People counting in France: measuring within the CNIL framework
France is unusual in that the regulator has written down what it expects: CNIL publishes explicit rules for footfall measurement in publicly accessible spaces. For buyers that is good news, because a vague compliance worry becomes a concrete checklist. This page is orientation, not legal advice.
On this page
In most European markets, footfall measurement has to be reasoned out from GDPR’s general principles. In France, CNIL, the French data protection authority, publishes explicit rules for dispositifs de mesure d’audience et de fréquentation in publicly accessible spaces: measurement devices in shopping centres, stations, high streets and advertising environments. For a retailer, a property owner or a city, that framework is an advantage. The compliance conversation in France is about whether the method meets the published expectations, and that question has a checkable answer.
What the framework expects
CNIL’s framework comes down to three demands. The data must be properly anonymised, or processed under strong guarantees if anything identifiable is touched along the way. Visitors must be informed that measurement is taking place. The processing must also rest on a sound legal basis. As with everything in our compliance library, this is orientation, not legal advice. The direction is still clear: the further a method’s output is from personal data, the shorter each of those conversations becomes.
Bumbee Labs designed its method on that principle from the start. Measurement is passive and nothing is asked of the visitor. All personal data is irrevocably deleted and never stored, not even in hashed form, which leaves only anonymous, aggregated statistics: counts, dwell, flows and trends per zone and period. There are no profiles and no journeys of identified individuals, and nothing that could put a person back into the numbers.
Why a reviewed method matters in France
Compliance claims cost nothing to make, and France, with the clearest published rules, deserves the strongest evidence. Bumbee Labs runs the only footfall method in Europe approved by a data protection authority. The approval was issued by IMY, the Swedish Authority for Privacy Protection, which examined our Wi-Fi footfall method: what is collected, what is deleted, and what remains. GDPR is one regulation across the EU, so the question IMY answered is the same one CNIL’s framework puts to any device operating in France, and the same one your DPO will put to any supplier. The difference between a self-declared “conforme au RGPD” and a regulator-reviewed method is the subject of its own page, and that difference matters most in France.
In deployments that combine methods, the same privacy-by-design engineering applies to 3D sensor, LiDAR and cellular measurement, all in one platform with the anonymous, aggregated output the framework favours.
What French operators measure
The French market runs on the same questions as every other, with the regulator’s checklist on top. Retailers and centres commerciaux measure store performance: footfall, conversion, dwell and flows between zones. Cities and collectivités measure pedestrian flows on high streets and in public space to steer investment and report on it. Transport operators measure stations and hubs. In every case the deliverable is the same: anonymous statistics a French compliance review can approve without difficulty, through dashboards or an API into your own tools.
Start the conversation with your DPO in the room
A demo walks through the method, the data journey and the dashboards in plain language, and we answer compliance questions in writing. Bring the CNIL framework and we’ll go through it point by point. The GDPR footfall analytics page collects the full compliance position, and the DPIA guide lists the questions to put to us and to any other supplier.
Curious what this looks like for your venue?
Frequently asked questions
What does CNIL expect from footfall measurement?
CNIL's published framework for measurement devices in publicly accessible spaces sets expectations in three areas: the data must be properly anonymised or processed with strong guarantees, visitors must be informed, and the processing needs a sound legal basis. The cleanest way to meet the framework is a method whose output contains no personal data at all.
Is Wi-Fi people counting legal in France?
CNIL's framework explicitly addresses signal-based footfall measurement and does not ban it: it describes the conditions under which such devices operate lawfully. A method designed around anonymisation, where personal data is irrevocably deleted and only aggregated statistics remain, is built for exactly those conditions. A specific deployment is assessed in its own review; this page is orientation, not legal advice.
Which authority approved Bumbee Labs' method?
IMY, the Swedish Authority for Privacy Protection, which examined the Wi-Fi footfall method: what is collected, what is deleted and what remains. GDPR is the same regulation in Stockholm as in Paris, so the question IMY answered is the same one a French review asks: does this produce personal data?
Do visitors have to consent to being counted?
Consent is one of the routes CNIL's framework describes, but not the only one: the framework also covers processing built on anonymisation with strong guarantees, paired with clear visitor information. Measurement that produces only anonymous, aggregated statistics avoids resting the whole deployment on collecting consent from every passer-by, which no footfall project can realistically do.