KVKK-Compliant People Counting Systems: A Guide to Anonymous Counting, Data Security and Technical Selection

People counting systems are technologies used to measure visitor traffic in shopping centres, retail stores, hospitals, museums, offices and other commercial spaces. Modern systems can do more than count entries and exits: they can also generate data on occupancy, visitor density, repeat visits and customer behaviour.

However, advances in people counting technology raise important questions about personal data protection. Particular care is needed to assess what data is processed by methods such as camera-based analytics, facial recognition, tracking device identifiers and matching people across different areas.

The primary aim of KVKK-compliant people counting systems is to process the minimum data necessary to measure visitor traffic and to create a system architecture that protects people’s privacy.

However, a system’s being marketed by its manufacturer as “anonymous,” “KVKK-compliant” or “privacy-friendly” does not, by itself, mean that it is legally compliant. Actual compliance depends on the sensor technology used, data processing methods, system configuration, retention policies and the business’s fulfilment of its obligations.

What Is a KVKK-Compliant People Counting System?

A KVKK-compliant people counting system is one designed and operated in accordance with the requirements of Personal Data Protection Law No. 6698 when personal data is processed as part of measuring visitor traffic.

In this context, the entire data processing lifecycle—not just the device’s technical specifications—must be assessed.

For example, a sensor at a store entrance might produce only total entry and exit counts for each hour. Another system might record visitors’ images, track people or attempt to match returning visitors.

The personal data processing risks of these two systems are not the same.

The key questions to ask are:

• What data does the system collect?

• Can visitors be identified, directly or indirectly?

• Are images or person-specific identifiers stored?

• Is data processed on the device, on a local server or in the cloud?

• Is data shared with third parties?

• Is there a data retention and deletion policy?

• Are the applicable legal conditions for processing data met?

Key distinction: Data consisting solely of anonymous, aggregated statistics may not qualify as personal data if it truly cannot be linked to identified or identifiable people. However, if personal data is processed while those statistics are being generated, that processing stage is assessed under KVKK.

Do People Counting Systems Process Personal Data?

Not all people counting systems process the same types of data.

Some systems detect only physical passage events and produce numerical results. Others may use camera images, person-tracking information or persistent identifiers.

Accordingly, whether a people counting activity falls within the scope of KVKK depends on how the technology actually works.

People Counting Systems That Do Not Process Personal Data or Pose Low Risk

Systems that detect only passage events and do not generate data that can be linked to a person may offer an advantage in terms of data minimisation.

For example, a suitably configured infrared passage sensor can detect that a person has passed a particular point and increment the total counter.

If the system generates no other data relating to an identifiable person, the aggregate count alone would not be expected to qualify as personal data.

However, it should still be checked whether the device generates other identifiers or event records that can be linked to individuals.

Camera-Based People Counting Systems

Visitor counting can be performed using IP cameras and AI-powered image analysis.

In these systems, images may be processed only temporarily or may be recorded.

Where identifiable images of people are processed, subsequently deleting the images or retaining only total counts does not, by itself, take the earlier personal data processing activity outside the scope of KVKK.

For this reason, the data processing architecture is particularly important in image-based systems.

Identification and Re-Identification Systems

Some advanced visitor analytics solutions can analyse whether people are seen again at different times or in different areas.

Creating or storing identifiers that can be linked to a person in such systems may increase the risk of personal data processing.

Facial recognition and biometric identification features in particular should be assessed separately from standard entry-exit counting.

What Is Anonymous People Counting?

Anonymous people counting measures visitor traffic without identifying individuals and in a way that does not allow the results to be linked to identifiable people.

For example, reporting that a store had 2.450 visitors in a day may constitute an anonymous aggregate statistic if no person-linked data underlies that result.

However, anonymisation and the use of pseudonyms (pseudonymization) are not the same process.

Assigning a random ID to a person or replacing a facial image with a mathematical feature vector does not in every case ensure anonymity.

If the system can match the person again or link them to other records, personal data processing may be taking place.

Accordingly, assessing anonymous people counting requires looking not only at whether images are stored, but also at whether a person can be identified again.

Comparison of People Counting Technologies from a KVKK Perspective

The sensor technologies used in people counting systems have different data processing characteristics.

This table is intended as a general risk assessment. The same sensor technology may use different data processing methods depending on the manufacturer or software configuration.

Are 3D People Counting Sensors KVKK-Compliant?

3D people counting sensors may use stereoscopic imaging, depth sensing or other three-dimensional measurement methods.

Some systems produce only passage counts, while others may generate person-tracking data, depth images or other analytical outputs.

Therefore, it cannot be said that 3D sensors automatically fall outside the scope of KVKK.

What to Check in 3D Sensors

• Are raw images or depth data stored?

• Can people be identified?

• Are permanent or temporary tracking IDs assigned to people?

