AI video analytics in hotels: people counting, plate reading, face recognition and what KVKK says

AI video analytics is software that reads camera footage and turns it into events: counts, queue alerts, plate reads or face matches. Each feature creates different data. Anonymous counts stay low-risk; plates are personal data; face matching is biometric data under KVKK and needs one of the strict conditions in Article 6.

A supplier offers your hotel a box that counts people, reads plates and recognizes a returning guest. The cameras are the same ones you already have. What the system now produces is not. After reading this you will be able to sort each feature in the offer by the data it creates, know which ones move into biometric territory under Law No. 6698, and walk into the supplier and adviser meetings with a written question list.

What does AI video analytics add to an ordinary camera system?#

It adds a layer that interprets footage instead of only storing it, so the output becomes an event or a number rather than a file someone has to watch.

Ordinary closed-circuit television (CCTV) has three parts: camera, recorder, retention. Its only output is video that a person reviews after something has happened. Analytics classifies what the camera sees: person or vehicle, a line crossed, dwell time in a zone, queue length, loitering, a fall, smoke or flame, plate characters, a face template.

Detection is not identification. A system can count people without knowing who any of them are, and the same camera can be sold to you in either mode. Where the analysis runs decides where the data goes: on the camera, on the recorder, on a local server, or in a supplier's cloud. A cloud feature is a transfer of footage off the property, and it belongs in your processing inventory.

Every feature has a false-positive rate. An alert that fires wrongly at night teaches staff to ignore alerts, so the written response procedure matters more than the detection claim on the brochure. Analytics also changes the purpose of the processing: the sign at the door, the retention table and the internal register must change with the installation, not after it.

Which features create which data?#

Sort the offer by the data each feature produces, because that decides the legal question, not the feature name.

A count per zone per hour, with no image kept, is a number about a space. It carries the least obligation, provided the setting really discards the images. A clip attached to an event is footage of identifiable people, so the retention and access rules you already have for CCTV apply to it. A plate string plus a timestamp links to a vehicle and often to its registered owner, which makes it personal data even when no face is captured.

A face template compared against a gallery is biometric data, a special category under Law No. 6698, treated separately below. Fall, smoke and flame alerts capture people, but their purpose is safety, so they are judged against the safety duty they support, not against marketing value. Audio is its own decision: KVKK's announcement of 8 June 2026 (opens in a new tab) says cameras that record audio should not be used unless their lawful reason and necessity are clearly shown.

When does face recognition become biometric data under KVKK?#

When the processing extracts distinctive characteristics from a face and those characteristics identify the person or verify their identity. A stored image plus a matching engine is biometric processing, not ordinary CCTV.

Law No. 6698 Article 6 lists biometric data among the special categories but does not define it. KVKK's guide (Publications No. 55, March 2025) (opens in a new tab) points to the GDPR Article 4 definition as the most comprehensive one available. Its physiological examples are fingerprint, retina, palm, face, hand shape and iris; behavioural examples are gait, keystroke pattern and driving style.

Processing needs one of the conditions in Article 6(3): explicit consent, an express provision in law, protecting life or bodily integrity, data the person has made public, establishing or protecting a right, health purposes, employment and occupational health and safety duties, or certain non-profit bodies for their members. The general principles in Article 4 apply on top.

Necessity is the hard test. The guide says that if an alternative exists, processing biometric data is not necessary and not proportionate, and the controller must state clearly why it processes the data and prove that it has to. A template is not an escape: in its public notice of 27 August 2026 on the scope of the attendance decision, the Authority said that converting fingerprint or palm data into a mathematical code for storage does not stop it being biometric data.

The guide's security duties include cryptographic protection when biometric data sits in cloud systems, templates that cannot reconstruct the original characteristic, testing with synthetic data, and an alternative offered without restriction or extra cost to people who cannot use the system or do not consent. Guest-facing uses such as recognizing a returning guest or matching against a blacklist sit outside the attendance decision. The controller must assess lawfulness itself, and the Board examines complaints case by case.

What does the Board's 2026 biometric decision mean for a hotel?#

It is about staff attendance, not guests, and it tells hotels not to use face or fingerprint clocks: the Board found no legal provision for biometric attendance tracking, doubted that consent is freely given, and held that less intrusive alternatives exist.

The instrument is Principle Decision No. 2026/921 of 29 April 2026, made under Article 15(6) of Law No. 6698 and published in the Official Gazette of 2 June 2026, No. 33268 (opens in a new tab). The reasoning runs in three steps. The law requires employers to track working time but never says to do it with biometrics, so the "expressly provided for by law" condition fails. The other conditions in Article 6(3)(b) to (g) do not apply. And because of the power imbalance between employer and employee, explicit consent is doubtful and not sufficient on its own.

