Recognising faces.

What facial recognition is

The technology analyses the image from a camera, finds a face in it and converts its features into a set of numerical characteristics. That set is then compared with those already in a database. If a match is found, the system reports who is in front of it; if not, it records a new person.

The system consists of three parts: cameras that capture the image; algorithms that isolate and describe the face; and a database the comparison is run against. The third part is the most problematic, and it is where all the legal difficulties lie.

It is important to distinguish two different scenarios. Identification answers the question “who is this” and requires a database linked to identities. Anonymised analytics answers the question “how many people passed through and roughly how old were they”, without storing who exactly they were. The tasks and requirements are fundamentally different.

What the law says

A facial image processed to establish identity is classed as biometric personal data. In Russia it may be processed only with the person's written consent - a direct requirement of the personal data law.

The practical conclusion is simple: deploying a camera on the shop floor that recognises people coming in and picks an offer for them, without the explicit and documented consent of each one, is not allowed. No sign on the door counts as consent.

Anonymised visitor counting, where the image is not stored and identity is not established, is regulated more leniently, but a lawyer's advice is needed here too: in practice the line between anonymised data and biometrics is thinner than it seems.

It is also worth remembering that the requirements change, and liability for a breach lies with whoever processes the data, not with the equipment supplier. We covered the general principles of working with customer data in our piece on data protection.

Where the technology is used in practice

Counting and analysing footfall. Anonymised collection of data on how many people come in, at what time, how long they linger at the display. This is closer to web analytics than to advertising, and it is where the benefit is most obvious.

Assessing a location's effectiveness. Comparing those who walk past with those who come inside shows whether the entrance design and signage are working.

Reaction to content. Systems that analyse facial expressions in front of a screen or a display give feedback on which material attracts attention. This is a research task, close to what is covered in our article on biometrics in UX research.

Personal offers by consent. A scenario where the customer signs up to a programme with recognition themselves - for example, for fast payment or recognition in a membership system. Here consent is given knowingly, and that changes everything.

Security. Access control for staff-only areas. Formally not marketing, but this is most often how the technology enters a company.

What it gives advertising

Anonymised footfall data allows outdoor and in-store communications to be tuned more precisely: what to show in the morning, what in the evening, which message works for the predominant audience. This is not personalisation for a specific person but adjustment to a cross-section, and it works without legal complications.

The second effect is linking offline to online. Knowing how many people walked past and how many came in, you can assess the effect of an advertising campaign where previously there was only guesswork. For the general approach to assessing investment, see our article on ROI.

The third is saving budget by dropping formats that do not work. If the data shows the display does not hold attention, it is cheaper to redo it than to pile on more advertising.

Risks worth weighing up

Reputational. Recognising a customer without their knowledge is perceived as surveillance, even if everything is formally in order. A single social media post saying a shop is “spying on shoppers” costs more than any gain in conversion.

Legal. Fines for breaching the rules on processing biometric data are substantial, and it is you who will have to prove that consent was given.

Technical. Algorithms make mistakes, and the errors are unevenly distributed: accuracy drops in poor lighting, at low resolutions and for some groups of people. A decision made on the basis of a mistaken recognition affects a specific person.

Economic. Equipment, installation, licences and support cost money. For a single small location the costs often do not pay off even in theory.

How to approach it sensibly

First - formulate the task without mentioning the technology. “I want to understand why people walk past the entrance” is a task. “I want to install facial recognition” is not a task but a solution chosen before the task was set.

Second - choose the anonymised option if it solves the task. In most marketing scenarios you need statistics, not the identity of a specific visitor.

Third - if identification cannot be avoided, build the scenario on voluntary sign-up. A customer who has joined the programme themselves and signed a consent form gets a clear benefit and does not feel like the object of surveillance.

Fourth - agree everything with a lawyer before buying equipment, not after. How consent is documented, how data is stored and when it is deleted must be described in advance.

Fifth - talk about it openly. A clear explanation of exactly what is collected and why removes most of the mistrust.

Footfall data only makes sense when it influences decisions about campaigns. Reconciling it with advertising metrics and reworking the settings around the resulting picture is part of the advertising setup work.