• Can these IDs be linked to other datasets?

• Is analysis performed on the device?

• When are images and intermediate data deleted?

• What information is transferred to the central software?

Transferring only aggregate count data, without generating person-linked data or by irreversibly anonymising it under the necessary technical conditions, may reduce data protection risks.

However, a product’s KVKK compliance should be assessed using technical documentation and the actual system configuration.

AI-Powered People Counting and KVKK

AI-powered people counting systems can detect people in images and analyse entries and exits or occupancy levels.

Facial recognition technology is not always required for this process.

An image analytics algorithm can count people by assessing their body shape and movements.

However, it should also be assessed whether the images contain personal data, what data is retained following analysis and whether the system can identify people again.

Edge AI and Local Data Processing

In Edge AI systems, image analysis is performed directly on the camera or sensor.

This approach may reduce the need to send raw images to central servers.

For example, the device can perform the analysis and send only hourly entry and exit totals to the reporting system.

However, processing images on the device does not mean that no personal data processing takes place.

Edge AI can support data minimisation; on its own, it does not guarantee KVKK compliance.

How Is RE-ID Technology Assessed Under KVKK?

RE-ID (Re-Identification) refers to technological approaches intended to match records in images or at different observation points to determine whether they belong to the same person.

In retail analytics, RE-ID may be used to analyse repeat visits or assess movement between different areas.

However, assessing this technology from a data protection perspective differs from standard anonymous entry-exit counting.

For example, if a system assigns a visitor a persistent identifier and attempts to determine whether the same person returned an hour later, tracking data relating to that person may be created even if no name or telephone number is used directly.

Does RE-ID Always Process Biometric Data?

No. RE-ID systems can use different technical methods.

Not all matching methods based on clothing, movement, appearance or other features can automatically be classified as biometric data processing.

However, if biometric data obtained through specific technical processing is used to uniquely identify a person or confirm their identity, provisions on special-category personal data may apply.

Accordingly, feature extraction, identifier storage, matching duration and re-identification capability in RE-ID systems should each be examined separately.

Are Facial Recognition and People Counting the Same Thing?

No. People counting and facial recognition are technologies that serve different purposes.

People counting aims to measure the number of people entering or leaving a particular area.

Facial recognition, by contrast, may be intended to identify or verify people using specific technical methods.

In general, a store does not need to recognise customers’ faces to calculate its daily visitor count.

Where biometric data is processed in facial recognition systems, KVKK provisions on special-category personal data also apply.

Businesses should therefore consider avoiding identification technologies that are not genuinely necessary for visitor counting.

Are Cloud-Based People Counting Systems Compliant with KVKK?

Cloud-based people counting systems can enable visitor data from multiple stores or facilities to be managed through a central platform.

However, using the cloud does not, by itself, breach KVKK, nor does it automatically ensure compliance.

What matters is what data is transferred, where it is processed, who can access it and whether the relevant legal obligations are met.

Data Flows in Cloud Systems

A people counting system may use the following architecture:

1. The sensor detects a visitor’s passage.

2. Analysis is performed on the device.

3. Only entry and exit counts are generated.

4. Aggregate data is transferred to the central reporting platform.

5. The business accesses reports through its authorised users.

This arrangement may pose a lower personal data risk than an architecture in which raw images are sent to the cloud.

However, it must be verified that the data is genuinely anonymous. Individual event times, tracking IDs, device identifiers or information that can be matched with other records may qualify as personal data.

Servers Located Abroad

If personal data is transferred to servers abroad, Article 9 of KVKK should be taken into account.

Amendments that entered into force on 1 June 2024 introduced a new framework for transferring personal data abroad, based on adequacy decisions, appropriate safeguards and certain exceptional transfer circumstances.

For standard contracts, which are one of the appropriate safeguard mechanisms, the relevant contract must be notified to the Authority within five working days of all signatures being completed.

When selecting a cloud service, businesses should therefore examine not only the country where the data centre is located, but also sub-service providers, access permissions, data transfer relationships and legal mechanisms.

Data Minimisation in KVKK-Compliant People Counting Systems

Data minimisation is the principle of processing the least amount of personal data necessary for a defined purpose.

For example, if a business’s sole aim is to know the hourly visitor count, the need and proportionality of storing people’s facial images, identities or individual movement histories should be questioned.

The following technical approaches may be considered for data minimisation:

• Store only aggregate counting results.

• Disable raw image transfer if it is not required.

• Do not use identifiers that can be linked to individuals.

• Do not collect unnecessary metadata.

• Limit data retention periods.

• Assign user access permissions according to role.

• Apply appropriate security measures when transferring data.

These measures do not replace legal obligations, but they support the design of a system that complies with data protection principles.

Transparency Obligations for People Counting Systems

Under Article 10 of KVKK, where personal data is processed, the data controller must inform the data subjects concerned.

