In Germany, installing a technical system in a workplace is rarely a decision the employer makes alone. Where a works council (Betriebsrat) exists, German co-determination law gives it a formal say over systems capable of monitoring how employees behave or perform. A footfall counter can land squarely in that conversation, because a device on the ceiling that measures movement looks, at first glance, like exactly the kind of system the law was written to cover. Whether it truly is depends on what the system can observe about employees, and that turns out to be the question that decides everything.
This post explains the German co-determination context in plain terms, walks the test a works council actually applies, and sets out why a camera-free counting method that measures customer volume and captures no identity gives a works council far less to be concerned about than a camera or an identified-tracking system would. It is written for the German-jurisdiction reader that the general privacy posts do not serve. It is general information, not legal advice; the works council, the data protection officer, and qualified counsel should assess the specific installation.
Does a works council have a say in installing people counters in Germany?
In Germany, a works council (Betriebsrat) has co-determination rights over technical systems that are capable of monitoring employee behaviour or performance, under the German Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), including its Section 87(1) no. 6. Whether a footfall system falls under that right depends on what it can observe about employees. A camera-free counting method that measures customer volume and flow, captures no face and no identifier, and stores nothing that ties movement to a named employee gives a works council far less to be concerned about than a camera or an identified-tracking system. This is general information, not legal advice; the works council and qualified counsel should assess the specific installation.
What co-determination covers under the BetrVG
German co-determination is a defining feature of the country's workplace law, and the relevant provision here is well known to any works council. Section 87(1) no. 6 of the Betriebsverfassungsgesetz gives the works council a co-determination right in the introduction and use of technical devices that are designed to monitor the behaviour or performance of employees. German case law has read that provision broadly over the years: the settled interpretation is that the device only needs to be objectively capable of such monitoring for the co-determination right to attach, regardless of whether the employer actually intends to use it that way. Anyone relying on the exact scope should read the current statutory text and the relevant case law, or have counsel do so, rather than treat this summary as the operative wording.
That "capable of monitoring" standard is the crux. It is deliberately wide, because the law is concerned with the potential for surveillance of employees, not only with an employer's stated intentions. A system that could monitor staff, even if the employer promises it will not, can still fall within the right. This is why the honest question is never "do we plan to watch employees" but "can this system observe an identifiable employee at all." The answer to that second question is a fact about the technology, and it is where the choice of counting method starts to matter a great deal.
Co-determination is not the only obligation in play. German and EU data protection law, including the GDPR and the Bundesdatenschutzgesetz, apply to any processing of employee personal data alongside the co-determination right. The two run in parallel: a system can raise a data protection question, a co-determination question, or both. This post is about the co-determination angle specifically; the data protection assessment is its own exercise, and both should be worked through for a real installation.
The question that decides it: can the system observe an identifiable employee?
Because the co-determination right hinges on capability to monitor employees, the practical test reduces to one question. Can this system observe an identifiable employee? If it can, the right is very likely engaged and the works council must be involved before the system goes in. If it genuinely cannot, because it captures no identity of anyone, the ground for the concern narrows considerably, though the assessment still belongs to the works council and counsel.
This is where customer-counting and employee-monitoring separate cleanly. A footfall counter is aimed at understanding how many customers enter a space and how they move through it. It is not aimed at staff. But intention is not the test, capability is, so the question is whether the system could observe an employee even incidentally. A camera can: it captures a picture in which a specific employee is recognisable, whether or not anyone set out to watch them. An identified-tracking system can: it holds a persistent identifier that could belong to an employee's device and be followed across the workplace. A method that captures no identity of any kind is in a different position. It has no face to recognise and no persistent identifier to follow, so there is no identifiable employee in the data to observe. That does not by itself decide the legal question, but it changes the factual picture the works council is assessing.
Why a camera-free, identity-free method lowers the concern
The method a counting system uses is the concrete fact underneath the co-determination question, so it is worth being precise about what a camera-free method does and does not capture.
Ariadne measures this with Hybrid Fusion, its patented camera-free method. Time-of-Flight depth sensing counts every visitor at the entrances, capturing geometry rather than images, while patented phone signal sensing follows movement through the interior, detecting the signals a phone emits even in airplane mode, and tracks that movement to about one-metre precision. The sensor streams both feeds to Ariadne, where Hybrid Fusion combines them into one trajectory per visit and computes counts, dwell, and paths. The streams carry no identifier: no MAC address, no device ID, no biometric data, and no camera is involved. Identifiers are stored only when a visitor explicitly opts in, which keeps the method GDPR-friendly and outside biometric territory.
