Cities need occupancy and movement data. Residents need assurance that the cameras are not tracking them. Both requirements can be met if privacy is designed into the pipeline rather than promised afterward.
People counting is one of the most requested smart-city analytics and one of the most scrutinized. The useful outputs are aggregate: how many people are in the square, how flow through the station changes across the day, where crowds form during an event. None of this requires knowing who anyone is. Yet the same cameras could, with different software, identify individuals, and the public knows it. Designing a counting system therefore involves two problems at once: measuring accurately and demonstrating that identification is not happening.
What the model actually needs to see
A person detector locates a human-shaped region in an image and returns a box. A tracker links those boxes across frames so the same person is not counted twice. Neither task needs a face. Detection models trained for counting work on body shape, posture and motion, and perform well on footage where faces are far too small to resolve, which is the case for most elevated public cameras anyway.
This matters because it allows a deliberate choice: operate on resolutions and viewpoints where identification is not practically possible. Downsampling frames before inference reduces compute at the edge and reduces what the system can ever know. A camera mounted high and wide for coverage is a worse camera for recognition and a perfectly good one for counting.
Tracking without re-identification
Multi-object trackers often use appearance features to re-acquire a person after occlusion. Those features are, in effect, a short-lived visual signature. For counting in public spaces we constrain this in two ways. Appearance embeddings are kept in memory only for the lifetime of a track and are never written to storage. And embeddings are not compared across cameras, so the system cannot follow an individual from one view to another. Flow between areas is measured by counting line crossings at each camera, not by following people.
The trade-off is real. Without cross-camera re-identification, a person who leaves one camera's view and enters another is two anonymous observations, not one journey. For occupancy and flow analytics this is acceptable. For a system that promised origin-destination tracking of individuals, it would not be, and that is precisely the kind of system a public counting deployment should refuse to be.
Aggregate before anything leaves the device
The strongest privacy guarantee is architectural. If raw video and per-person detections never leave the edge device, no central system, database breach or well-meaning analyst can misuse them. In our designs the edge unit emits counts per interval, per zone and per direction, along with device health. Nothing about an individual frame or track is transmitted.
- Video is decoded, analyzed and discarded in memory; no frames are persisted by default.
- Track identities are ephemeral integers with no link to any external data.
- Outputs are aggregated counts over fixed intervals, with small counts optionally suppressed.
- Any diagnostic frame capture is disabled in production builds and requires physical access to enable.
Being able to prove it
Public bodies increasingly have to explain what their cameras do. A privacy-by-design pipeline is easier to explain when its guarantees are enforceable rather than policy-based. Practical steps include publishing the data schema that leaves each device, keeping the edge software auditable, logging configuration changes, and allowing an independent reviewer to confirm that the deployed models have no recognition capability. These are engineering tasks, not legal ones, and they belong in the project plan from the start.
Accuracy under real conditions
Privacy constraints do not excuse poor counting. Crowded scenes, umbrellas, strollers and groups walking in step all challenge detectors. Validation should use footage from the actual cameras across weather, lighting and busy periods, with manual counts over sampled intervals as ground truth. Where a camera cannot support reliable counting, the honest answer is to say so and suggest a different mounting position rather than to report numbers nobody should trust.
Done this way, people counting delivers what city teams need, continuous occupancy and flow data, while giving residents a clear and verifiable answer to the question they are entitled to ask: the cameras count, they do not watch.