Effective 13 September 2026
Computer Vision Privacy Disclosure
Change note (v2.1, 3 September 2026): every reference to emotion, mood or emotional response has been removed. The computer-vision system does not estimate emotion; the legal wording now describes only what the system actually does (face detection, age-range and gender buckets, dwell and gaze time, aggregate impression counts). No other change.
Change note (v3.0, 13 September 2026): the previous version of this disclosure said only aggregate, minute-level, suburb-level data ever left the device and that "individual records are never transmitted." That was not an accurate description of what our systems do. This version describes the per-advertisement record that is actually transmitted (clause 3), while everything about the on-device processing itself — no image, video, or biometric template is ever generated or transmitted — remains true and is the most important privacy protection this system has. It also corrects the passenger opt-out (a control on the Tablet itself — there is none in the Rider App), adds the Tablet's emergency button (clause 4.3), and marks the one retention target not yet enforced automatically. See the Privacy Policy clause 2.4 for the platform-wide summary.
11 — Computer Vision Privacy Disclosure
Effective Date: 13 September 2026 Controller: OOHAi Media Pty Ltd as trustee for the OOHAi Media Unit Trust ("OOHAi Media", "we", "us", "our"). Joint controller (vehicle-mounted equipment): OZ Ride Pty Ltd (ABN 52 694 735 487) for the limited purpose of operating the Player Tablet inside a Vehicle that is connected to a Trip. Governing law: Western Australia, Australia. Defined terms: Capitalised terms not defined in this document have the meaning given in 00 — Definitions.
This Computer Vision Privacy Disclosure explains how the computer vision technology inside OOHAi advertising equipment operates, what data is and is not collected, what leaves the device and where it goes, and how we protect the privacy of pedestrians, passengers, and the general public who come into the field of view of that equipment.
This disclosure applies to the computer vision sensors deployed on:
- Player Tablets (passenger-facing in-car displays mounted in Driver Vehicles).
- Car Toppers (roof-mounted digital displays), where deployed.
It does not cover any data we collect from Riders who book Trips on the OZ Ride platform — that is governed by the Privacy Policy. It also does not cover the separate driver identity-verification process, which performs true one-to-one biometric facial matching using AWS Rekognition and is governed by the Biometric / Facial Verification Notice. The two systems are architecturally unrelated: the cameras described in this document never identify anyone and never retain an image; the driver-verification process is a genuine biometric match against a specific named person's licence photo, with its own consent flow.
1. Privacy-first by design
Visual data captured by the computer vision sensor is processed entirely on the device and discarded immediately after processing. No video, no photographs, and no biometric template ever leaves the device. What does leave the device is described plainly in clause 3 below — please read that clause; do not assume "privacy-first on-device processing" means nothing is transmitted at all.
2. Technology overview
2.1 What the sensors do
The computer vision sensor detects whether a face is present in the device's field of view, performs face detection and classification (not facial recognition — it does not compare any face against a reference photo or database, and it does not derive an identifier that could later be matched back to the same person). Demographic estimates (age range, gender, attention duration) are inferred locally for advertising-effectiveness measurement.
The sensors do not identify any specific individual, and do not track the same individual across separate sightings, locations, or Trips.
2.2 How it works, step by step
- Capture. The camera produces a video frame in device memory.
- Local inference. An on-device machine-learning pipeline — Google ML Kit for face detection, together with on-device classifier models for age and gender, orchestrated by
oz-player/src/domain/cv/cvEngine.tsand the nativeFaceAnalysisModule.kton Android — detects faces and infers demographic estimates from the frame. - Discard. The frame (and any cropped face region used during inference) is recycled/overwritten in device memory immediately after inference. Nothing is written to persistent storage on the device.
- Build the scene record. For the advertisement currently playing, the device builds one record describing the scene it just measured: an estimated viewer count, the dominant age band and gender observed, attention/dwell/gaze metrics, and whether more than one person was detected (a group flag and estimated group size).
- Transmit. That per-ad-play scene record — together with the device's precise location and a timestamp — is sent off-device to OOHAi Media's servers, batched with other recent records and compressed. This is a real, individually-transmitted record for each ad play, not a rolled-up hourly or suburb-level count (see clause 3).
3. What leaves the device, in plain terms
Each time an advertisement plays on a Player Tablet or Car Topper, one scene-level record is sent to OOHAi Media's servers. That record contains:
- The device's precise GPS location at the time of the play (not a rounded suburb-level location);
- A timestamp accurate to the second (not just the hour);
- An estimated number of viewers detected during the play;
- The dominant age band and gender observed across those viewers, and separate attention, dwell-time, and gaze-time metrics;
- Whether the detection was of a group and, if so, an estimated group size;
- A session identifier for the device and the ad-play.
What that record does not contain, ever: an image, a video frame, a facial template, a biometric identifier, or anything that names or otherwise identifies a specific person. The record describes the scene — how many people, roughly what demographic mix, how engaged — not any individual in it.
