C-DRONE GUIDE · 30 AUGUST 2026
Drone Crowd Size Estimation at Events: What the Law Allows a Private Organiser
The question comes back at every edition : how many people were actually there ? A festival director wants to size the first-aid post, a city race organiser wants hard figures on pressure at the start pen, a local authority wants to know whether its capacity cap held, a security team wants to measure flow at an entrance that keeps saturating. The drone looks like the obvious tool. It partly is — but not in the way people imagine, because French law reserves image capture of gatherings for public-security purposes to a closed list of state services, and a private organiser is not on that list. Here is the exact boundary between the two regimes, what a private contractor may lawfully do, what a figure obtained from aerial imagery is really worth, and the prices.
Published on 30 August 2026, reviewed on 31 August 2026 — regulations in force as of August 2026.
Two regimes that do not overlap: state security forces on one side, the organiser on the other
Since Law no. 2022-52 of 24 January 2022 on criminal responsibility and internal security, France has had a specific legal framework for image capture by cameras fitted to unmanned aircraft, codified in articles L.242-1 to L.242-8 of the internal security code and detailed by the implementing provisions of decree no. 2023-283 of 19 April 2023, adopted after the CNIL's opinion. That framework is tightly drawn : it benefits only a closed list of services — national police and gendarmerie, customs, civil protection and fire and rescue services — acting in the exercise of administrative policing duties.
The purposes are exhaustively listed in article L.242-5 : preventing harm to persons and property in particularly exposed locations, securing gatherings of people on the public highway or in places open to the public where those gatherings are likely to cause serious public-order disturbance, preventing acts of terrorism, regulating transport flows, border surveillance, and rescuing people. Deployment requires a written and reasoned authorisation from the State's representative in the département — the prefect of police in Paris — valid for a maximum of three months and renewable, reduced to the duration of the gathering alone when sought to secure one, and stating the maximum number of cameras that may record simultaneously. Three prohibitions appear in the text itself : no sound capture, no facial recognition, and no automated cross-referencing, interconnection or linkage with other personal-data processing. Recordings are destroyed after seven days, except where passed to the judicial authority, and the public must be informed by any appropriate means unless circumstances prevent it.
This regime — part of whose provisions for municipal police forces was struck down by the Constitutional Council in its decision of 20 January 2022 — defines by contrast the position of a private organiser : there is no equivalent for them. No prefectural authorisation will ever cover the capture of images of an audience for security purposes by a festival, a sports club, a venue operator or a private security contractor. The question is therefore not how to obtain the same authorisation, but what ordinary law permits — a very different line of reasoning, closer to the one set out in our guide to drone surveillance of a company site than to any administrative-policing logic.
The only workable route for a private operator: anonymity by design
The starting point is simple : the CNIL considers that any image capture allowing a natural person to be identified constitutes processing of personal data, from the moment of collection and regardless of any later publication. Filming a crowd in which faces, recognisable clothing or number plates are legible therefore brings the organiser fully within the scope of the GDPR, with its obligations on legal basis, minimisation, information and retention period — reasoning we develop in our guide to GDPR and professional drone work.
There is, however, a narrow door, and it is the one to take : obtaining a figure without ever producing identifying data. That anonymity cannot be declared after the fact ; it is built into the mission parameters :
- Height and angle chosen so that the image yields only silhouettes seen from above, with no usable facial features — the single most decisive parameter, and the only one that genuinely protects.
- Fixed, wide focal length : no zoom on a group or a person, no slow motion on an individual, no tracking sequence.
- No individual tracking : what is measured is a density and an area, not a trajectory. The moment a system follows a person from one point to another, counting has become surveillance.
- Minimisation and short retention : only the frames useful for counting are processed, and the aim is to keep nothing but the result — the figures, the anonymised density map, the method note — deleting the source imagery within a period agreed in the order itself.
- Informing the public : signage at entrances, a clause in the event's terms of admission, a notice on the ticketing platform and the event website, stating that an aerial counting system is in use, its purpose and the data controller.
- A data protection impact assessment should be seriously considered as soon as capture covers a large audience in an open space : this is precisely the kind of processing for which one is expected.
