How Our AI Counts Every Impression (Without Capturing Faces)

Advertising measurement has always involved a tradeoff. More data means better measurement. But more data also means more privacy risk. The online advertising industry learned this the hard way — years of invasive tracking led to GDPR, CCPA, the death of third-party cookies, and a global backlash against surveillance advertising.

Out-of-home advertising is at a crossroads. As DOOH screens add cameras for audience measurement, the same privacy questions arise. How do you count impressions without tracking individuals? How do you measure demographics without storing faces? How do you optimize campaigns without building profiles?

We believe we have found the answer. And it starts with a simple architectural decision: process everything on the edge, store nothing identifiable, transmit only aggregates.

The Privacy Problem in OOH Measurement

Traditional OOH measurement relied on traffic counts — cars per day, pedestrians per hour. No privacy issues, but also no precision. You knew how many people could have seen your ad, not how many actually did.

Modern DOOH measurement has improved precision through two approaches, both of which raise privacy concerns:

Mobile location data: Companies collect location signals from apps on people's phones (often without clear consent), aggregate them, and match them against DOOH screen locations. This tells you how many phones were near a screen. The problem: even "anonymized" location data can be re-identified. Research from MIT and other institutions has shown that just four location points are enough to uniquely identify 95% of individuals. The legal landscape is tightening — multiple lawsuits have targeted location data brokers, and the FTC has taken enforcement actions.

Cloud-based computer vision: Some DOOH systems capture video or images, send them to cloud servers for processing, and then (supposedly) delete them. The problem: raw images of people in public spaces are being captured, transmitted over networks, and processed on remote servers. Even if deletion is prompt, the data is vulnerable during transit and processing. And "prompt deletion" is a policy decision, not an architectural guarantee.

Our Approach: Edge Processing, Zero Storage

AdLuxy takes a fundamentally different approach. We call it "privacy by architecture" — not privacy by policy. The difference matters. A privacy policy says "we promise to delete your data." Privacy by architecture means the system is physically incapable of retaining identifiable data.

Here is how it works, step by step:

Step 1: Image Capture (Transient)

A wide-angle camera on the backpack captures frames at 15 fps. These frames exist only in the processor's volatile memory (RAM). They are never written to persistent storage — not to an SD card, not to flash memory, not to any disk. If you pulled the battery from the backpack, the images would vanish instantly because they were never stored anywhere permanent.

Step 2: On-Device AI Processing

Each frame is processed by six neural network models running on the NVIDIA Jetson Orin Nano — a powerful edge AI processor mounted inside the backpack. The models run in under 67 milliseconds per frame:

Person detection model: Identifies bounding boxes around people in the frame. This model outputs coordinates and confidence scores, not images. A person at position [x: 340, y: 120, w: 80, h: 200, confidence: 0.94] — that is all the model produces.

Pose estimation model: Determines body orientation — is the person facing the screen or walking away? This is critical for distinguishing between a "passerby" and an "impression." Output: a set of keypoint coordinates. Not an image.

Demographic estimation model: Estimates age range (buckets: 13-17, 18-24, 25-34, 35-44, 45-54, 55+) and gender. This runs on the detected bounding box region, not on a face. The model uses full-body cues — clothing patterns, body proportions, gait — supplemented by facial region analysis when available. Output: a categorical label and confidence score.

Attention model: Estimates whether detected individuals are looking toward the screen and for how long. Uses head pose estimation and gaze direction. Output: attention duration in milliseconds.

Crowd density model: Estimates total crowd size and flow direction in the broader scene. Used for route optimization. Output: density estimate (people per square meter) and flow vector.

Distance estimation model: Estimates the distance of detected individuals from the screen. Used to calculate effective viewing range. Output: distance in meters.

Step 3: Frame Disposal

After the models process a frame, the frame is immediately overwritten by the next incoming frame in the RAM buffer. The raw image exists for approximately 67 milliseconds — less time than a human blink. At no point is any image written to persistent storage, transmitted to any network, or retained in any form.

Step 4: Aggregate Data Transmission

The only data that leaves the backpack is aggregate statistics, transmitted every 60 seconds via LTE to our cloud platform:

Notice what is absent: no images. No device IDs. No MAC addresses. No facial encodings. No individual-level data of any kind. Just aggregate counts, averages, and distributions. This data is mathematically irreversible — you cannot reconstruct any individual's identity or appearance from these numbers.

Why Edge Processing Matters

The decision to process on the edge (on-device) rather than in the cloud is not just a privacy choice — it is an architectural requirement for privacy. Here is why:

No data in transit. Raw images never leave the device. There is no network transmission to intercept, no server to breach, no CDN to compromise. The attack surface for image data is zero because the data never exists outside the device.

No data at rest. Images are never stored on any persistent medium. Even if the physical device were stolen, there would be no stored images to recover — because none were ever stored.

Lower latency. On-device processing delivers results in 67ms per frame. Cloud processing would add 100-500ms of network latency, making real-time creative optimization impossible for a moving platform.

GDPR and Global Compliance

Our architecture was designed with GDPR compliance as a primary constraint, not an afterthought. Here is how we address key GDPR requirements:

Data minimization (Article 5.1c): We collect only the data necessary for our stated purpose (impression counting and campaign optimization). No images, no personal data, no device identifiers.

Purpose limitation (Article 5.1b): Data is collected solely for advertising measurement and is never repurposed for other uses.

Storage limitation (Article 5.1e): Raw data (images) are not stored at all. Aggregate data is retained for 90 days for campaign reporting, then deleted.

Data protection by design (Article 25): Privacy is embedded in the system architecture, not bolted on through policies. The system is physically incapable of storing personal data.

This approach also satisfies requirements under CCPA (California), LGPD (Brazil), POPIA (South Africa), and PDPA (Singapore/Thailand). Because we do not collect personal data at all, most consent requirements do not apply — there is no personal data to consent to collecting.

Accuracy Without Faces

A common question: can you count impressions and estimate demographics without facial recognition? Yes. Here is how:

Our person detection model uses full-body detection, not facial recognition. It identifies people by body shape, clothing boundaries, and motion patterns — the same cues a human uses to detect people in a crowd from a distance. In our validation studies (conducted with consented participants in controlled environments), the model achieved 96.2% accuracy for person detection and 87% accuracy for demographic estimation.

These numbers compare favorably to cloud-based facial recognition systems (which typically achieve 97-99% for detection and 90-95% for demographics) while offering dramatically better privacy properties. The 2-3% accuracy gap is a worthwhile tradeoff for zero privacy risk.

For more on the AI technology behind our platform, read how LED backpack billboards work and our roundup of AI advertising examples.

The Industry Should Adopt This Standard

We believe edge-processed, aggregate-only measurement should be the standard for all DOOH audience measurement — not just walking billboards. The technology is ready. The accuracy is sufficient. And the regulatory trajectory makes cloud-based image processing increasingly risky.

The DOOH industry has an opportunity to get ahead of privacy regulation rather than being dragged into compliance like online advertising was. Edge processing with aggregate-only outputs is the way.