I worked for a company doing this in 2015-2016. Bluetooth isn’t the primary mechanism because your phone doesn’t passively transmit its Bluetooth Mac under norm

I worked for a company doing this in 2015-2016. Bluetooth isn’t the primary mechanism because your phone doesn’t passively transmit its Bluetooth Mac under normal circumstances. It’s primarily Wi-Fi that’s used for that (and no, the Wi-Fi anonymization work done by Apple and others wasn’t enough to block this). We did use beacons too for stores that had a store app (and thus could be setup to receive the beacon probes), but Wi-Fi was the primary triangulation method. We also fused data from stereoscopic vision cameras too to get a more accurate count (since some folks disable Wi-Fi or don’t have phones on them). It’s a scary space, but that’s part of why I joined. The space needs more smart privacy focused engineers to make sure things are built respecting privacy (I rearchitected systems to where no one person could be tracked and only aggregate data existed). I’d love to be utopian and say nothing like this should exist, but the reality is if we don’t build it, someone will, and likely do it poorly.