"Anonymous" is one of the most stretched words in the footfall industry. A vendor can attach it to almost any system: the camera counter that blurs faces after recording them, the Wi-Fi counter that hashes a MAC address, the depth sensor that never saw a face at all. All three call themselves anonymous. Only one of them is anonymous in the sense that actually protects a visitor, and the difference is worth getting exactly right, because it decides how much personal data a system ever held.
This post is about the category term itself: anonymous people counting, sometimes called anonymous people flow monitoring. It sets out what "anonymous" precisely means here, why it is a stronger claim than "anonymized," which methods genuinely qualify, and what anonymous flow monitoring can tell you when it holds no identity at all. For the sensing-modality comparison, see biometric vs non-biometric counting; this post owns the "anonymous" label and the distinction that sits under it.
What is anonymous people counting?
Anonymous people counting measures how many people enter a space and how they move through it without ever capturing information that could identify anyone. Precise wording matters: an anonymous method captures no personal data at all, which is stronger than an "anonymized" method that first collects personal data and then strips it. Depth sensing that records geometry rather than images, and signal sensing that stores no MAC address by default, produce counts, dwell times, and flow paths while holding no identity. The result is analytics on crowds and journeys, never on named individuals.
Anonymous vs anonymized: why the difference is not pedantic
Read quickly, "anonymous" and "anonymized" look like the same idea in two spellings. They are not. They describe two different sequences of events, and the gap between them is the whole point of this post.
An *anonymized* system collects personal data first, then removes or obscures the identifying part. A camera records a face, then software blurs it. A Wi-Fi sensor reads a MAC address, then hashes it into a token. At some moment, however brief, the system held personal data. It processed it. If the removal is imperfect, or the raw data is retained too long, or the hash can be reversed or linked back, the personal data can resurface. Anonymized data starts as personal data and depends on a process to stop being personal data.
An *anonymous* system never captures the identifying part in the first place. A depth sensor sees a shape crossing a line and increments a count; there was never a face to blur. A signal sensor detects that a device is present and moving, without storing the identifier that would tie it to one device; there was never a MAC address to hash. Nothing identifying was collected, so there is nothing to strip, nothing to retain by mistake, and nothing that can resurface later. The protection is structural, not procedural.
That distinction is not academic under GDPR. GDPR regulates the processing of personal data, so a system that never processed personal data is on firmer footing than one that processed it and then reduced its identifiability. The anonymized system is making a claim about how well its cleanup works; the anonymous system is making a claim about what it never touched. The second is the one that does not depend on a process holding up. It is also the reason the honest phrase for a genuinely camera-free, identifier-free method is "there is nothing to anonymise," not "we anonymise your data."
Which methods are genuinely anonymous, and which only claim to be
Sorting the methods by the anonymous-versus-anonymized test cuts through the marketing quickly.
Genuinely anonymous methods capture no identifier at any point. Depth or Time-of-Flight geometry counting registers a person as a shape crossing a threshold and never forms an image of them. Signal sensing that stores no MAC address detects presence and movement without holding the identifier that would single out a device. Both produce useful analytics while holding nothing that relates to an identifiable person.
Methods that "anonymise" started with personal data. A camera counter that blurs faces recorded a recognisable image before the blur was applied. A Wi-Fi counter that hashes MAC addresses read the raw address before hashing it. These can be run responsibly, and a well-configured one may hold little identifiable data at rest. But they are not anonymous in the structural sense; they are anonymized, and the difference lives in whether personal data ever existed in the pipeline. A camera method is not automatically incapable of protecting privacy, but the practical fact remains that it captured personal data at the point of measurement, and its privacy then depends on what happens next. For the specific Wi-Fi case, see why Wi-Fi probe sniffing is not anonymous; for the disclosure-label view of what a sensor actually captures, a privacy label for a counting sensor; and for the mechanics of where the scrubbing happens, edge scrubbing versus cloud blur.
What anonymous people flow monitoring gives you
A fair question at this point is whether giving up identity means giving up useful data. It does not. Anonymous people flow monitoring is surprisingly rich precisely because most footfall questions are about patterns, not people.
