GDPR-compliant footfall analytics

Bumbee Labs runs the only footfall method in Europe approved by a data protection authority. Sweden’s IMY examined the Wi-Fi method and concluded that what it delivers is statistics, anonymous and aggregated. Personal data is deleted irrevocably at source, so nobody can be identified from the numbers.

Counting visitors means measuring people in a physical space, and most ways of doing it touch something personal: signals from a phone, or images at a door. A compliance team is right to ask what is collected, what is kept and whether anyone could be picked out of the data. A supplier of GDPR-compliant footfall analytics should be able to answer those questions in writing.

The short version

• IMY, the Swedish Authority for Privacy Protection, reviewed and approved Bumbee Labs’ Wi-Fi footfall method.
• All personal data is irrevocably deleted. Only anonymous, aggregated statistics remain.
• The 3D sensor, LiDAR, AI camera and cellular methods are designed to the same privacy-by-design principle. The approval itself covers the Wi-Fi method.
• The same position applies under UK GDPR, and the method-level distinction is the question to ask any supplier in an EU AI Act review.
• Statistics arrive through dashboards and a documented API, and the visitor data is yours.

Why does footfall measurement raise GDPR questions?

Under GDPR, anything that could identify a person is personal data (Article 4(1) and recital 26), and identifiers and stored footage are exactly the material the regulation covers. A compliance team should have direct, written answers before counting starts.

How does a GDPR-compliant people counter handle personal data?

Bumbee Labs counts with Wi-Fi-based people counting, optical 3D sensors, cellular network data or a hybrid of them, and the same privacy design runs through every method. Measurement is passive: nothing is installed on a phone, and nothing is asked of the visitor. All personal data is irrevocably deleted and never stored, not even in hashed form. Only anonymous, aggregated statistics remain, and no individual can be identified. Camera and sensor installations process video for analytics only and store no personal images. That is the approach behind GDPR-conscious camera counting. Cellular analytics works on anonymised, aggregated network data, with no device-level tracking.

What reaches you is statistics: visitor counts, dwell times, flows, capture rates and trends. The result is GDPR-compliant people flow monitoring: anonymous people counting at every scale, from a single doorway to an entire district. Data deliverables describes the journey from signal to statistic.

Who approved it, and what did they review?

The approval was issued by IMY, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, formerly Datainspektionen), the supervisory authority in Sweden. IMY examined the Wi-Fi footfall method itself: what is collected, what is irrevocably deleted, and what remains. The review concluded that the output is anonymous, aggregated statistics, which are not personal data.

The approval covers the Wi-Fi footfall method. It also set the engineering standard for everything we have built since: 3D sensor, LiDAR, AI camera and cellular measurement are designed to the same privacy-by-design principle and deliver the same anonymous output. Because GDPR is one regulation across the EU and EEA, the question IMY answered is the one a reviewer in any member state starts from. Your local authority supervises the same law. What separates a regulator-reviewed method from a supplier’s own “GDPR-compliant” badge is covered on GDPR-compliant vs approved.

What does the approval change in our compliance review?

It changes the starting point. The question that decides a review is whether the method produces personal data, and IMY has already asked and answered it. Because no personal data is ever produced, you work only with anonymous statistics. The method is also validated by academia, partners and customers, and every deployment is verified with manual control measurements matched against our own data. DPIA for people counting collects the questions a DPO typically asks and shows where the answers live.

What do compliance teams ask us?

• What is collected? Wi-Fi signals that phones emit, optical counts at a point, or anonymised, aggregated network data, depending on the method. Collection is passive throughout.
• What is kept? Statistics only: counts, dwell, flows and trends. Nothing that could identify anyone is stored.
• Can anyone be picked out of the data? No. The method is designed so that no individual can ever be identified.
• Where do the numbers go? Into dashboards and a documented, pull-based API. Your visitor data is yours.

Privacy is a requirement in our procurement: what should we ask suppliers?

The central question is whether the method produces personal data. Ask each supplier to answer in writing what is collected, what is kept and whether anyone could be picked out. IMY has examined that question for Bumbee Labs’ Wi-Fi method. Public bodies can turn the same principles into requirements with procuring people counting.

Who is this for?

Retailers and shopping centres, transport hubs and airports, museums, libraries, city centres and outdoor advertising. The approach scales from a single store to entire districts. The statistics arrive the same way at every scale, so a group with many sites reviews the method once.

Is a people counter covered by the EU AI Act?

The EU AI Act is on the compliance agenda for anyone deploying AI systems in the EU. Camera-based people-counting systems that use computer vision to classify individuals may fall within Annex III of the Act (high-risk AI systems related to biometric categorisation). Wi-Fi-based and cellular-based methods are outside that scope by the way they are built: they process no biometric data, they identify no individuals, and the output is anonymous, aggregated statistics. In an EU AI Act review, the method-level distinction is the question to ask any supplier.

Does this apply under UK GDPR?

Organisations in the United Kingdom operate under UK GDPR (the retained EU GDPR under the Data Protection Act 2018). The compliance position described on this page applies in full under UK GDPR: the method produces no personal data, nothing identifiable is stored, and the DPA approval provides documented evidence your Data Protection Officer can reference. UK buyers in retail, transport and public bodies can use these visitor statistics with the same confidence as their EU counterparts.

Can I bring my DPO’s questions to a demo?

Yes. A demo walks through the method, the data journey and the dashboard in plain language. Our privacy policy covers how we handle data, and case studies show how organisations that asked the same questions first use the statistics.