A camera on the screen: what regulators require

Many displays can be fitted with a small camera or sensor. The technology counts how many people are standing in front of the screen, estimates age and gender, or measures how long someone looks. For advertising networks this is tempting because it provides evidence of audience. Anyone installing such a device in a shop should know beforehand what the data protection authorities say about it.

In Germany the key document is the guidance of the Data Protection Conference (Datenschutzkonferenz, the joint body of the federal and state supervisory authorities) on video surveillance by non-public bodies, dated July 2020. It is addressed to everyone who uses cameras, not only to security services.

Legal basis: legitimate interest, rarely consent

According to the guidance, the legal basis is normally Article 6(1)(f) of the General Data Protection Regulation, that is, a balancing of the operator's interest against the rights of the people captured. Consent is practically ruled out in a shop: the controller can hardly prove that everyone walking through the picture has consented.

The sign before the camera

People should be informed before they enter the area being captured. The conference recommends two layers: an advance notice at eye level and a full information sheet that is displayed on site or published online. The sign should show, among other things, a camera symbol, the controller with contact details, the data protection officer where one has been appointed, purpose and legal basis in keywords, the legitimate interest and, where applicable, the storage period.

One sentence of the guidance applies directly to advertising screens: if processing could come as a surprise to those affected, for instance because data is processed for marketing purposes, this must be pointed out clearly.

Facial recognition means an impact assessment

Where biometric data is processed with facial recognition software in order to carry out advertising and marketing measures, the guidance says a data protection impact assessment is mandatory beforehand. It explicitly lists "advertising and marketing measures using facial recognition software" as an example of high risk.

Store only briefly

The longer data is stored, the greater the burden of justification, the conference writes, particularly beyond 72 hours. For audience measurement the cleanest solution is obvious: do not store images at all and keep only counts. Whether a particular product actually works that way is something the supplier has to confirm in writing.

Since August 2026: an information duty under the AI Act

Article 50 of the EU AI Act has applied since 2 August 2026. Paragraph 3 requires deployers of an emotion recognition system or a biometric categorisation system to inform the people exposed to it about its operation. The information has to be given clearly and at the latest at the time of first exposure.

A sensor that derives a mood or a category of person from a face may fall under this. The question for the supplier is therefore: what exactly does the system derive from the camera image, and how does the manufacturer classify it under the AI Act?

Even a dummy has consequences

A switched-off sensor or a dummy processes no data. The guidance points out, however, that the mere impression of surveillance can create pressure on behaviour and give rise to civil claims. A visible lens that is not in use is better covered or left out.

Before switching on

1. What is the sensor for, and could it be done without a camera, for example with a counter at the door?
2. What is stored, where and for how long?
3. Is the notice placed where it can be seen before reaching the screen?
4. Is there an impact assessment if faces are analysed?

This article is an overview based on the sources named and is not legal advice.