A stroller walk does not end at the supermarket door. The route planner gets you to the entrance, congratulates itself, and stops. The parent still has to find milk, diapers, a checkout lane wide enough for a stroller, and an exit that does not require reversing through a pyramid of seasonal snacks.
So I built the smallest indoor audit rig I could: an Android phone in my pocket, recording Bluetooth, WiFi, GPS, magnetometer, accelerometer, audio level, ultrasonic spectrum, and step cadence every 2-3 seconds. I walked three Danish supermarkets. Four walks total, two in pocket, two in hand.
I wanted to see if the stroller route could continue indoors. I accidentally built a retail media audit tool.

The Phone Immediately Lied
The raw Bluetooth count said there were 417 phone-like devices nearby.
I could see maybe 15 humans.
Bluetooth does not know whether a signal came from the shopper next to the milk, the apartment upstairs, the person walking past the front door, or the car in the parking lot. Signal strength is not distance. It is distorted by shelves, bodies, walls, refrigerators, and whatever the phone happened to be doing in my pocket.
Filtering by signal strength helped. Keep only strong nearby signals and the count drops to something like 11-19. That matched the room. But it was not a headcount.
| Walk | Mode | Points | BLE devices | WiFi SSIDs | Ultra events |
|---|---|---|---|---|---|
| Store A | 105 | 262 | 50+ | 19 | |
| Store B | 117 | 264 | 80+ | 16 | |
| Store C | hand | 68 | 286 | 50+ | 5 |
| Store B | hand | 98 | 417 | 90+ | 9 |
The Store Was More Interesting Than The Shoppers
Once I stopped pretending I had a people counter, the data got much more interesting.
The phone produced something closer to a site survey than a census.
The phone saw Grundfos refrigeration equipment, Zebra printer advertisements, Govee cold-chain sensors, SES-imagotag electronic shelf labels, Nilfisk cleaning robots, and smart taps. Store B and Store C turned out to share the same parent company, which the phone proved by finding identical corporate WiFi SSIDs in both stores. Twenty-six access points, same names, same network. A competitor could learn this from the entrance.
Every little system was casually announcing enough about itself to be useful. The operating model of the building was leaking into the air.

Ultrasonic Beacons Nobody Mentioned
The phone records a 9-bin ultrasonic spectrum in the 18-22 kHz band, frequencies most humans cannot hear. At each scan point, it classifies ultrasonic events as tones, bursts, or sweeps.
Store A had 10 tones and 8 sweeps. Store B had 6 tones and 9 sweeps. Both stores have active ultrasonic infrastructure in the near-ultrasonic band. Nobody mentioned it. No sign on the door. Nothing in the store's privacy policy.
This could be pest deterrent systems. It could be positioning beacons. It could be ad-tech audio beacons from companies like Silverpush or Signal360 that use inaudible tones for cross-device tracking. The phone cannot tell which. But it can prove the signals exist, measure their frequency, and map where they are strongest.

