Indoor localization in shopping centres, without collecting personal data
Counting and following people flows in large public spaces, and locating with centimetre precision only what needs it. A three-layer architecture, each layer with the right radio technology.
- 3 layers
- anonymous flows, precise position, smartphone proximity
- 0 MACs
- leaving the sensors: data is anonymous by design
The context
A shopping centre operator wanted to know how many people come in, where they go and how long they stay, zone by zone and in real time. For a first version we designed the electronics and firmware of a Wi-Fi and Bluetooth sensor network. Today the same question has better answers, and this is how we design it now.
The problem
For years the simplest method was counting phones from the Wi-Fi scan requests they send. It no longer works: iOS and Android change their MAC address on every scan, so the same phone shows up as several devices and counts are inflated. European regulators also treat even a hashed MAC address as personal data, so a MAC-based system exposes the client to GDPR risk.
Constraints
- Sensors that fit into architectural elements, mains- or battery-powered.
- No personal data leaving the sensor.
- Hundreds of nodes managed remotely, with OTA configuration and firmware updates.
- Two different needs: aggregated flows across the whole centre, and precise positions only for trolleys, assets and staff.
Technical choices, and why
Wi-Fi sensing for anonymous flows. CSI (Channel State Information) describes how people disturb the Wi-Fi signal; IEEE 802.11bf, published in 2025, formalises it. People carry nothing, and only per-zone counts leave the sensor: no identifier to protect. Published research reaches 98% counting accuracy for groups of up to 20 people, but results depend heavily on node placement, so placement is part of the design.
UWB for precise position. Synchronised anchors and battery tags per IEEE 802.15.4z. We locate by time difference of arrival (TDoA): the tag only transmits, uses very little power and the system scales to many tags. Chip specifications state about 10 cm in line of sight; without line of sight the error grows, and anchor placement keeps it in check.
Bluetooth 6.0 Channel Sounding for smartphone proximity. It measures the distance between an anchor and a phone or tag, with a check that makes relay attacks hard. It is accurate at short range but suffers from reflections and device orientation at longer distances, so we use it for proximity, not precise localization, which stays with UWB.
Processing on the node and the gateway, not in the cloud. Each node sends only aggregated data; the edge gateway fuses the three sources and anonymises per zone before anything leaves the site.
How we verify it
- A test bench comparing all three technologies.
- OTA updates with signed images and automatic rollback.
The result
An architecture that overcomes the limits of MAC-based counting: anonymous data by design, centimetre precision only where needed, one firmware platform for every node.
What we bring to your projects
Low-power radio (Wi-Fi, BLE, UWB), firmware on ESP32 and Nordic with Zephyr, on-device processing, privacy by design and OTA management of device fleets.
