Facilities teams need to know how buildings are used: which rooms sit empty, when floors fill, how many people are in a zone so ventilation can follow them. None of those questions requires knowing who anyone is. Yet the default tool is often a camera, and the moment cameras appear on a ceiling, people assume — reasonably — that they are being watched.
Privacy-preserving sensing is an architecture, not a promise. Choose sensors that cannot identify people, process on the device, transmit counts instead of images, keep less data for less time, and tell people what you are doing. This article is the design checklist we use.
Start with the question, not the sensor
Every occupancy project should begin with a written list of the decisions the data will support. That list sets the ceiling on what you collect.
| Question | Data that answers it | Data it does not need |
|---|---|---|
| Is this room in use right now? | Presence per zone, every few minutes | Counts, identities, images |
| How many people are on this floor? | Count per zone per interval | Identities, individual paths |
| Which booked rooms sit empty? | Presence per room, compared with bookings | Who booked or attended |
| How much of our space do we really use? | Peak and average use per zone over weeks | Individual patterns |
| How long is the queue at the dock office? | Counts and dwell-time distributions | Faces |
Ventilation and lighting control mostly need presence and approximate counts. Real-estate planning needs aggregates over weeks. Nothing on the list needs a name.
Sensors and what they can reveal
A sensor’s privacy properties come from its resolution, its placement and what it can transmit — not from its product category.
| Sensor | Measures | Identifying potential | Watch out for |
|---|---|---|---|
| Passive infrared (PIR) | Motion | Very low | Misses people sitting still; no counts |
| CO₂ | A lagging proxy for occupancy | Very low | Minutes of delay; depends on ventilation rate |
| Low-resolution thermal array | Warm shapes, counts | Low | Crowds merge; hot equipment and sunlight confuse it |
| Time-of-flight depth | Shape and direction at doorways | Low to moderate | Height and build are visible; faces and clothing color are not |
| mmWave radar | Presence and small movements | Low to moderate | Can sense breathing-level motion and see through some materials — say so |
| Wi-Fi or Bluetooth device counts | Devices, not people | High | Device identifiers can be personal data |
| Camera with on-device counting | A full image, processed locally | High capability | Needs the strongest technical and policy controls |
Thermal is not automatically anonymous. A very low-resolution array shows warm blobs; a high-resolution thermal camera at close range shows faces, gait and what someone is doing. The same is true of depth sensors at high resolution. Specify resolution and mounting height for the question you are answering, and no more.
Accurate enough for the decision
The usual objection to low-resolution sensors is accuracy, and it is worth testing against the decision rather than in the abstract. A ventilation controller serving a 40-person open office does not behave differently whether the count is 23 or 25. A space-planning study that asks whether a floor ever exceeds 60% use over a quarter is not changed by a miss at a busy doorway on a Tuesday. Before choosing a higher-resolution sensor for accuracy, write down which decision the extra accuracy would change. Usually the answer is none.
The security-camera shortcut
Sooner or later someone suggests reusing the CCTV cameras that are already on the ceiling. Resist it. Security cameras were installed for a different purpose, with their own retention rules, access lists and expectations among the people they record. Running occupancy analytics on their footage widens that purpose, sends more video to more systems and makes the occupancy program inherit every privacy question the security system carries. A separate, purpose-built counting sensor is usually cheaper than the conversation that follows.
Process on the device, emit counts
The strongest privacy control is one that does not depend on anyone’s good behavior. If the sensor turns its raw signal into a count internally and transmits only that number — “zone 4: 7 people, 10:15–10:30” — there is no image to leak, subpoena or misuse.
Make that property architectural:
- Choose devices that cannot stream images. If a sensor can be reconfigured to stream video, it is a camera, whatever the purchase order calls it. Where a camera is the only workable option, the image path should be disabled in signed firmware, not by a setting an administrator can flip.
- Control commissioning views. Installers need to aim sensors. Use a commissioning mode that shows a view on a local tool only, is logged, and switches itself off.
- Isolate the network. Put sensors on their own segment, with outbound traffic only to the aggregation point and no inbound access. This is good security practice anyway; our Edge & OT Security work treats occupancy sensors like any other connected device.
- Prove it. During commissioning, capture traffic on the sensor segment and show that only count messages flow. That capture is the most persuasive document you can hand an employee representative.
Minimize and expire
Counts can still identify someone if they are fine-grained enough. One person in a private office at 7:02 every morning is a person, not a statistic.
- Aggregate in space. Report by zone rather than desk, unless desk-level use is the actual question — and then report presence, not people.
- Aggregate in time. For HVAC and space planning, intervals of several minutes are enough.
- Use small spaces live, store them coarsely. A private office can drive its own ventilation in real time while its history is stored only as part of a larger zone.
- Never join. Do not link occupancy data with badge records, Wi-Fi logs, calendars or HR data. Joining datasets is where anonymity usually ends.
- Expire on a schedule. For example: interval counts kept for 90 days for troubleshooting, hourly aggregates for three years for planning. Then confirm that deletion actually happens.
- Limit access. Role-based access, with an audit log of who viewed what.
Signage and employee communication
People accept measurement they understand and resist measurement they discover. Tell them first.
- Brief employees before installation: what is measured, why, what the sensors cannot do, and how long data is kept. Show the real output — a table of counts per zone — rather than a diagram.
- Post plain-language signs at the entrances to sensed areas, with a contact for questions.
- If your workforce is represented, involve the union early. In some countries, works councils have a legal right to be involved before monitoring technology is introduced.
- Publish a short FAQ, and answer every question in writing.
Some jurisdictions regulate biometric data specifically. Illinois’ Biometric Information Privacy Act, for example, lists a scan of face geometry among biometric identifiers, requires a written release before such data is collected, and requires a public retention and destruction schedule. Other states and countries have their own rules. A counter that never computes anything about faces and never stores images is designed to stay well clear of that territory, but how a law applies to a particular system is a question for your counsel.
Governance that outlasts the project
Sensors stay in ceilings for a decade. The people who installed them move on. Governance is what stops a ventilation project from turning into a monitoring program by accident.
- A named owner in facilities, and a named reviewer from security or privacy.
- A written purpose statement. The system supports ventilation, energy and space planning. It is not used for attendance, performance or discipline.
- Change control. Any new use, new data join, higher-resolution sensor or longer retention goes through review first.
- A requests log. When someone asks “who was in room 4B at 3 p.m.?”, the answer is that the system cannot say — and the log shows the question was asked.
- An annual check that configuration, network traffic and deletion still match the design.
- Vendor terms that confirm you own the data, prohibit secondary use and require deletion at the end of the contract.
In our facility and energy monitoring work, occupancy arrives in the Facility module of Perflens Console as counts, beside energy, compressed-air and environmental data, so ventilation and lighting can respond to how a building is actually used. For offices, campuses and mixed-use buildings, our commercial facilities page covers the wider stack.
Done well, privacy-preserving sensing is also easier to secure, easier to explain and easier to keep running. Data you never collect never needs protecting.