Online, every click, scroll and abandoned basket is measured. In physical stores, most retailers still know little more than how many people came through the door and what was sold. The gap matters more each year as shoppers move fluidly between app, website and store, and as retailers invest in store layouts, staffing, in-store media and services that need evidence to justify them.
The technology to close that gap exists: people counters, zone sensors, Wi-Fi and Bluetooth analytics, and computer vision that can map paths and dwell. The risk is just as real. Regulators on both sides of the Atlantic have shown they will act against careless in-store surveillance, and shoppers react badly to anything that feels like tracking. This playbook shows how to measure in-store customer journeys in a way that is useful for the business and defensible with regulators and customers alike.
What Retailers Actually Need to Know
Before choosing sensors, define the questions. Most in-store journey programs revolve around a small set of decisions, and most of those decisions can be supported with aggregate, anonymous data.
- Traffic and conversion. How many visitors enter, at what times, and what share of them buy? Conversion rate by hour is the single most useful store metric most retailers still lack.
- Zone performance. Which areas attract visits and dwell, and which are bypassed? How does a layout or planogram change affect zone traffic and category sales?
- Queues and service. How long do people wait at checkout, service desks or fitting rooms, and how does that relate to staffing and abandonment?
- Omnichannel flows. How long do click-and-collect customers wait, and do they shop while in store? How do app users behave compared with other visitors?
- Media and display impact. How many people had the opportunity to see a display or screen, and did category sales change while it ran?
Notice what is missing from that list: knowing who a specific person is. For nearly all operational decisions, counts, flows, dwell distributions and conversion ratios are enough. Designing around that insight is the foundation of a privacy-safe program.
The Regulatory Landscape in 2026
Rules differ by jurisdiction, but several clear signals shape what responsible in-store analytics looks like.
European Union
Under the GDPR, video and device signals that relate to identifiable people are personal data. The European Data Protection Board’s guidelines on video devices state that video becomes special category biometric data when it is processed specifically to uniquely identify someone, that facial recognition for tailored advertising generally requires explicit consent from everyone captured, and that tracking returning shoppers to target ads counts as biometric identification. The same guidelines note that simple counting is less intrusive, and that classifying shoppers by broad characteristics without creating identifying templates falls outside the special category rules, although the processing must still have a lawful basis and respect data minimization. They also recommend layered notices, starting with a clear sign at the entrance, and short retention periods with automatic deletion.
The EU AI Act adds hard limits. Since February 2, 2025, it has prohibited biometric categorization that infers sensitive traits such as race, political opinions or sexual orientation, untargeted scraping of facial images from CCTV to build recognition databases, and emotion recognition in workplaces, which covers store staff. Retailers using vision systems in the EU need to confirm that none of their features fall into these categories.
United States
There is no single federal privacy law, but enforcement is active. In December 2023 the Federal Trade Commission announced action against Rite Aid over its use of facial recognition in stores, describing thousands of false matches, a lack of accuracy testing and failure to inform customers. The proposed order banned the company from using facial recognition for surveillance for five years and set strict conditions for any future biometric systems, including notice, complaint handling and deletion. State laws such as Illinois’s Biometric Information Privacy Act and comprehensive privacy laws in a growing number of states add consent and notice obligations for biometric and precise geolocation data.
Measure flows, not faces. Almost every in-store journey question can be answered with anonymous aggregates, and those are far easier to defend than any identification system.
Choosing Sensing Technologies by Privacy Risk
Sensor choice is the most consequential privacy decision in the program. Rank options by how much personal data they can capture, then use the least intrusive option that answers the question.
- Beam and thermal counters. Count entries and exits without capturing images. Very low privacy risk, limited to door-level traffic.
- Time-of-flight and radar sensors. Produce depth or motion data that supports counting, zone occupancy and queue length without recognizable imagery. Low risk with good spatial detail.
- Edge computer vision with on-device anonymization. Cameras whose processor converts video to anonymous coordinates, counts and dwell times in real time, with no video stored or transmitted. Moderate risk that depends heavily on configuration and verification.
- Wi-Fi and Bluetooth analytics. Detect device signals to estimate visits, dwell and return frequency. Modern phones randomize hardware addresses, which reduces accuracy and also reduces identifiability. Requires care because device identifiers can be personal data.
- Logged-in app and loyalty signals. Consented, identified data from shoppers who use the app in store, scan a loyalty ID or opt in to location features. High value for personalization, but only for the consented subset.
- Facial recognition and re-identification. Identifies or tracks specific individuals. High legal and reputational risk, unsuitable for journey analytics and prohibited or heavily restricted in many contexts.
Most mature programs combine levels 1 to 3 for estate-wide anonymous measurement with level 5 for consented personalization, keeping the two data streams separate.
Accuracy deserves as much attention as privacy. A counter that misses groups entering together, or a vision sensor confused by reflections from glass doors, can produce conversion rates that are wrong by a wide margin and lead to poor staffing decisions. Validate every sensor type against manual counts or recorded ground truth during the pilot, across busy and quiet periods, and set an acceptable error band before go-live. Decide how to handle staff movements, children and groups, and document the rules so that metrics are comparable between stores. Finally, monitor data completeness daily: a sensor that silently goes offline will make a store look as if traffic collapsed.
A Reference Architecture for Privacy by Design
Architecture should make privacy failures difficult, not just discouraged by policy.
Edge layer
Sensors and edge devices convert raw signals to anonymous events as close to the source as possible: entry counts, zone occupancy, path segments without persistent identity, dwell durations and queue lengths. Video is processed in memory and discarded. Where the device supports it, configure masking of areas outside the measurement zone, disable audio and limit the field of view to the floor area that matters.
