footfall, zone presence, queues, and dwell time, but it should be designed from the outset in line with the data minimisation principle. The safest model does not identify individuals, stores no footage, and transmits only aggregated events to the system.
Purpose first, technology second
Before deployment, the objective must be clearly defined. Is the goal counting footfall, assessing traffic near a display, queue detection, zone occupancy analysis, or audience estimation? Each objective may require a different scope of data. Collecting age or gender simply because an algorithm is capable of it increases risk without guaranteeing business value.
A secure data hierarchy
- 1Playback logs and device status.
- 2POS data, product availability, and aggregated footfall.
- 3Non-optical sensors.
- 4Computer vision analysis performed locally, with no footage recorded.
- 5More sensitive estimations only following thorough legal and technical evaluations.
In an edge analytics model, the camera can process footage locally and transmit only the event to the CMS: the number of people in a zone, timestamp, queue level, or an anonymous counter. Retention must be kept to an absolute minimum, access should be role-based, and data transfers as well as logs securely protected.
DPIA, transparency, and vendors
Depending on the scale, monitoring method, and level of risk, a Data Protection Impact Assessment may be required. Controller and processor roles, legal bases, contracts, processing locations, retention periods, and mechanisms for exercising data subject rights must also be established. Signage in the venue must be clear, transparent, and visible prior to entering the monitored area.
What not to communicate
Do not promise “customer recognition and personalised ad targeting” if the system is designed to operate anonymously. A more accurate and credible message is: “the system estimates footfall and zone context at an aggregate level, without identifying individuals”.
The Nedilo perspective
In Nedilo analytics, priority is given to proof of presence, footfall, zones, queues, product availability, and correlation with POS. Demographics are an optional module requiring a separate assessment, rather than a core premise of the system.
Frequently asked questions
Does people counting always involve personal data?
Not necessarily. If the system processes video locally and records only aggregated counts without the ability to identify an individual, the risk is significantly lower. However, the assessment depends on the specific deployment and should be documented.
Does video footage need to be recorded?
No. In an edge analytics model, video is processed locally and does not need to be recorded or transmitted. Only the event itself—such as the number of people in a zone—is sent to the CMS.
When is a DPIA required?
A Data Protection Impact Assessment is typically required when systematically monitoring publicly accessible spaces on a large scale, as well as for higher-risk analytics. The decision is made based on the purpose, scope, and scale of the deployment.
Can dwell time be measured anonymously?
Yes. Dwell time in a zone can be estimated at an aggregate level, without facial recognition or profiling individuals.
Sources
About the author and methodology
This material was prepared by the Nedilo expert team based on digital signage and in-store audio deployments in retail, QSR, petrol and commercial venues across Europe, as well as public industry standards (including IAB Europe, EDPB guidance and Google Search documentation). We verify recommendations in multi-location projects and update them whenever standards change.
Related articles
Digital signage analytics: from Proof of Play to sales impact
Digital signage analytics is the process of connecting playback data, device performance, audience presence, and business outcomes. While a report confirming file pl...
In-store retail media measurement according to IAB: ad plays, impressions, OTS, and store zones
Measuring in-store retail media requires shared definitions of the display medium, zone, playout, and audience. Without them, retailers, advertisers, and agencies ma...
Digital Signage Security and Business Continuity in a Distributed Network
Digital signage security encompasses the CMS, user accounts, APIs, media players, the network, displays, content suppliers, and the publishing workflow. Across a net...