What this route absolutely rules out deserves to be stated plainly : no facial recognition, no tracking of individuals, no named behavioural detection, no transmission of imagery to a third party — including to a police service, absent a judicial requisition — and no reuse of counting footage for communication purposes without going back through the regime of image rights and publication. And where the flight crosses neighbouring private plots, the rules set out in our guide to overflying people and private property continue to apply in full.
Research supports the logic of anonymity through height. A study by B. Ptak, D. Pieczynski, M. Piechocki and M. Kraft, published in 2022 in Remote Sensing and devoted to on-board crowd counting at low altitude, notes that images acquired at these working altitudes allow no extraction of biometric features and no attempt at individual identification (see the study on Google Scholar). In other words : the technical parameter that makes counting possible is exactly the one that makes identification impossible. That happy coincidence is what makes the service defensible — and it is also why any drift towards zooming or tracking tips the mission into a regime no private organiser can carry.
The airspace constraint: you do not fly over an assembly of people
GDPR is only half the problem. The other half is aeronautical, and it is blunter : Implementing Regulation (EU) 2019/947 prohibits flying over assemblies of people in all three open-category subcategories (A1, A2 and A3), without exception. An assembly is defined there not by a headcount but by a state of fact : a gathering in which people are unable to move away because of the density of those present. A festival front-of-stage, a pit, a city-race start pen or a stadium forecourt as the gates open all typically fall within that definition.
The paradox is stark : the view that would give the best count — a nadir image taken directly above the densest zone — is precisely the one banned in the open category. Four routes remain, and the choice is made case by case :
- Flying outside public opening hours : calibration passes over an empty site (before opening, between sessions, after clearance) to georeference zones precisely and measure their usable areas, with counting then done on constrained passes.
- Working from outside the perimeter, in oblique view, never positioned directly above the assembly : the geometry is less favourable and occlusion increases, but per-zone density measurement remains usable.
- Targeting zones where the public is not dense : access queues, forecourts, walkways, car parks, campsites — where people can move away, the assembly qualification does not apply, and that is often where the real operational issue of entry flow actually lies.
- Building a specific-category case where flying over the public is genuinely necessary : a European standard scenario or a dedicated risk assessment, ground perimeter, clearance procedures. That is the framework described in our guide to drones at festivals and gatherings, with the corresponding lead times and costs.
This constraint is not a negotiable formality : it shapes the mission, it drives the price, and it explains why a serious quote always starts with a site layout marking the zones that may actually be overflown, before any discussion of deliverables. The ground arrangement follows the same logic as for inspecting temporary grandstands and bleachers : a take-off point set well clear, flight corridors agreed with the security manager, an immediate-stop procedure.
What a figure is really worth: estimation method and acknowledged uncertainty
The principle of aerial crowd estimation is old and has not fundamentally changed ; what has progressed is the counting tooling. It runs in four steps :
- A georeferenced image of the zone, ideally nadir, whose scale is precisely known — without that, everything downstream is wrong. Area, more than counting, is the first source of error : being 20 % out on a zone's area means being 20 % out on its headcount.
- A split into zones of homogeneous density : saturated front-of-stage, airier mid-site, sparse fringes, circulation aisles. Averaging across a whole site systematically produces nonsense, because real density varies by a factor of five or ten between the stage barrier and the edges.
- A count, either automatic through detection or density-map estimation, or by manual sampling on representative test squares — the manual method often remains the more robust one when image quality is average or density extreme.
- An extrapolation zone by zone, then a total presented as a range, never as a single number.
Technically, segmenting high-density zones is a long-studied problem in aerial imagery : a study by O. Meynberg, S. Cui and P. Reinartz, published in 2016 in Remote Sensing, shows that texture classification effectively separates dense-crowd regions from the rest of the scene in aerial images of large events, which provides exactly the prior zoning on which counting quality depends (see the study on Google Scholar).