For the retail media measurement people: if you are deploying ultrasonic beacons in stores, every phone with microphone access can detect them. The infrastructure is not invisible, just inaudible.
The Fridge Section Is Magnetic
Refrigerator compressors and large metal structures distort the local magnetic field. The phone's magnetometer picks this up.
Store A's magnetic field ranged from 31 to 84 µT, a 52 µT swing across a single store. The spikes correspond to the cold chain section. Store B had a 39 µT range. You can map the fridge aisles without looking at them.
Acoustic hardness told a similar story. It is a ratio of peak to average ultrasonic energy. Hard surfaces like metal shelving and glass refrigerator doors reflect sound differently than produce and textiles. The phone measured Q-factors from 1.6 to 7.7. The highest readings clustered near hard, reflective surfaces.
Between the magnetometer and the acoustic hardness, the phone is building a rough material map of the store. Not precise enough for a floorplan, but enough to segment the store into zones.
Your Body Is A Wall
Walking Store B with the phone in my hand: 417 unique BLE devices. Same store, phone in my pocket: 264. A 58% increase from simply holding the phone at chest height instead of hip pocket.
The pitch sensor confirmed it. 70° average in hand, 8° in pocket. The human body attenuates Bluetooth signals enough to change the device count by over a third.
Any retail measurement system based on BLE device counting that does not account for phone orientation is measuring the carrier's body as much as the crowd. This is the kind of thing that becomes a slide in a retail media deck and nobody mentions that the number depends on which pocket the phone was in.
The Indoor Map That GPS Could Not Make
GPS accuracy indoors ranged from 8 to 53 meters. Useless for navigation. The phone detected this automatically and switched to dead reckoning: gyroscope heading fused with step detection, corrected by WiFi ranging and magnetic field fingerprints.
The result is a walking path that looks like a store layout. Not a floorplan, but a topology. You can see the aisles, the turns, the entrance, the checkout area. Turn detection snaps heading changes to 90° because grocery store aisles are on a grid. The path is the map.
For indoor location services, this is the interesting part. A phone in a pocket, with no beacons, no setup, no cooperation from the store, can trace a usable walking path through the building. The sensors are already there.
The Cursed Retail Media Audit
This is where the stroller app accidentally turns into ad tech.
If you can understand the indoor part of the errand, someone will eventually ask if you can understand the aisle. If you can understand the aisle, someone will ask how many parents walked past the diaper shelf. If you can answer that, congratulations, you have reinvented retail media measurement with a baby in the dependency graph.
The phone found the supporting infrastructure for in-store retail media: WiFi access points, BLE beacons, electronic shelf labels, digital displays, ultrasonic signals. It could estimate nearby device density. It could segment the walk into zones and attach evidence tags to each one. It could tell which zones had checkout hardware and which had refrigeration equipment.
What it could not do is the part that matters for retail media: prove that a person saw an ad, faced a screen, dwelled in front of a display, or bought something. Those require cameras, and cameras were the one layer that was almost invisible to the phone. The phone could see the plumbing but not the measurement layer.
The IAB retail media measurement guidelines have a chapter on in-store measurement. A phone walk like this is obviously not that. But the gap between "what a phone can passively detect" and "what retail media measurement claims to measure" is interesting. The infrastructure is visible. The measurement is not.

What We Can Claim
Observed
- 262-417 BLE identifiers per walk.
- Named devices consistent with Grundfos, Zebra, SES-imagotag, Nilfisk, Govee.
- Ultrasonic activity in 18-22 kHz in all stores tested.
- Magnetic field variation of 33-52 µT mapping cold chain sections.
- Corporate WiFi infrastructure shared across two "different" store brands.
- 58% more BLE devices visible with phone in hand vs pocket.
- Indoor walking path from dead reckoning when GPS failed.
Estimated
- 11-19 people nearby (RSSI-filtered, not a headcount).
- Store zones from magnetic, acoustic, and heading transitions.
- Fridge locations from magnetic spikes.
- Surface materials from acoustic hardness.
- Retail media infrastructure readiness.
- Browsing vs walking from accelerometer.
Not Proven
- Exact headcount.
- Individual tracking across visits.
- Demographics or purchase intent.
- Whether anyone saw an ad.
- What camera analytics ran.
- Shelf-level product placement.
- Floor changes (Samsung barometer returned 0).
The Samsung Tax
On the Samsung A52, Bluetooth scanning works while the screen is awake. Then the screen turns off and the scanner quietly dies. WiFi keeps working. Motion sensors keep working. Audio keeps working. BLE just stops.
The workaround is ridiculous but effective: keep the screen on, make it black, dim the brightness, and eat all touch events so the phone can sit in a pocket without calling emergency services or buying bananas. The barometer also returned 0 for every reading, so no floor detection. The fix for both problems is a Pixel. But the dumb workaround worked well enough to collect the data.
The Abyss
I started with the usual paranoid sentence: the store is tracking me.
After walking around with the app, the stranger sentence is: I was passively tracking the store. And the store was describing itself to every phone that walked in. Printers. Pumps. Shelf labels. Access points. Beacons. Displays. Ultrasonic signals in frequencies humans cannot hear. The entire technology stack, leaking into the RF environment.
For indoor mapping: the phone can trace the walk without GPS. The route does not need to stop at the door.
For retail media: the infrastructure is visible but the measurement is not. The phone can audit the plumbing. It cannot audit the cameras.
For privacy: the phone counts nearby devices, classifies them by manufacturer, and estimates density. It does this passively, with permissions that any fitness app already has. The retail media measurement industry is built on weaker proxies than what a phone in a pocket can collect for free.
All of this started because a parent wanted to know if the walk could keep being useful after the stroller crossed the automatic doors.