- Counts. How many people entered, by hour, by day, by entrance, compared across periods.
- Dwell time. How long visitors stay in a zone, which reveals where a space holds attention and where it loses it.
- Flow paths. The routes people take through an interior, which corners fill and which stay empty, where journeys stall.
- Repeat-versus-new patterns. Whether the same movement rhythms recur, at the level of aggregate behaviour rather than tracked individuals.
None of that requires knowing who anyone is. "Sixty percent of visitors who enter through the north door reach the rear third of the floor" is an operational insight, and it names nobody. Identity would add almost nothing to it. The mistake behind a lot of over-collection is assuming you need to follow a person to understand a pattern, when the pattern is visible in anonymous flow alone. Anonymous flow monitoring gives the operational answer without ever creating the privacy liability that identity brings.
How Ariadne does anonymous counting and flow
Ariadne is anonymous in the structural sense described above, not the procedural one. There is no cleanup step because there is nothing to clean up.
Ariadne measures this with Hybrid Fusion, its patented camera-free method. Time-of-Flight depth sensing counts every visitor at the entrances, capturing geometry rather than images, while patented phone signal sensing follows movement through the interior, detecting the signals a phone emits even in airplane mode, and tracks that movement to about one-metre precision. The sensor streams both feeds to Ariadne, where Hybrid Fusion combines them into one trajectory per visit and computes counts, dwell, and paths. The streams carry no identifier: no MAC address, no device ID, no biometric data, and no camera is involved. Identifiers are stored only when a visitor explicitly opts in, which keeps the method GDPR-friendly and outside biometric territory.
Two details are worth drawing out. First, the trajectory Hybrid Fusion builds is a path, not a person. It records that a visit moved from the entrance to the rear of the floor and stayed for four minutes; it does not record whose visit that was, because no identifier was captured to attach it to. Second, the combining happens centrally in the Ariadne platform, on two feeds that already carry no identifier, so fusion does not create personal data as a side effect. The only path to identity is an explicit opt-in that a visitor chooses, such as a guest Wi-Fi login, and that is a separate consented layer, kept apart from the anonymous count. That is what anonymous people counting looks like when the anonymity is built into the method rather than bolted on afterward.
This is general information about how the method works and how privacy concepts apply to it, not legal advice for a specific deployment. If a deployment adds an opt-in identified feature, that feature has its own considerations; confirm the particulars with your DPO or counsel.
FAQ
What is anonymous people counting?
Anonymous people counting measures how many people enter a space and how they move through it without capturing any information that could identify anyone. A genuinely anonymous method records no camera image and stores no device identifier, so it produces counts, dwell times, and flow paths while holding no identity at all. The output is analytics on crowds and journeys, not on named individuals.
What is the difference between anonymous and anonymized data?
An anonymous method never captures identifying data in the first place, so there is nothing to remove. An anonymized method collects personal data and then strips or obscures the identifying part, which means it held personal data at some point and depends on that removal working. Anonymous is the stronger position because it does not rely on a cleanup step holding up.
Does anonymous counting still tell me anything useful?
Yes. Most footfall questions are about patterns, not people: how many entered, how long they stayed, which routes they took, whether the same rhythms recur. Anonymous flow monitoring answers all of that without knowing who anyone is, because identity adds little to an aggregate pattern and creates a privacy liability that the pattern never needed.
Is a camera counter that blurs faces anonymous?
It is anonymized rather than anonymous. The camera recorded a recognisable image before the blur was applied, so personal data existed at the point of capture, and the system's privacy then depends on the blur and the retention rules. A method that never forms an image is anonymous in the structural sense, because it never captured the identifying part.
Do I need cameras to count people anonymously?
No. Ariadne counts with Hybrid Fusion: Time-of-Flight depth sensing plus patented phone signal sensing, never cameras. Time-of-Flight captures geometry rather than images, and signal sensing captures no MAC address by default, so the measurement involves no video, no faces, and no biometric data.
