In 2026, every serious people counting project runs into the same question from legal and procurement: does this trigger GDPR, and what happens under the EU AI Act?
The answer is no longer just about accuracy or features. When it comes to people counting GDPR compliance, it starts with one legal test: does your counting method capture personal data at all?
People counting GDPR: the one question that really matters
GDPR regulates the processing of personal data – information relating to an identified or identifiable person. For people counting, the practical question is simple: what does the system actually capture?
- If the system records faces, recognisable images or biometric templates, it is processing personal data.
- If it records device identifiers such as Wi‑Fi MAC addresses, it is processing personal data.
- If it only ever outputs anonymous counts – for example, “142 people entered between 09:00 and 10:00” – with no image, no MAC address and no device ID, then personal data is not processed for the counting function.
That distinction is at the heart of people counting GDPR analysis, because GDPR looks at what the system touches, not just what the final dashboard shows.
People counting GDPR: why camera and Wi‑Fi counters are under pressure
This is why camera-based and Wi‑Fi-based counters are under growing scrutiny.
- A camera that “only counts” still handles identifiable image data while the frame exists, even if footage is deleted quickly afterwards.
- A Wi‑Fi tracker that logs MAC addresses still processes a unique device identifier, even if it never links that MAC to a name.
Both patterns fall squarely into GDPR scope, with the related burden of legal basis, DPIAs, retention controls and data subject rights management.
On top of that, the EU AI Act becomes fully applicable for high‑risk AI systems from 2 August 2026, adding another layer of regulatory attention where AI is applied to identifiable video or biometric data.
Anonymous by architecture: the SUS AI 3D Pro range
Smart Urban Sensing takes a different path. The AI 3D Pro2 and AI 3D Pro3 are designed so that, in normal operation, they do not export raw video streams or personal identifiers.
- All core processing runs on the device, rather than sending video to a cloud stack for analysis.
- For Pro2, the technical specification states that video processing is performed on-device and that normal operation does not transmit video streams or images.
- The privacy model is built around anonymous and aggregated analytics rather than handling personally identifiable information in the exported data.
The result is simple: the business receives aggregated metrics such as footfall counts, dwell time, queue data and visitor flow patterns, without relying on identifiable personal data in the analytics output.
AI 3D Pro2: high‑accuracy entrance analytics
The AI 3D Pro2 is engineered for precise entrance measurement and privacy‑first edge processing.
- On‑device processing with no normal transmission of raw video or images.
- Designed for entrance counting, queue monitoring, visitor trends and related analytics.
- Built to output operational insights while maintaining an anonymous analytics model.
For stores, transport hubs and public buildings, that means accurate measurement at the doorway without creating a new privacy headache for legal or procurement teams.
AI 3D Pro3: whole‑store analytics, same privacy model
The AI 3D Pro3 extends the same privacy‑first approach into larger, multi‑zone environments.
- Designed as a more advanced analytics platform for broader coverage and richer in‑store insights.
- Supports multi‑zone and whole‑store analytics while keeping the privacy model focused on anonymous outputs rather than exported personal identifiers.
- Ideal where operators want deeper behavioural insight without moving towards invasive identification models.
People counting GDPR: what your DPO and procurement team need to hear
When a DPO or procurement lead reviews a people counting deployment, three questions usually matter most.
- Does the system process personal data? If the deployment is based on anonymous counting outputs and does not rely on stored faces or device identifiers for the counting function, the compliance position is materially simpler.
- Where does processing happen? When analytics are processed on the device, the exposure surface is reduced because raw visual data is not routinely exported externally.
- How does this sit alongside the EU AI Act? With the Act fully applicable for high‑risk AI systems from August 2026, organisations increasingly prefer solutions that deliver analytics without moving closer to biometric or high‑risk categories.
This is the difference between being “privacy‑friendly” as a marketing phrase and being anonymous by design as a technical and operational architecture.
Why this matters commercially
Privacy is no longer just a legal issue. It is a commercial one. Retailers and public‑sector buyers want analytics that improve staffing, space planning, queue management and conversion, but they also want a cleaner procurement path and fewer compliance complications.
Anonymous‑by-design systems are increasingly attractive because they provide the operational value of footfall analytics without pulling organisations into unnecessary personal‑data risk.
The Smart Urban Sensing position
For Smart Urban Sensing, the message is clear: AI 3D Pro2 and Pro3 are built to deliver actionable analytics while keeping privacy at the heart of the architecture. That matters for retailers, transport operators, councils and public venues that need strong data without crossing into invasive monitoring.
In practical terms, that means a people counting deployment can support operational decision‑making, strengthen reporting and remain easier to defend in front of legal, procurement and compliance stakeholders.
Explore Smart Urban Sensing solutions:
www.smarturbansensing.co.uk
Smart Urban Sensing partner page