Transport and storage
Only aggregates or short-lived, non-persistent tokens leave the store, encrypted in transit. Storage applies retention rules automatically, and access is role-based and logged. Any short-term identifiers used to link path segments within a single visit are rotated frequently and never stored beyond that visit.
Analytics layer
The data platform joins anonymous store metrics with transactions, staffing, weather, promotions and media schedules at the level of store, zone and time interval. Consented app and loyalty data are analyzed in a separate domain, and the two are combined only at aggregate level, for example comparing conversion of app users with the store average.
Governance layer
A register of sensors and their configurations, data protection impact assessments for each sensor type, vendor contracts that forbid secondary use of data, and periodic technical verification that devices behave as documented. The EDPB guidelines note that systematic monitoring of publicly accessible areas on a large scale will often require a DPIA, so plan for it from the start.
Step-by-Step Rollout Playbook
- Frame the decisions. List the business decisions the program will support and the metrics each needs. Remove any metric that would require identifying individuals.
- Assess legal requirements by market. Map GDPR, the AI Act, state biometric and privacy laws, and works council or labor requirements where staff may be captured. Decide on a lawful basis and document the balancing test where legitimate interests are relied on.
- Select sensors by store zone. Use counters at doors, time-of-flight or edge vision for zones and queues, and avoid devices with capabilities you do not need.
- Run a DPIA and design notices. Prepare entrance signage stating the purpose, the controller and how to learn more, with a second layer online or at the service desk.
- Pilot in a few representative stores. Validate accuracy against manual counts, check that no personal data leaves devices, and measure whether the insights change decisions.
- Integrate with operational systems. Feed traffic forecasts into workforce scheduling, queue alerts into store apps, and zone metrics into merchandising and media reporting.
- Scale with verification. Roll out in waves with a standard installation and configuration checklist, and schedule periodic audits of device settings and data flows.
Worked Example: A Specialty Retailer Measures Its Stores
Consider a hypothetical specialty electronics retailer with 80 stores in the United States and the European Union. Leadership wants to know why conversion varies so much between stores and whether a new store layout with a central service zone performs better.
The team defines four metrics: hourly traffic, conversion, dwell in the service zone and checkout queue time. Door counters provide traffic in all stores. Ten stores, including three with the new layout, receive edge vision sensors configured to output only zone counts, dwell distributions and queue lengths, with video discarded on the device. A DPIA is completed for EU stores, works councils are consulted where store staff could be captured, and entrance signs explain the measurement with a link to a plain-language notice.
After three months, the analysis shows that conversion drops sharply in the late afternoon in several stores because staffing does not match traffic peaks, and that the new layout increases service-zone dwell without hurting checkout times. Workforce schedules are adjusted using traffic forecasts, and the layout is approved for the next wave of refits. App users who opted in to store mode are analyzed separately; they show higher conversion, which supports investment in app features for in-store use.
At no point does the retailer identify individual shoppers. When a vendor proposes adding demographic estimation from faces for media targeting, the team declines because the EU stores would require consent from everyone captured and the benefit does not justify the risk.
The governance work pays off in another way. Because the sensor register, DPIA and verification records already exist, the retailer can extend the program to its in-store media screens a few months later with a short addendum rather than a new assessment. Media reporting uses the same anonymous zone counts, with the projection method disclosed to advertisers, so one measurement foundation serves operations, merchandising and media at once.
Pitfalls and How to Avoid Them
- Buying capabilities you do not need. Cameras with identification features invite scope creep. Specify devices that cannot do what you do not want.
- Trusting vendor claims without verification. Test that devices really discard video and only transmit aggregates, and re-check after firmware updates.
- Forgetting employees. Staff are captured too, and workplace rules, including the AI Act’s prohibition of emotion recognition at work, apply.
- Mixing anonymous and identified data. Joining sensor paths with loyalty identities can re-identify people and change the legal analysis entirely.
- Weak signage. Hidden or vague notices undermine trust and can breach transparency obligations.
- Metrics without action. Dashboards that do not connect to staffing, layout or media decisions will lose funding quickly.
Looking ahead, journey analytics will increasingly combine store sensors with electronic shelf labels, smart carts, in-store media playout and 2D barcode scans, all at aggregate level. Industry measurement standards for in-store media are pushing retailers toward transparent, disclosed methodologies, and privacy-enhancing techniques such as on-device processing and aggregation thresholds are becoming standard features. The retailers that build privacy into the architecture now will be able to add these signals without reopening their legal and reputational risk.
Conclusion
In-store journey analytics can give retailers the operational insight they have long had online, but only if it is built on the right foundation. Start with business decisions, choose the least intrusive sensing that answers them, process data at the edge, keep anonymous and consented data separate, be transparent with shoppers and staff, and verify continuously. Measuring flows rather than faces delivers almost all of the value with a fraction of the risk, and it keeps the trust that every customer journey ultimately depends on.
How Hanoi Technology Can Help
Hanoi Technology designs privacy-by-design in-store analytics, from edge sensing and data pipelines to dashboards that connect store traffic with staffing, layout and media decisions.
Further Reading
- Guidelines 3/2019 on processing of personal data through video devices – European Data Protection Board
- EU Commission Publishes Guidelines on the Prohibited AI Practices under the AI Act – Orrick
- Rite Aid banned from using AI facial recognition – Federal Trade Commission
- IAB Releases In-Store Retail Media Definition, Measurement Standards – MediaPost