We hold these scene-level records on our own servers. We do not give advertisers this level of detail. What an Advertiser sees through the Advertiser Portal is a further-aggregated, k-anonymised report that strips out precise location and any field that is small enough in sample size to risk re-identifying a viewer — see clause 9.1. That advertiser-facing aggregation is enforced independently of this document, in code, and is checked by automated tests before every release.
A representative advertiser-facing report would read: "Your campaign received 5,000 impressions in Perth CBD between 8:00 and 10:00 on weekdays, with 60% of viewers in the 25–34 age range and an average attention duration of 3.2 seconds." That is genuinely all an Advertiser can see. What is different from the previous version of this disclosure is that OOHAi Media's own servers, before that aggregation happens, hold the more granular per-play record described above.
4. Your choices
4.1 Passenger opt-out
If you are a passenger and would prefer the Player Tablet in your Vehicle not run audience-measurement processing during your Trip, use a control on the Tablet itself, which stops audience measurement for the rest of your Trip. Using it stops the on-device audience-measurement pipeline (clause 2) from running for the remainder of your Trip; it does not affect your ability to complete the Trip. There is no equivalent control in the Rider App.
4.2 In-vehicle notice
A QR code and printed notice are displayed inside each Vehicle that hosts a Player Tablet, linking to this disclosure (clause 7.3 below).
4.3 Emergency button on the Tablet
The Player Tablet also carries an emergency button: pressing it alerts OZ Ride's safety team and, by design, does not alert the Driver. It does not place a call to emergency services — in an emergency, call 000 yourself as well.
5. What data is NOT collected — ever
The following is never collected, stored, or transmitted from the equipment, at any point:
- No video footage. Frames are processed in memory and overwritten before the next frame.
- No photographs or screenshots.
- No raw visual data is ever uploaded to OOHAi servers, Cloudflare R2, AWS S3, or any third party.
- No facial recognition, facial template, or biometric identification of any individual.
- No name, account, or other identifier tying a detection to a specific person.
- No tracking of an individual across time, location, or multiple sightings — each detection is independent and is not linked to any prior or later detection.
6. Data flow architecture
Camera frame ─▶ On-device CV pipeline (ML Kit + on-device classifiers) ─▶ Scene record built
(viewer count, age/gender/
attention,
group flag)
Frame overwritten in memory ◀─────────────────────────────────────────────────┘
│
(per ad play) ▼
Scene record + precise location + timestamp ─▶ TLS ─▶ OOHAi advertising backend
(held at per-impression detail)
│
(aggregation + k-anonymisation,
enforced in code and CI)
▼
Advertiser Portal — aggregate,
de-identified reports only
No step in this pipeline persists a frame, an image, or a biometric template. The per-play scene record described in clause 3 is held by OOHAi Media; only the further-aggregated output at the bottom of this diagram reaches an Advertiser.
7. Regulatory compliance
7.1 Australian Privacy Principles (APPs)
- APP 1 (Open and Transparent Management). This disclosure describes the data practices of the computer vision system, including what we transmit and hold off-device.
- APP 3 (Collection). No image, video, or biometric identifier is ever collected off the device. The scene-level records described in clause 3 are collected as part of our advertising-measurement function.
- APP 5 (Notification). This disclosure informs the public about the technology and is signposted by a QR code or notice inside each Vehicle that hosts a Player Tablet.
- APP 6 (Use and Disclosure). Scene-level records are used only for advertising-effectiveness measurement and billing. Advertiser-facing outputs are aggregated and k-anonymised before disclosure and never include precise location, device, or vehicle identifiers (enforced in code —
oz-advertising-service/src/lib/advertiserLocationPrivacy.ts). - APP 11 (Security). On-device processing means no image or biometric data ever exists anywhere for a breach to expose. The scene-level records we do hold are transmitted over TLS and stored behind our standard access controls (see the Privacy Policy, clause 10).
7.2 Whether this is "Personal Information" or "Sensitive Information"
We do not treat the on-device processing itself as collecting Personal Information about anyone, because no image, video, or biometric identifier is ever collected off the device (clause 5), and no detection is ever linked to a name, account, or other identifier, or to any other detection of the same person.
We take a more cautious position on the scene-level records described in clause 3, which we do hold. Those records combine a precise location and a second-accurate timestamp with an aggregate description of who was observed at that moment. Where the number of people detected is small — for example, a single passenger travelling alone — a record showing "one viewer, in this age/gender band, at this exact place and second" starts to describe a specific occasion involving a specific (if unnamed) person, even though nothing in the record identifies who that person is. We do not consider that this, by itself, allows us to identify a specific individual, and we have designed the on-device pipeline (no persistence, no template, no cross-sighting) with the goal that it never could. But consistent with the Office of the Australian Information Commissioner's 2021 determination concerning 7-Eleven Stores — which held that even transient, aggregated facial-analysis processing can amount to "collection" of Personal (and in that case Sensitive) Information for the purposes of the Act — we do not claim these scene-level records definitively fall outside the Act, and we handle them under our normal Personal Information safeguards (Privacy Policy clause 10) rather than treating them as exempt.