Proportionality then fails as well, because less intrusive alternatives exist. The decision names encrypted card or PIN systems, traditional signatures and paper attendance sheets, RFID or NFC identity cards, and manual entry under a supervisor.

The Authority's public notice of 27 August 2026 limits the scope to attendance tracking. It adds that in facilities with a high security risk, biometric identity verification and access control to critical areas can serve a security purpose, if the processing is limited to the critical areas and the people who need it, used only where alternatives are insufficient, and proportionate to the concrete need. For a hotel, that points at a cash office, a key store or a server room, not the staff entrance and not the locker room. If key control is the real concern, start with the key log, not the camera: see our guide to key control in hotels: master keys, store keys and the key log.

Do not extend the decision to guests by assertion. The notice says other purposes fall outside it and are assessed case by case, which leaves the analysis in the previous section standing.

What must the notice, the retention period and the access rules say?#

Recording people on camera is personal data processing and needs a legal basis under Law No. 6698. KVKK's public announcement of 8 June 2026 on security cameras in workplaces sets out what a controller should do about purpose, placement, notice, retention and access.

Fix the purpose before the camera goes up: workplace security, preventing and detecting crime, or occupational health and safety. Cameras must not be used to track employees' attendance or performance. Placement follows data minimisation: common areas such as entrances, exits and storerooms, or risk points such as the cash desk, may be proportionate given their position and field of view. Toilets, changing rooms, prayer rooms (mescit) and rest areas are out. So are wide-angle recording of the whole workplace and face-focused recording.

In areas open to the public, weigh the effect on people who are not under supervision, especially people who need special protection such as children. Employees must be informed, and the duty to inform under Article 10 is met by giving notice that the area is recorded. The notice should name the purpose and a contact, and it must cover the analytics, not only the camera.

Access to footage is limited to authorised people through an authorisation matrix, backed by technical and administrative measures. Footage is kept for the shortest possible time with an automatic deletion mechanism, and after an incident only the relevant recording is kept for the legal proceedings. A new analytics feature is a new purpose: it needs a line in the notice, a line in the retention and destruction table, and a line in your register of AI uses. For the wider framework, see our articles on CCTV in hotels under KVKK, KVKK for hotels and building a retention table.

Do alerts replace a lifeguard, a guard or a fire duty?#

No. An alert is a signal that asks a person to look, decide and act. The duty of supervision stays with the trained person, and a system that fires without a response procedure adds risk rather than removing it.

Detection is probabilistic. A fall detector can miss a person lying still, a camera that spots smoke is not a fire detection system, and a pool camera does not watch water the way a lifeguard does. At the pool, an alert routed to a phone at reception is not supervision. Keep the lifeguard duty where your operating rules and your insurer put it, and treat the camera as an extra pair of eyes only.

Smoke and flame detection on a camera is supplementary to the building's fire detection and alarm system and to the evacuation plan. It does not replace that system or its maintenance and testing regime. For security, an alert needs a named receiver, a response time, an escalation path and a log. Write it down and test it, including at three in the morning.

Fall detection inside bathrooms and changing rooms conflicts with the private-area rule. Solve those rooms with staff rounds and call buttons, not cameras. Finally, measure the response, not the detection: count alerts received, alerts acted on and alerts found to be false, and review the list every month with the security manager.

What should you ask the supplier, and then your adviser?#

Ask the supplier what data each feature creates and where it goes, then ask your adviser whether you have a legal basis for it. The two conversations are different and neither replaces the other.

To the supplier: which features are on by default, and can each be switched off per camera? What exactly is stored, a count, an event, a clip, a plate string or a face template, and is it processed on the device, on your recorder, on your server or in the supplier's cloud? What is the default retention, can you shorten it, and is deletion automatic? Does the system record audio, and can that be disabled permanently? Can a face template be turned back into the original image, how is it protected, and what documentation can the supplier give you for your processing inventory and retention table?

To the adviser: what is the legal basis for each feature in writing, is the notice at the door adequate for the analytics, and what retention period goes into the policy? Is the supplier a data processor under your contract, what obligations does that carry, and do you need a written assessment before go-live? Both conversations should end with the feature placed in your register of AI uses, in the form described in an AI register for hotels, with an owner and a risk tier, so that someone can find it when a guest asks.

What to do next#

Take your camera list and write, for each camera and each feature switched on, one sentence naming the purpose and the data it produces. Anything you cannot justify in that sentence gets switched off or moved before the next guest arrives, and the list becomes the agenda for your adviser and your supplier.