# Indoor localization in shopping centres, without collecting personal data | OneStack > Case study: counting people flows in large public spaces and locating with centimetre precision only what needs it, using three radio technologies. URL: https://www.onestack.it/en/case-studies/indoor-localization [← All case studies](/en/case-studies)Retail and large public spaces # Indoor localization in shopping centres, without collecting personal data Counting and following people flows in large public spaces, and locating with centimetre precision only what needs it. A three-layer architecture, each layer with the right radio technology. ![3D render of the Bluetooth Channel Sounding anchor board: nRF54L15 SoC with chip antenna, accelerometer, power from USB-C or a 12–24 V terminal block](/_astro/ancora-ble.Ckke5SRn_1319HC.webp)![](/_astro/ancora-ble-xray.yah8tbey_Z2nf2oG.webp) 3 layers anonymous flows, precise position, smartphone proximity 0 MACs leaving the sensors: data is anonymous by design System architecture **Wi-Fi sensing nodes**ESP32 · per-zone counting from CSI **UWB anchors**TDoA · battery tags **Bluetooth anchors**nRF54L · Channel Sounding **Edge gateway**data fusion · per-zone anonymisation **Platform**flow and position dashboard ## The context A shopping centre operator wanted to know how many people come in, where they go and how long they stay, zone by zone and in real time. For a first version we designed the electronics and firmware of a Wi-Fi and Bluetooth sensor network. Today the same question has better answers, and this is how we design it now. ## The problem For years the simplest method was counting phones from the Wi-Fi scan requests they send. It no longer works: iOS and Android change their MAC address on every scan, so the same phone shows up as several devices and counts are inflated. European regulators also treat even a hashed MAC address as personal data, so a MAC-based system exposes the client to GDPR risk. ## Constraints - Sensors that fit into architectural elements, mains- or battery-powered. - **No personal data leaving the sensor.** - Hundreds of nodes managed remotely, with OTA configuration and firmware updates. - Two different needs: aggregated flows across the whole centre, and precise positions only for trolleys, assets and staff. ## Technical choices, and why **Wi-Fi sensing for anonymous flows.** CSI (Channel State Information) describes how people disturb the Wi-Fi signal; IEEE 802.11bf, published in 2025, formalises it. People carry nothing, and only per-zone counts leave the sensor: no identifier to protect. Published research reaches 98% counting accuracy for groups of up to 20 people, but results depend heavily on node placement, so placement is part of the design. **UWB for precise position.** Synchronised anchors and battery tags per IEEE 802.15.4z. We locate by time difference of arrival (TDoA): the tag only transmits, uses very little power and the system scales to many tags. Chip specifications state about 10 cm in line of sight; without line of sight the error grows, and anchor placement keeps it in check. **Bluetooth 6.0 Channel Sounding for smartphone proximity.** It measures the distance between an anchor and a phone or tag, with a check that makes relay attacks hard. It is accurate at short range but suffers from reflections and device orientation at longer distances, so we use it for proximity, not precise localization, which stays with UWB. **Processing on the node and the gateway, not in the cloud.** Each node sends only aggregated data; the edge gateway fuses the three sources and anonymises per zone before anything leaves the site. ## How we verify it - A test bench comparing all three technologies. - OTA updates with signed images and automatic rollback. ## The result An architecture that overcomes the limits of MAC-based counting: anonymous data by design, centimetre precision only where needed, one firmware platform for every node. ## What we bring to your projects Low-power radio (Wi-Fi, BLE, UWB), firmware on ESP32 and Nordic with Zephyr, on-device processing, privacy by design and OTA management of device fleets. ## Services - PCB design - Firmware development ## Technologies - Wi-Fi CSI - IEEE 802.11bf - UWB IEEE 802.15.4z - Bluetooth 6.0 Channel Sounding - ESP32 - Nordic nRF54L - Zephyr - OTA ## More case studies [ ![3D render of the control board: microcontroller in the centre, connectors for the two isolated channels on the side, pluggable terminal blocks and power and service connectors](/_astro/interfaccia-rugged.CkQk4iYb_1A6Ozp.webp)![](/_astro/interfaccia-rugged-xray.CZb6dpZZ_Z1kxhOu.webp) 23 tests in ~75 s Systems for harsh environments ### A rugged interface that updates in the field and never bricks A portable, battery-powered unit that powers and controls two remote devices over isolated channels. The hard part was making it reliable far from any lab. Its firmware updates in the field and, if something goes wrong, rolls back on its own to the last working version. Read the case → ](/en/case-studies/rugged-interface-secure-ota)[ ![3D render of the measurement bench: the sensor under test and three boards inside a black anodised aluminium housing, with two BNC connectors and an M12 connector](/_astro/banco-sensore-capacitivo.DpjM9RDJ_2dpT9y.webp)![](/_astro/banco-sensore-capacitivo-xray.CdoncSBR_Z1LXalp.webp) ~1.4% Test systems for high-reliability applications ### The test method would not have worked. We found out before building it A bench that tells in seconds whether an electric-field sensor works, measuring capacitances of a few picofarads in air. The method planned at the start was ruled out with measurements, before any money went into hardware. Read the case → ](/en/case-studies/capacitive-sensor-test)[ ![3D render of the test bench: two steel plates clamped by tie rods with the discs and the boards inside, handles on the sides and the actuator on top](/_astro/banco-mems.BVjo7je3_Z2tCAuW.webp)![](/_astro/banco-mems-xray.CArss8sQ_Z1wwNRX.webp) \> 40 dB Test systems for high-reliability applications ### Ten seconds to know whether a MEMS accelerometer really works A bench and firmware that say yes or no on whether a MEMS accelerometer is present and well coupled to the structure, even in the hands of a non-specialist operator and with the machine running. Read the case → ](/en/case-studies/mems-sensor-10s-test) ## Got a deadline? Tell us about your project: within 48 hours you get a proposal with phases and dates. If needed, we sign an NDA before seeing your files. [Request a proposal](/en/contact)[Urgent? Call +39 030 535 7183](tel:+390305357183)