Is Video People Counting GDPR Compliant? A Plain-Language Answer

If you are counting pedestrians from video, sooner or later someone asks the fair question: is video people counting GDPR compliant? The honest short answer is that it can be done in a privacy-respecting, GDPR-friendly way — and it can also be done badly. The difference is design. This is a plain-language explainer for entrepreneurs, brokers and property owners: what the concern really is, how anonymous silhouette-based counting avoids it, and what to ask any provider before you trust them with footage of a public street. It is not legal advice, but it is exactly how StreetProof is built.

It complements the foot traffic study guide and the counting methodology handbook, where the technical pipeline is described in full.

Key takeaways

• Counting people from video can be GDPR-friendly when it is anonymous by design.
• We count silhouettes, not people: no facial recognition, no identities, no biometric identifiers.
• Data is minimised to aggregate counts; source video is deleted after processing.
• Processing runs in the EU, and the public report contains no personal data about any individual.

Is video people counting GDPR compliant? What the concern really is

GDPR is about personal data — information relating to an identifiable person. A camera pointed at a street could, in the wrong system, recognise faces, track named individuals or build profiles. That is the thing people are right to worry about. The concern is not "a machine counted how many people walked past"; it is "a machine worked out who walked past."

So the real question is narrower than "is video involved?" It is: does this system identify anyone? If the answer is a genuine, designed-in no, the privacy picture changes completely. Counting how many anonymous shapes cross a line is much closer to a turnstile tally than to surveillance.

How anonymous counting is designed to respect privacy

We built the counting around a single principle: count silhouettes, not people. In practice that means several concrete choices.

• No facial recognition. The system detects the shape of a pedestrian — enough to know a person crossed a line — and does nothing to recognise faces. It is not looking at who anyone is.
• No identities, no biometrics. No identity is derived, no name is attached, and no biometric identifier is stored. A crossing is just an anonymous event: "one person, moving this way, at this time."
• Data minimisation. The output that is kept is aggregate: totals by hour, day, direction and category. Aggregate counts about a crowd are not personal data about any individual in it.
• Short retention of source video. The raw footage exists only long enough to be processed into counts, then it is deleted under our retention policy. The lasting artifact is the number, not the film.
• EU processing. Processing runs in the EU region, keeping data within the area whose rules we are designing around.

Put together, these mean the durable record of a study is a set of anonymous tallies — the same information a person with a clicker would have written down, produced more consistently and then wiped.

Processor, not profiler

When you commission a study, we act as a data processor working on your behalf, on a tightly scoped task: turn this footage into these counts, then delete the footage. We are not building an advertising profile, not enriching data against other sources, and not retaining anything that could re-identify a passer-by. That narrow scope is itself a privacy feature — there is simply no personal dataset to leak, sell or subpoena, because none is created.

A note for readers outside the EU

Privacy law is not only European. In the United States, for example, some states have biometric-privacy statutes (Illinois' BIPA is the well-known one) that specifically restrict collecting biometric identifiers like faceprints. Anonymous, no-facial-recognition counting is designed to stay clear of exactly that category: with no biometrics collected, the most sensitive obligations do not attach. Wherever you operate, the safe design is the same — do not identify anyone in the first place.

None of this is legal advice, and your own circumstances may add obligations (signage, notices, local rules on filming). If in doubt, take proper advice. But the architecture above is what makes the honest answer to the headline question a confident "yes, when it is built this way."

What to ask any counting provider

Use this as a checklist before you hand anyone footage:

1. Do you run facial recognition or identify individuals? (You want a clear no.)
2. What exactly is retained, and for how long? (You want: aggregate counts kept, source video deleted.)
3. Where is the data processed? (For EU streets, you want EU processing.)
4. Can the public report be shown to anyone without exposing personal data? (It should contain only aggregate numbers.)
5. Can you point to your privacy stance in writing? (Transparency is itself a signal.)

If a provider cannot answer these plainly, that is your answer. And if you want to see how our counts are produced end to end before trusting them, the methodology handbook walks through every stage, while how accurate is video people counting covers how honestly we report the numbers themselves.

Comfortable with the privacy picture? Start a $49 Spot Check of your own street, or review the full study options on the pricing page.

Frequently asked questions

Is video people counting GDPR compliant? Counting people from video can be done in a privacy-respecting, GDPR-friendly way when it is anonymous by design: no facial recognition, no identities derived, data minimised to aggregate counts, and source video deleted quickly. This is not legal advice, but it is how StreetProof is built.

Do you store faces or identify anyone? No. We count silhouettes, not people. The system detects the shape of a pedestrian to count a crossing; it does not run facial recognition, does not attempt to identify anyone, and stores no biometric identifiers.

What happens to the video after it is processed? Source video is deleted after processing under our retention policy. What remains is aggregate counts — totals by hour, day and direction — which contain no personal data about any individual.

Where is the video processed? Processing runs in the EU. Keeping data within the EU region is part of how the service is designed to align with European data-protection expectations.