Privacy threats in low-cost people counting devices

As evident from an in-depth analysis of the state of the art concerning device tracking through Wi-Fi probes and MAC addresses, these techniques represent an increasingly relevant privacy threat. In this paper we provide design and implementation details of a low-cost and low-power people counter based on the Espressif ESP8266 board, and we explicitly analyze the overall cost of the introduced solution. The proposed device can gather MAC addresses from Wi-Fi packets and is designed to circumvent MAC address randomization, as we demonstrate through practical experiments. Our study also shows that, as IoT devices and components are less and less expensive, even a single person could set up a personal people counting systems to be maliciously installed in urban areas or indoor environments.