Privacy-by-Design Measurement: Anonymous and On-Device

Privacy-by-design measurement draws a deliberate line between understanding an audience on DOOH screens and identifying individuals. This article explains the six core principles of an anonymous, on-device measurement architecture that stores no image and creates no identity, and why those principles act as both a legal shield and a trust signal.

Note: This is general information, not legal advice. For a specific deployment, consulting a qualified legal professional is recommended.

What is privacy-by-design?

Privacy-by-design treats privacy not as a feature bolted on afterward but as a principle embedded into a system’s design from the start. In DOOH measurement, this means “produce data that is un-identifiable from the outset” rather than “collect the data first and protect it later.” By design, the system does not produce personal data; privacy is not a patch but the architecture itself.

The concrete consequence is that measurement sees an anonymous crowd, not specific individuals. The system answers “how many people, with how much attention, in what coarse demographic” rather than “who is this.” This distinction keeps it firmly on the safe side of the legal line between anonymous measurement and personal-data processing discussed in KVKK/GDPR and DOOH.

The six principles of privacy-by-design measurement

A privacy-first DOOH measurement architecture rests on six complementary principles. When they work together, measurement is both useful and free of personal data.

#	Principle	What it means
1	RAM-only processing	The image frame is processed in volatile memory for ~60–200 ms, never written to disk or transmitted
2	Detection, not recognition	The system detects presence (detection), not identity (recognition)
3	No biometric template	No face template or descriptor is created; a returning person is not re-recognised
4	Anonymous, aggregate output	Only aggregate metadata: counts, dwell, coarse distribution
5	Edge / on-device processing	Processing happens locally at the player level; raw imagery never travels the network
6	Independent verification	The approach is open to external audit (e.g. GDPR audit, privacy seal)

1. The image is processed only in RAM

The first and perhaps most important principle is that the image frame is never stored persistently. The frame is processed in volatile memory (RAM) for roughly 60–200 milliseconds; within that window the necessary anonymous metrics are extracted, and then the frame is permanently destroyed. The image is not written to disk or sent to a server. The principle at work is simple: an image that is never stored cannot be leaked.

2. It detects, it does not recognise

The system works through face detection, not face recognition. It detects that a face is present in the frame and roughly whether it is oriented toward the screen, but it does not know — and does not try to know — whose face it is. This separates measurement entirely from identity.

3. No biometric template is created

In privacy-by-design measurement, no biometric template, face descriptor, or persistent identity signature is ever generated. The direct consequence is that the system cannot re-recognise the same person at a later time. This limitation is not a shortcoming but a deliberate design choice; it is the key to keeping the data in the anonymous domain.

4. The output is anonymous and aggregate

The only thing the system produces is anonymous, aggregate metadata: how many people are present at a given moment, average dwell time, coarse age band and gender distribution. These outputs describe a crowd, not an individual. It is worth being honest about the limits of demographic estimation; the article on the limits of demographic measurement explains why age estimation is reliable only at a coarse-band level.

5. Processing happens on-device (edge)

Performing processing locally on the player hardware next to the screen (edge / on-device) rather than in a central cloud strengthens privacy. The raw image never leaves the device; only anonymous numerical results are transmitted over the network. This both shrinks the attack surface and aligns with the principle of data minimisation. How computer vision performs this processing is detailed in computer vision for measurement.

6. Independent verification is possible

The final principle is that the system’s claims can be verified from the outside. That the image is not stored, that no biometric template is created, and that the output is anonymous can be confirmed by an independent audit — for example a GDPR compliance audit or a privacy seal process. Verifiability is different from “trust me”; it turns a claim into evidence.

Why is this both a legal shield and a trust signal?

These six principles serve two purposes at once. As a legal shield: because the output stays anonymous and aggregate and no individual is identified, measurement largely falls outside the definition of personal-data processing, which lightens obligations under GDPR and KVKK (Türkiye’s GDPR-equivalent). As a trust signal: brands, screen owners, and the public receive a clear and verifiable “no” to the question “is my image being stored, am I being recognised?”

One nuance deserves an honest mention: if a feature such as cross-screen frequency capping — which requires recognising the same person across screens — is added, the third principle (no template) is strained, and the data shifts from anonymous into the pseudonymous or biometric domain. Privacy-first architecture therefore deliberately avoids cross-screen identity matching.

Privacy-first, computer-vision-based measurement providers (such as Mecrai) adopt these six principles as the backbone of their architecture, so that measurement is both useful and anonymous by design.

Summary

Privacy-by-design measurement makes privacy the architecture itself rather than a patch: RAM-only processing, detection-not-recognition, no template, anonymous output, edge processing, and independent verification. When these six principles work together, measurement is both useful and anonymous by design — and that is both a legal shield and a strong trust signal.