7.3 Notice in the Vehicle
A QR code and printed notice are displayed inside each Vehicle that hosts a Player Tablet, linking to this disclosure. By using OZ Ride or OOHAi services, or being in view of OOHAi advertising equipment after reviewing this disclosure, you acknowledge the collection described in this document.
7.4 Western Australia — in-vehicle recording rules
The Transport (Road Passenger Services) Regulations 2020 (WA) separately regulate an on-demand vehicle's dedicated closed-circuit security recording unit ("CSU"), where one is fitted, including signage and access-control duties for that system. The Player Tablet's audience-measurement camera described in this document is a different system: it does not record, and there is no footage or image at any point for those CSU rules to apply to in the way they apply to an actual recording device. Whether, and to what extent, the Surveillance Devices Act 1998 (WA) reaches a camera that performs only transient on-device processing and never records is not a question we treat as settled; we provide the in-vehicle notice described in clause 7.3 regardless.
8. Retention
| Data type | Retention |
|---|---|
| Visual data (raw frames) | Zero — discarded/overwritten in device memory immediately after on-device inference. Never written to persistent storage on the device or transmitted. |
| Per-ad-play scene-level records (clause 3) held by OOHAi Media | Target: 25 months for advertising billing reconciliation, then further aggregation into indefinite, fully de-identified campaign analytics. Current practice: no automated purge is in place for these records (not yet enforced automatically — the same gap is stated in clause 8 of the Privacy Policy) |
| Fully aggregated campaign analytics | Retained indefinitely (no location, timestamp, or individual-occasion detail) |
| Equipment status / diagnostic logs | 12 months |
Because no image, video, or biometric template is ever held, the right of access (APP 12) and right of correction (APP 13) do not apply to raw visual data — there is none. They do apply, in the ordinary way, to the scene-level records described in clause 3 and to any operational record that may incidentally include your Driver's Vehicle identifier — those requests are handled under the Privacy Policy.
9. Third-party access
9.1 Advertisers
Advertisers receive only aggregate, k-anonymised, de-identified impression reports through the Advertiser Portal. An Advertiser never has access to raw sensor data, video, images, biometric templates, the precise location or timestamp of an individual ad play, or any information that could identify an individual. This aggregation is enforced in code and checked by automated tests before every release.
9.2 Drivers
Driver Partners do not have access to computer vision data, settings, or outputs through the Driver App or any other interface. The sensor configuration is managed centrally by OOHAi Media operations.
9.3 Law enforcement
No video, photograph, or biometric template can ever be provided to law enforcement, a regulator, or any other party, because none is ever generated or stored at any point — the on-device camera output does not persist beyond the immediate inference step described in clause 2.
OOHAi Media does hold the non-video, scene-level records described in clause 3, including the precise location and time of each ad play. Where compelled by valid legal process, OOHAi Media may be required to produce those records; we would treat such a request under our ordinary process for responding to third-party legal requests for data we hold.
10. Frequently asked questions
Can OOHAi identify me from my face? No. The system performs face detection and classification, not facial recognition. No biometric template is generated or retained, and no detection is linked to any name or account.
Are photographs being taken without my consent? No. No images are captured. Frames are processed in memory and overwritten before the next frame is read.
Is my data being sent to the cloud? No visual data — no image, video, or biometric template — is ever sent anywhere; that stays on the device and is overwritten immediately. What is sent to OOHAi Media's servers, for each ad play, is a scene-level record: the device's precise location and the time of the play, plus non-identifying aggregate estimates of who was in view (an estimated headcount and the group's age/gender/attention profile). See clause 3. Advertisers themselves only ever see the further-aggregated reports described in clause 9.1.
Can advertisers see who viewed their ads? No. Advertisers see aggregate, de-identified reports only, and never see the precise location or timestamp of an individual ad play.
Can police get video footage from OOHAi equipment? No — there is no footage to provide; none is ever recorded. OOHAi Media does hold non-video scene-level records (location, time, aggregate audience estimates) for each ad play, which could in principle be the subject of a valid legal request — see clause 9.3.
As a passenger, am I being recorded during my Trip? No. The Player Tablet camera is used for audience-measurement detection only; it does not record, and no image or video of you is ever taken or stored. A scene-level record describing the vehicle's occupants in aggregate (not a record about you individually) may be generated for each ad play shown during your Trip, as described in clause 3. You can opt out — see clause 4.1.
11. Contact
Questions about the OOHAi computer-vision technology or this disclosure:
- OOHAi Media privacy:
privacy@oohai.com.au - OAIC:
oaic.gov.au, 1300 363 992
12. Related documents
- Privacy Policy — the platform-wide privacy policy.
- Biometric / Facial Verification Notice — the separate driver identity-verification biometric system (not covered by this document).
- Advertiser Terms of Service — terms governing the Advertiser Portal.
- Advertising Content Policy — what may and may not be advertised.
End of Computer Vision Privacy Disclosure.