People counting in France: measuring within the CNIL framework
CNIL, the French regulator, has written down what it expects from footfall measurement in publicly accessible spaces. For buyers, a vague compliance worry becomes a concrete checklist. This page is orientation, not legal advice.
On this page
CNIL, the French data protection authority, expects footfall measurement in publicly accessible spaces to rest on anonymised data or strong guarantees, informed visitors and a legal basis. Methods with no personal data in the output fit best. Bumbee Labs has the only footfall method in Europe approved by a data protection authority. The approval, from IMY, covers the Wi-Fi method.
What does the CNIL framework expect of people counting?
Elsewhere, footfall measurement is often reasoned out from the general principles of GDPR. In France, CNIL publishes explicit rules for dispositifs de mesure d’audience et de fréquentation in publicly accessible spaces: measurement devices in shopping centres, stations, high streets and advertising environments. For a retailer, a property owner or a city, that helps: the question becomes whether the method meets published expectations, which can be checked.
The framework asks for three things. The data is properly anonymised, or processed under strong guarantees if anything identifiable is touched along the way. Visitors are informed that measurement is taking place. The processing rests on a sound legal basis. This is orientation, not legal advice. Still, the further a method’s output is from personal data, the shorter each of those conversations gets.
Bumbee Labs designed its method on that principle from the start. Measurement is passive and nothing is asked of the visitor. All personal data is irrevocably deleted and never stored, not even in hashed form, so only anonymous, aggregated statistics remain: counts, dwell, flows and trends per zone and period. There are no profiles, no journeys of identified individuals, and nothing that could put a person back into the numbers.
Why does a reviewed method matter in France?
Anyone can claim compliance. In France, with the clearest published rules, the evidence should be strong. IMY, the Swedish Authority for Privacy Protection, reviewed our Wi-Fi method itself: what it collects, what it deletes and what stays in the output. Bumbee Labs holds that approval. The regulation is the same in Stockholm and in Paris. The question IMY asked (does this produce personal data?) is the one CNIL’s framework puts to any device operating in France, and the one your DPO will put to any supplier. A self-declared “conforme au RGPD” and a regulator-reviewed method are different things, covered on GDPR-compliant vs approved, and the difference weighs most in France.
Which methods can be combined in France?
In deployments that combine methods, the same privacy-by-design engineering applies to 3D sensor, LiDAR and cellular measurement, all in one platform with the anonymous, aggregated output the framework favours.
What do French operators measure?
The questions are the same as in any market, with the regulator’s checklist on top. Retailers and centres commerciaux measure store performance: footfall, conversion, dwell and flows between zones. Cities and collectivités measure pedestrian flows to steer investment and report on it. Transport operators measure stations and hubs. In every case the deliverable is anonymous statistics that a French compliance review can approve without difficulty, through dashboards or an API into your own tools.
How do we start, with our DPO in the room?
A demo walks through the method, the data journey and the dashboards in plain language, and we answer compliance questions in writing. Bring the CNIL framework and we will go through it point by point. GDPR-compliant footfall analytics collects the full compliance position, and DPIA for people counting lists the questions to put to us and to any other supplier.
Curious what this looks like for your venue?
Frequently asked questions
What does CNIL expect from footfall measurement?
CNIL's published framework for measurement devices in publicly accessible spaces sets expectations in three areas: anonymised data or strong guarantees, informed visitors, and a sound legal basis for the processing. The cleanest way to meet it is a method whose output contains no personal data at all.
Is Wi-Fi people counting legal in France?
CNIL's framework explicitly addresses signal-based footfall measurement and describes the conditions under which such devices operate lawfully; it does not ban them. A method designed around anonymisation, where personal data is irrevocably deleted and only aggregated statistics remain, is built for those conditions. A specific deployment is assessed in its own review. This page is orientation, not legal advice.
Which authority approved Bumbee Labs' method?
IMY, the Swedish Authority for Privacy Protection, reviewed the Wi-Fi footfall method: what it collects, what it deletes and what stays in the output. Its question was whether the method produces personal data, and a French review starts from the same one, because GDPR applies in France as it does in Sweden.
Do visitors have to consent to being counted?
Consent is one route CNIL's framework describes. It also covers processing built on anonymisation with strong guarantees, paired with clear visitor information. Measurement that produces only anonymous, aggregated statistics avoids resting the whole deployment on collecting consent from every passer-by, which no footfall project can realistically do.