That leaves honesty about the margin. The reference dataset DroneCrowd, published by L. Wen, D. Du, P. Zhu and co-authors at the CVPR 2021 conference, gathers 112 video clips, 33,600 high-definition frames and 4.8 million annotated heads, precisely in order to evaluate detection, tracking and counting algorithms on crowds filmed by drone at varying densities, perspectives and flight altitudes (see the study on Google Scholar). The mere fact that such a dataset had to be built says the essential : aerial crowd counting remains an open problem on which no method claims an exact figure. The error sources are known and cumulative — people invisible under a marquee, a tree, a footbridge or stage structure ; density changing faster than the flight plan ; a crowd moving between two passes ; backlight and long late-afternoon shadows. A contractor announcing 12,437 people is selling false precision ; a contractor announcing between 11,000 and 14,000, with the method and zones detailed in an appendix delivers a usable result. It is the same discipline as the vehicle counts described in our guides to car park occupancy counting and traffic counting, with the difference that humans move, cluster and hide far more than a parked car does.
Legitimate uses, mission set-up and 2026 prices
Stripped of the surveillance fantasy, the service keeps solid uses — and those are the ones that actually sell :
- Sizing first-aid and circulation arrangements : knowing that one zone holds 40 % of the audience at 10 pm changes where the first-aid post goes, how wide the walkways need to be and how many stewards are assigned to a pinch point.
- Putting hard figures on entry flow : measuring the real queue at each gate, comparing throughputs, identifying which gate saturates and which stays empty — data that translates straight into the number of screening lanes to open next year.
- Feeding a safety case : attaching to the event notification or the safety-commission file an attendance estimate documented by zone and by time slot, rather than a theoretical capacity figure that was never verified.
- Running a post-event review : comparing estimated attendance against ticket sales and staffing levels, and settling the site layout for the next edition.
- Publishing a figure to partners, funders and the press while owning the order of magnitude and disclosing the method — which is exactly what protects against a dispute over numbers.
Operationally, the mission is prepared like a drone security and surveillance job, with a few specifics : a preparatory meeting with the security manager and the production manager, a site layout marking overflyable and prohibited zones, passes timed around the moments the organiser actually cares about (gates opening, headline act, exit), a take-off point clear of flows, an immediate-stop procedure on request from the security control room, and a written data-processing agreement setting out purpose, retention period and recipients. Allow six to eight weeks' lead time if a specific-category case is required — far less where counting is confined to non-dense zones and the surroundings.
2026 prices (excl. VAT) : €500 to €1,000 for a counting session over a two-to-four-hour slot on one zone, with a counting note and an attendance range ; €1,200 to €2,500 for a multi-pass campaign across an event day (several timestamped slots, several zones, an anonymised density map and a method report) ; €2,500 to €5,000 and above, on quotation, for a multi-day event or a multi-stage site requiring several crews ; €150 to €350 per additional pass within a session already under way ; €300 to €700 for the analysis report alone (post-processing, zone-by-zone extrapolation, method and uncertainty note) from existing imagery. Specific-category regulatory work is priced separately and lengthens the lead time. A travel charge applies beyond a 30 to 50 km radius. Request a quote stating the site area, the announced capacity, the time slots you care about and whether the public will be present during the flight.
Frequently asked questions
Can a private organiser have its crowd filmed by drone in order to count it?
It can have attendance estimated, but it cannot surveil an audience. The difference lies in how the mission is designed : imagery taken from a height and angle that yield only non-identifiable silhouettes, no zoom on faces, no tracking of any individual, and retention limited to the strict minimum — ideally only the count itself is kept once processing is done. And the airspace rule stacks on top of GDPR : in the open category, flying over an assembly of people is prohibited, which means working from outside the perimeter, outside public opening hours, or under a specific-category authorisation.
How accurate is a drone crowd count in practice?
It is an order of magnitude, not an exact figure, and an honest contractor says so upfront. The error sources are structural : people hidden under a marquee, a tree or stage structure, density varying sharply from one zone to the next, a crowd moving between two passes, poorly defined zone edges. Reference datasets in aerial-counting research show that even the best algorithms retain a significant mean error, which degrades markedly as density and occlusion increase. A serious report therefore states a range and the method behind it, never a single isolated number.
Does the French law of 24 January 2022 on airborne cameras apply to a private contractor?
No, and that is a common misreading. This regime, codified in articles L.242-1 and following of the French internal security code, is reserved to a closed list of services — national police and gendarmerie, customs, civil protection and fire and rescue services — acting under administrative policing duties, with a written and reasoned prefectural authorisation. An organiser, a private security contractor or a production company cannot invoke it : they fall entirely under ordinary law, GDPR and image rights, with no derogation whatsoever attached to a security motive.