Customer movement across the shop floor can now be measured anonymously, with centimetre-level accuracy and without requiring customers to carry any device. However, what is technically possible and what is legally permissible under data protection law depends heavily on the technology being used. This article provides an overview of the main approaches and their respective strengths and limitations.
The GDPR protects personal data, meaning information relating to an identified or identifiable natural person. The key term is “identifiable”. If data is collected in such a way that tracing it back to individuals is technically impossible, it is not considered personal data under the regulation. The crucial question is not whether customers are being observed, but whether personal data is being generated in the process.
Camera systems provide precise data on customer journeys and shelf interactions. From a data protection perspective, however, the decisive factor is how image processing is handled. Modern systems process video footage directly on the camera without transmitting it elsewhere. Only anonymised movement data leaves the device. This is necessary for data protection compliance, but it also makes camera-based systems technically complex and costly. Processing power must be built directly into each device, large-scale installations require extensive cabling, and the coverage areas of individual cameras must be carefully aligned with one another.
LiDAR sensors capture spaces through laser pulses, creating three-dimensional point clouds and achieving high levels of accuracy. From a data protection perspective, they are largely unproblematic because no image data is generated. The drawback is that LiDAR sensors cost several times more than camera sensors and produce large volumes of data due to their precision. For large-scale deployment across a retail chain with many stores, this is currently difficult to justify economically.
Radar sensors measure movement and position using radio waves. They do not generate images but instead create three-dimensional point clouds, meaning no personal data is produced. At the same time, they achieve a level of precision comparable to camera systems: customer journeys, dwell times and interactions can be measured with centimetre-level accuracy. Radar operates independently of lighting conditions and does not require extensive cabling, as the data volume can be transmitted easily over wireless networks. This makes it one of the few technologies that combines high accuracy, data protection compliance and economic scalability.
Wi-Fi and Bluetooth-based systems use smartphone signals for location tracking. Their main advantage is low cost. For simple footfall analysis at store level, they can provide a cost-effective entry point. However, they are unsuitable for behavioural analysis at shelf level for two reasons. First, their accuracy is insufficient: beacon-based systems typically achieve location accuracy of only around 3–5 metres, which merely allows retailers to determine the general area in which someone is located. Second, the data is statistically unreliable, as many people now carry multiple devices simultaneously and modern smartphones randomise their MAC addresses, making consistent tracking difficult. From a data protection perspective, Wi-Fi and Bluetooth tracking generally involves the processing of personal data, as MAC addresses are classified as personal data.
The GDPR sets clear boundaries for behavioural analysis in physical retail. Technologies that generate personal data create significant legal and operational requirements. Systems that are anonymous by design, on the other hand, fall outside the scope of the regulation. For retail chains seeking to measure customer behaviour across large numbers of stores in a legally compliant and economically scalable manner, it is therefore advisable to assess whether a technology is anonymous by design and whether it can be installed without structural modifications during ongoing operations. Respory is based on radar sensing technology and is therefore GDPR-compliant by design, delivers centimetre-level accuracy and can be deployed in any store without structural modifications. This enables robust decision-making based on real customer behaviour without requiring compromises on data protection.
