Transport for New South Wales has defended the use of technology to track commuters’ devices, often without their knowledge, after privacy concerns were raised by local media.

The system, which uses Wi-Fi signals to collect data from devices such as mobile phones, is being trialled on a small number of Sydney light rail services for one year which began on 20 March 2024.

It collects a device’s MAC address — a unique 12-digit identifier — to detect the number of commuters on board seven of Sydney’s 76 trams.

The trial has been advertised using posters on some light rail services, which tell passengers “sensors are in use to monitor passenger capacity” but do not explain how the data is collected unless they scan a QR code “to learn more or opt out”, as first reported by ABC News.

The QR code takes passengers to a website about the trial which states the data is collected by Flowly, a start-up based on a small French island off the coast of Africa called La Réunion, on behalf of the private light rail operator Transdev.

While the website confirms passengers’ names, browsing history, and contacts are not collected, it also states that a device’s MAC address “may, if collated with other information about that person, be capable of identifying an individual”.

In a statement to Information Age, Flowly argued it was not possible to identify an individual if their MAC address was cross-referenced with other related information.

“As soon as collected, MAC addresses are encrypted and then completely anonymised after three hours,” the company said.

“As the MAC address is totally anonymised with the Flowly process, no personal data is stored or shared with Flowly neither the operator.”

A Transport for NSW spokesperson told Information Age that Flowly complied with the state’s privacy regulations and its technology was “also actively used around the globe on about 50 transport networks”. 

Passengers automatically opted in

Under Flowly’s system, data about a commuter’s presence on a light rail service is automatically captured if their Wi-Fi is switched on, automatically opting them into data collection.

To avoid this, passengers need to make sure their Wi-Fi is turned off before boarding.

To opt out if their device's unique identifier has already been captured, passengers have been asked to input their MAC address on the trial’s website, so it can be deleted from the system.


The trial on some Sydney light rail services uses hidden sensors from French start-up Flowly. Photo: Shutterstock

Transdev told Information Age that the trial was established as an opt-out system “to enable the large volume of travel flows needed to give a comprehensive view of a network’s performance”.

It also said the trial complied with NSW privacy laws.

"Because MAC addresses are anonymised and no other data is collected, the only data that is saved are the graphs produced from the collated statistical and aggregated data,” a spokesperson said.

“… Flowly's data protection policies mean that Flowly will not hold information for longer than is needed and for the purpose of this trial only.

“Any data collected is stored at a secure data centre in NSW.”

Flowly said the technology used in the trial, which involved sensors hidden inside vehicles, was "compliant with the European General Data Protection Regulation (GDPR) which is one of the most stringent in terms of data privacy and protection”.

“In Sydney we have also conducted a Privacy Impact Assessment and received advice from local lawyers to make sure the solution is compliant with local requirements,” the company said.

Transdev reportedly told ABC News that the Flowly trial was publicised on the Transport for NSW website before it began.

However, Information Age could not find any reference to the trial on the Transport for NSW website, and the department did not respond to a question about whether it had announced the trial there.

Transport for NSW said it calculated passenger numbers and travel times on other modes of transport such as buses, trains, and the metro using tap-on and tap-off data from its Opal system.