.png)
In 2018, Cadillac Fairview was using facial-recognition-capable software embedded in mall directory kiosks across Canadian shopping centres, including Chinook Centre in Calgary, to estimate the age and gender of shoppers walking past. The Privacy Commissioner of Canada's investigation found the system had collected over 5 million biometric facial templates. Consent was buried in a five-thousand-word privacy policy. The signage near the kiosks referenced only "safety and security," not biometric analysis (Office of the Privacy Commissioner of Canada, PIPEDA Findings #2020-004, October 2020).
Cadillac Fairview stopped the program in 2018 and deleted the data before the finding was published. But the case remains the clearest, most concrete example of what happens when a shopping centre gets the line between useful analytics and a privacy violation wrong.
That line matters more now than it did in 2018, because the technology to do this well, and legally, has gotten significantly more capable.
Why the Old Way of Counting People Isn't Enough
Most Canadian shopping centres still measure foot traffic the way they did a decade ago: infrared beam counters or basic sensors at main entrances, producing a single daily total. That number tells you how many people walked in. It tells you nothing about where they went, how long they stayed, whether they were new or returning visitors, or which tenants actually captured their attention.
The blind spot is significant. A shopper can walk directly past a storefront without entering, and an entrance counter has no way to distinguish that from a shopper who stopped, browsed, and bought something two doors down. Zone-level detail, the kind that shows which corridors, tenants, and areas of a property actually hold shopper attention, requires a different category of technology entirely: computer vision, Wi-Fi analytics, or anonymized mobile location data layered across the property, not just at the doors.
That's a real capability gap. And it's exactly the kind of gap that pushes some operators toward more invasive tracking methods than they need, which is where the compliance risk starts.
The Legal Line: Anonymized Data vs. Biometric Identification
Here's the distinction that matters most for any Canadian property considering an upgrade to its foot traffic analytics.
The Cadillac Fairview investigation actually drew this line explicitly. The Privacy Commissioner found that CFCL's Wi-Fi-based geolocation tracking, using hashed MAC addresses to follow anonymized device movement through a property without identifying individual users, did not constitute "personal information" under PIPEDA. That part of the original complaint was found not well-founded. The facial recognition component, which extracted biometric characteristics tied to individual faces, was the part that violated the law.
That distinction is the whole ballgame. Anonymized, aggregated device or sensor data that can't be traced back to an individual sits outside PIPEDA's personal information trigger. Any system that captures, analyzes, or stores biometric identifiers, facial geometry, or unique physical characteristics faces a materially higher legal bar, and that bar just got higher in Quebec specifically.
Quebec Changed the Calculation
Quebec's Law 25 is the strictest privacy legislation in the country, and its first major enforcement decision under the law set a demanding standard. In September 2024, Quebec's access to information regulator, the CAI, ordered a company to cease using facial recognition for building access and destroy the collected data, applying a two-part necessity and proportionality test. Consent alone was not sufficient. The organization had to demonstrate the biometric approach was actually necessary for the stated purpose and proportionate to the privacy intrusion involved (CAI decision, reported by Osler, January 2025).
In February 2025, the CAI went further with a decision directly relevant to retail: it prohibited Metro Inc.'s pilot use of facial recognition for loss prevention because the grocery retailer could not obtain individuals' express consent for identity-verification-grade biometric use (CAI decision on Metro Inc., corroborated independently by Stikeman Elliott, Dentons, and DWW LLP, March-April 2025). Under Quebec's Privacy Act, penalties for non-compliance can reach up to $10 million or 2% of worldwide turnover, whichever is greater. Organizations must also declare any biometric database to the CAI at least 60 days before deployment (Osler, January 2025).
For a shopping centre operating properties in Quebec, or for a national operator building a single analytics approach across provinces, the Metro Inc. decision is the clearest signal available: facial recognition and biometric identification for retail analytics purposes is now a very high-risk category in Canada, regardless of the stated business purpose.
What This Means in Practice
None of this means real-time foot traffic analytics are off the table. It means the technology choice matters as much as the business case.
Anonymized mobile location data, the kind that tracks device movement through a property without identifying the person carrying the device, remains a legally sound foundation for zone-level traffic analysis, dwell time measurement, and trade area understanding. Environics Analytics, a Toronto-based data firm, offers foot traffic products built specifically around this anonymized, aggregated model, and it's the kind of Canadian-built approach that starts from a compliant foundation rather than retrofitting compliance onto a biometric system after the fact.
Computer vision systems that count and track movement without performing facial recognition or biometric extraction, essentially treating people as anonymous shapes moving through space rather than identifiable individuals, occupy similar legal ground to the Wi-Fi tracking the Cadillac Fairview finding permitted. The moment a system starts inferring age, gender, emotion, or identity from a face, it moves into the territory that got Cadillac Fairview investigated and that got Metro Inc.'s pilot shut down.
The Practical Starting Point
Before any property signs a contract for a foot traffic analytics upgrade, three questions need clear answers. Does the system identify or attempt to identify individuals in any way, including inferred demographic characteristics from facial analysis? Is the underlying data anonymized and aggregated in a way that can't be reversed to identify a specific shopper? And if there's a Quebec location involved, has the necessity and proportionality case been documented before deployment, not after a complaint is filed?
Properties that get this right at the outset get a genuinely useful upgrade: zone-level traffic patterns, dwell time by area, and trade area insight that a simple entrance counter can never provide. Properties that skip the compliance question get Cadillac Fairview's outcome: a shutdown program, a regulatory finding, and a rebuild of the trust it's supposed to be protecting.
The technology capability is real. So is the legal line. Knowing exactly where it sits before you deploy anything is the difference between the two outcomes.
Interested in what a privacy-compliant foot traffic analytics approach looks like for your property? BOOK A MEETING