The privacy notice should contain the necessary information, such as the data controller’s identity, processing purposes, transfer information, data collection method, legal grounds and the data subject’s rights.

The Personal Data Protection Authority emphasises that the obligation to inform is separate from explicit consent.

Accordingly, the existence of one of the conditions for processing personal data does not, by itself, remove the obligation to inform.

Nevertheless, the legal assessment may differ between a system that generates genuinely anonymous statistics and processes no personal data at any stage, and one that analyses identifiable images.

Data Controllers and Data Processors in People Counting Systems

In enterprise people counting projects, it is important to determine correctly the roles of data controller and data processor.

For example, if a retail chain determines the purposes and essential methods of visitor analytics, it may be the data controller for the relevant activity.

A company providing cloud reporting services may act as a data processor, depending on the contract and its actual activities.

However, these roles are not determined solely by the titles used in the contract.

The parties’ actual decisions and authority concerning the purposes and methods of data processing should be assessed.

How to Choose a KVKK-Compliant People Counting System

For businesses and system integrators, data protection criteria should be as important as counting accuracy in the technical selection process.

1. Define the Measurement Objective

Do you need only entry and exit counts, or will you also analyse repeat visits or individual behaviour?

This distinction determines the technology to be used and the data processing risks.

2. Examine the Sensor’s Data Output

Verify whether the sensor produces raw images, depth data, tracking IDs or only aggregate counts.

3. Map the Data Flow

Identify the systems through which data passes from the device to the reporting platform.

4. Check Retention and Deletion Policies

Assess retention and deletion processes for temporary data on the device, central records, backups and cloud records.

5. Verify the Manufacturer’s Claims

Claims such as “KVKK-compliant” or “anonymous counting” should be verified through technical documentation and, where necessary, field testing.

6. Review Security and Access Permissions

Check user-based permissions, encryption, access logs and update processes.

7. Complete the Legal Assessment

If personal data is processed, assess the legal basis, transparency obligations, data transfers and other obligations for the specific implementation.

Technical Checklist for KVKK-Compliant People Counting Systems

• Has the system’s data processing purpose been clearly defined?
• Has it been assessed whether personal data is processed?
• Are raw images or depth data stored?
• Are person-specific tracking IDs created?
• Are RE-ID or facial recognition features available?
• Has the data minimisation principle been applied?
• Have cloud and third-party data flows been identified?
• If personal data is transferred abroad, have the legal conditions been assessed?
• Has the transparency obligation been checked?
• Have retention and deletion policies been established?
• Have access permissions and technical security measures been tested?
• Have the responsibilities of the manufacturer and system integrator been determined?
• Has counting accuracy been measured through field validation?

Frequently Asked Questions

Are people counting systems subject to KVKK?

People counting systems that process personal data fall within the scope of KVKK. Systems that produce only genuinely anonymous aggregate count results and do not process personal data at any stage may be assessed differently.

Do 3D people counting sensors process personal data?

It depends on the technology and configuration used. Some sensors produce only passage counts, while others may process images, depth data or person-tracking information.

Is explicit consent required for anonymous people counting?

If no personal data is genuinely processed, the requirement for explicit consent under KVKK does not arise. If personal data is processed, a valid processing condition must be identified; explicit consent is not mandatory for every personal data processing activity.

Is facial recognition necessary for people counting?

No. Entry-exit counting can be carried out using other sensor and image analytics methods without facial recognition.

Can RE-ID systems be KVKK-compliant?

Compliance depends on the nature of the identifiers used, the purpose of processing, the legal basis and the technical measures. It should not be assumed that every system with RE-ID features is automatically anonymous or KVKK-compliant.

Do cloud-based people counting systems breach KVKK?

No. Using the cloud does not, by itself, mean that the law is being breached. However, the relevant obligations must be met when personal data is processed or transferred abroad.

Conclusion

KVKK-compliant people counting systems cannot be defined solely by the technical features of a sensor or software.

Actual compliance concerns what data is collected, how it is processed, with whom it is shared, how long it is retained and how the business fulfils its legal obligations.

Infrared sensors, 3D depth cameras, AI-powered IP cameras and RE-ID technologies pose different data processing risks.

For this reason, visitor analytics requirements and personal data protection principles should be considered together in professional projects.

The best approach is to build a people counting architecture that obtains the visitor data the business needs using the least personal data possible, and that is technically verifiable and compliant with legal requirements.

References

1. Personal Data Protection Authority – Points to Consider When Using Security Camera Systems in Workplaces

2. KVKK – Public Announcement on Fulfilling the Obligation to Inform

3. KVKK – Transfer of Personal Data Abroad

4. KVKK – Standard Contracts

5. KVKK – Board Decision No. 2024/540 dated 28 March 2024