AI Cameras for Shops and Restaurants: Uses and Privacy Rules

AI cameras in shops and restaurants count footfall by hour, alert staff when a queue builds, spot empty shelves and time drive-thru waits. Run on a small local box, the model can keep only the counts and delete each frame, which makes the privacy case much simpler. Facial recognition is a different product with heavy legal risk: Illinois allows $1,000 to $5,000 per violation, and the EU bans some uses outright.

This guide is part of the edge AI series. The hardware is covered in local AI hardware.

What can AI cameras do for a shop or restaurant?

Restaurants have the clearest published example. Restaurant Dive reported in January 2025 that Portillo's was testing computer vision in its drive-thrus and had shaved 15 seconds from its average drive-thru time. The screen flashes red if a car sits for four minutes without service.

The best-known queue system is older and uses infrared rather than AI cameras: Kroger said its QueVision cut the average checkout wait from four minutes to under 30 seconds across more than 2,400 stores. It shows what queue data is worth to a retailer, which is the case you make to a small shop.

We could not find independent figures on what footfall counting earns a small shop. Vendor numbers exist, but none we could check. Sell it as information the owner does not have today, such as the hour when walk-ins peak against the hour staff take breaks.

Why run the camera AI on a local box?

Three reasons the owner will care about:

1. The video stays in the shop. The box counts and discards. Nothing leaves the premises except the numbers, if those.
2. No cloud subscription to keep paying. A local box is bought once, with your retainer on top, and keeps running if a cloud vendor changes its prices.
3. It keeps working when the internet drops. Queue alerts still go to the staff tablet on the shop network.

The first point is also the strongest privacy argument. Data you never store cannot leak, be requested by a customer or be kept too long.

What are the camera privacy rules?

This is general information, not legal advice. The owner is responsible for compliance, and you should tell them so in writing.

United Kingdom. The ICO's checklist for small organisations says "You need to put up signs to let people know you're filming them", and that a DPIA (data protection impact assessment) is needed if the use is likely to be high risk, such as cameras in private areas or monitoring staff. Its detailed guidance calls a DPIA "a legal requirement and applies in most cases" for surveillance systems, and does not set a fixed retention period. Most small businesses also pay the ICO data protection fee, £52 or £78 a year.

European Union. GDPR Article 35 requires a DPIA for "systematic monitoring of a publicly accessible area on a large scale". The EDPB's video guidelines say signs should sit "approximately at eye level" before people enter the area, naming the purpose and the operator, and that footage should be erased "ideally automatically, after a few days", with more justification needed beyond 72 hours.

The EU AI Act has banned some uses since 2 February 2025, including untargeted scraping of CCTV footage to build facial recognition databases, emotion recognition in workplaces and biometric categorisation to infer protected characteristics. Fines for banned practices reach EUR 35 million or 7% of worldwide turnover, with the lower of the two applying to SMEs.

United States. No single federal camera law applies, but biometric laws do. Illinois's Biometric Information Privacy Act allows "liquidated damages of $1,000 or actual damages, whichever is greater" for a negligent violation and $5,000 for an intentional or reckless one. A 2024 amendment limits repeat scans of the same person by the same method to one violation, but it is still the law that makes face recognition expensive.

Singapore. The PDPC's advisory guidelines.pdf) say notices should be placed so people have sufficient awareness that CCTV is in use, and that the PDPA does not prescribe their content. Footage in public areas can rely on the publicly available exception, though informing people is good practice.

Malaysia. The 2024 amendment, Act A1727, added biometric data to the definition of sensitive personal data and raised the maximum fine to RM1 million. We could not find specific CCTV guidance from Malaysia's data protection commissioner.

How do you design a privacy-first camera install?

1. Count, do not identify. Use person detection, not face recognition. Keep totals, not images.
2. Delete frames on the box. Process in memory and write only counts to disk. Say this in the proposal.
3. Mask what you do not need. Black out the till screen, the staff room door and the street outside the window in the camera's view.
4. Put the sign up before the install. Use the regulator's wording for the country, with the shop's name and contact.
5. Write a one-page record. What the system does, what it stores, for how long and who can see it. In the UK and EU this is the start of a DPIA. Even where none is required, it is the document a client shows an inspector or a worried customer.
6. No face recognition without a lawyer. If a client asks for it, refer them to a lawyer before you quote. It is not a side-hustle product.

How do you sell it to a shop owner?

Lead with the problem the owner already feels: queues at lunch, a slow drive-thru, shelves empty on Saturday. Offer two weeks of counts on a demo box in the window, then show the numbers next to their sales by hour.

Keep the price simple: hardware at cost plus a modest margin, a setup fee, and a small monthly retainer for updates and a weekly report. A single-shop counter is a small ticket. The money is in a café chain or a franchise group that wants the same thing in ten sites. Pricing is covered in how to price local AI installs, and finding those owners in finding your first local AI clients.