Whether in retail store windows, corporate lobbies, government information boards, or doctors’ office waiting rooms, digital displays (digital signage) have become an indispensable part of modern communication. They attract attention, can be flexibly controlled remotely, and replace outdated paper posters.
However, as soon as displays are set up in public or semi-public spaces, the European General Data Protection Regulation (GDPR) comes into focus. Anyone operating these screens must ensure that neither the creation of content nor the technical implementation violates personal data or privacy rights.
In this technical article, you’ll learn in a clear and concise manner which legal and technical requirements you must follow to reliably avoid warnings or GDPR fines.
1. Camera Tracking & Audience Analysis: The Biggest Privacy Pitfall
Some modern digital signage systems use built-in cameras or sensors to analyze passersby (e.g., age, gender, eye contact, or dwell time) in order to dynamically tailor advertisements.
- The Legal Situation: Faces and physical characteristics constitute personal or biometric data (Art. 4 & Art. 9 GDPR). If a camera records video streams or transmits facial profiles to servers, this is prohibited in public spaces without the prior explicit consent (opt-in) of all passersby.
- The solution: If you forgo cameras or use purely passive display systems without sensors, you are fully compliant with data protection regulations. If camera technology is used solely for counting people, the system must ensure that the data is anonymized on the device in real time (edge computing) and is never stored or transmitted.
2. Displayed Content: What Information Can Be Shown on the Screen?
Not only the hardware, but also the content itself can be subject to the GDPR. As soon as you display data on the screen that makes a natural person identifiable, data protection law applies.
- Welcome Screens & Personalized Greetings: If you greet visitors by name in the lobby (e.g., “Welcome, Ms. Müller”), this is usually based legally on your legitimate interest (Art. 6(1)(f) GDPR) or a verbal/written agreement. For VIPs or sensitive business meetings, it is advisable to briefly clarify in advance whether the name may be displayed.
- Employee Photos & Birthdays: Publishing photos or names of employees on internal or public screens always requires the written consent of the data subject.
- Waiting Rooms & Healthcare Facilities: In doctors’ offices or clinics, particularly strict rules apply to health data under Article 9 of the GDPR. Announcing patients’ names on screens raises data protection concerns. It is safer to use anonymous ticket or call numbers.
3. Cloud Software & Data Processing (Data Processing Agreement)
If you manage your content using modern cloud software, the software provider typically processes data on your behalf (e.g., log files, IP addresses of player devices, or uploaded media).
- Hosting Location: Make sure that the cloud servers are located within the EU or in Germany. With providers whose servers are in third countries (such as the U.S.), there is often uncertainty regarding compliance with data protection regulations.
- Data Processing Agreement (DPA under Article 28 of the GDPR): As the operator of the screen, you are legally required to enter into a DPA with your software provider. Reputable providers make this agreement readily available and free of charge in your customer account.
4. Technical and Organizational Measures (TOMs) & Kiosk Mode
Under the GDPR, you are required to implement technical and organizational measures (TOMs) to protect data from misuse or unauthorized access.
- Encrypted Data Transmission: Communication between the cloud control system and your displays must be encrypted (e.g., via HTTPS / SSL/TLS).
- Kiosk Mode & Access Protection: If touch displays are used in publicly accessible areas, access to the operating system must be restricted. Unauthorized users must not be able to open the web browser, load third-party content, or change system settings.
To ensure compliance with the GDPR, you need the right software. There are many different providers from various countries. The following section presents the most affordable option - directly from Germany.
5. SignageNow: 100% GDPR-compliant on every screen
With SignageNow, you’re choosing digital signage cloud software that was specifically developed in accordance with the strict requirements of the European General Data Protection Regulation (GDPR).