Set against the "capable of monitoring an employee" test, several facts follow. The method captures no face, because Time-of-Flight sees geometry rather than images, so there is no picture in which an employee could be recognised. It captures no persistent device identifier by default, because the signal sensing carries no MAC address, so there is nothing that could be tied to a specific employee's phone and followed. The trajectories it produces are anonymous visits with no identity attached, and the fusion that produces them runs centrally inside the Ariadne platform, not at the sensor, so no identified record is created anywhere in the chain. The point to be careful about is the framing: this is not a system that captures employee data and then anonymises it. There is no employee identity captured to anonymise. A camera-free, identity-free method has substantially less capability to monitor an identifiable employee than a camera or a tracking system, and that is a meaningful reduction in the co-determination concern. It is a reduction, not an elimination: it lowers the concern, it does not decide the legal question, which remains for the works council and counsel to assess. For the underlying sensing-method contrast see non-biometric counting.
How to brief a Betriebsrat honestly
A works-council briefing goes best when it is specific and verifiable rather than reassuring in general terms. Four points cover the ground a Betriebsrat will want to establish.
- What the system measures. Customer counts, dwell time, and flow through the space, to run the location better. It is a customer-analytics tool, not a staff tool.
- What it never captures. No faces, no video, no names, and no device identifiers by default. There is no data field in which an individual employee could appear.
- Where the data lives and for how long. The fusion runs centrally in the Ariadne platform, and the output is aggregate counts and paths, not a record that ties movement to a person. For the residency detail, see where the data is stored.
- Why it is not employee monitoring. Because the method captures no identity, it cannot tell an employee's movement from a customer's, which means it cannot function as a monitoring tool even in principle.
The most useful framing for the whole briefing is the counting-versus-surveillance distinction: counting a crowd is not watching a person. A works council whose concern is employee surveillance can weigh that distinction directly against what the system captures. That framing is set out in full in counting is not surveillance, which pairs naturally with this brief. For the broader regulatory reasoning on why counting a non-identifying crowd is treated differently from biometric processing, see the EU AI Act view of counting.
What to still put in writing
Lowering the concern is not the same as removing the process, and a careful employer should expect to document the deployment regardless of how clean the method is. Where co-determination applies, the usual instrument is a works agreement (Betriebsvereinbarung) negotiated with the works council. It typically fixes the scope of what the system does, limits the purpose to the agreed customer-analytics use, sets out what is and is not captured, and records data handling and retention. Even where the parties conclude the method sits below the co-determination threshold, writing down the purpose limitation and a clear data map is good practice and makes the position easy to defend later.
A structured assessment helps here too. A data protection impact assessment, or an equivalent internal review, forces the questions a works council would ask and produces a record that the answers were considered before installation. See a data protection assessment template for a starting structure. What goes into the works agreement and whether one is required at all are decisions for the works council and counsel on the specific facts; this post is a starting point for that conversation, not a template to sign. To review the camera-free method itself, see camera-free people counting.
FAQ
Muss der Betriebsrat einer Personenzaehlung zustimmen?
That depends on whether the system is capable of monitoring employee behaviour or performance under Section 87(1) no. 6 BetrVG. A camera or an identified-tracking system is a strong candidate for the co-determination right. A camera-free method that captures no face and no identifier, and measures customer flow rather than staff, gives the works council far less to be concerned about, though the assessment still belongs to the works council and counsel. This is general information, not legal advice.
Do people counters monitor staff?
A camera-free counter cannot, because it captures no identity. Ariadne measures customer counts, dwell, and flow without capturing faces or device identifiers by default, so it has no way to tell an employee's movement from a customer's. It is a customer-analytics tool, not a staff-monitoring tool, and its data holds no field in which an individual employee could appear.
Does a camera-free people counter remove the works council's co-determination right?
No. It does not decide the legal question. What it does is change the factual picture the works council assesses: a method that captures no identity has substantially less capability to monitor an identifiable employee than a camera does, which lowers the concern. Whether the right applies to a specific installation is for the works council and counsel to determine.
Do I need cameras to count people?
No. Ariadne counts with Hybrid Fusion: Time-of-Flight depth sensing plus patented phone signal sensing, never cameras. Time-of-Flight captures geometry rather than images, and signal sensing captures no MAC address by default, so the measurement involves no video, no faces, and no biometric data.
What should a works-council briefing on a people counter cover?
Four points: what the system measures (customer counts, dwell, flow), what it never captures (no faces, no video, no names, no device IDs by default), where the data lives and for how long (aggregate output, central processing), and why it is not employee monitoring (no captured identity to monitor). Documenting these in a works agreement, where co-determination applies, records the position clearly.
