The same waves that carry your data can sense the room. And whoever is standing in it, phone or no phone.
In brief
- Germany’s data protection authorities adopted a position paper in June 2026 on ISAC, the technology that will pair communication with environmental sensing in 6G networks.
- The critical issue is not tracking network users, but everyone else: sensing works through reflected radio waves and covers anyone in range, with or without a device.
- ETSI has already identified 19 critical risk points, including unauthorised sensing. The technology is expected from 2030 — and the rules are being written now.
What ISAC actually is
ISAC Integrated Sensing and Communication merges two previously separate functions into one radio infrastructure: transmitting data and perceiving the environment. The same waves carrying a call or a video stream double as radar: by analysing how they reflect off objects and people, the network can derive positions, distances, speeds and movements in real time. The principle is echolocation.
This is not theoretical. The function is among the leading candidates for the sixth generation of mobile networks, expected from 2030, and is also under study for future WiFi standards. Vodafone is already demonstrating sensing capabilities on 5G networks.
The applications are attractive to the industry: detecting pedestrians at junctions, monitoring traffic without cameras, spotting falls at home without wearables, managing building occupancy intelligently. It is why ISAC is described as one of 6G’s genuine discontinuities more so than raw speed.
The problem: people without a phone in their pocket
The difference from conventional tracking is sharp, and it is the whole story. The location technologies we know GPS, cell towers, WiFi, apps require someone to carry a device, hold a SIM, install something. ISAC works at the physical layer: it analyses reflected waves, so it covers anyone within the coverage area regardless of what they are carrying.
The chair of Germany’s data protection conference, Tobias Keber, put it plainly: the technology draws no distinction between someone carrying a device and someone who is not, because being based on radio waves it can capture the movements of anyone present without any active participation from them and capturing vital signs is conceivable too.
This is the “bystander” problem. The informed consent the GDPR requires assumes a person knows they are subject to processing and can refuse. In a pervasive infrastructure scanning space as a whole, obtaining consent from everyone passing through is not merely difficult: it is practically impossible.
Through walls? What the paper actually says
The line that made headlines is the possibility of sensing space “potentially even through walls and masonry”: that phrasing comes from the German authorities’ official communication, and it is worth reporting for what it is a regulator flagging a risk, not a product specification.
On the physics, one clarification is missing from almost all coverage. The ability to penetrate obstacles does not increase with frequency: it decreases. The very high bands millimetre wave and the sub-terahertz range often associated with 6G offer high resolution but are easily stopped by walls and vegetation. Through-wall sensing works better at lower frequencies including those used by domestic WiFi, where research on reflection-based sensing has been running for years.
This is not an academic detail: it is why the German paper covers not only 6G but explicitly the future WLAN standards too. The issue, in other words, is not confined to operator antennas in 2030. It also involves the router in your living room.
The legal knot: consent, sensitive data, misuse
Under European law, three distinct fronts open up.
Consent. As noted, this is the structural problem: an infrastructure that senses space cannot ask permission of those crossing it. Authorities are therefore demanding that data protection be built into the design and standardisation phase rather than bolted on afterwards privacy by design.
The nature of the data. Movement, gait, presence in a place at a given time are personal data; to the extent the technology were to capture physiological parameters, it would enter the category of special data, which the GDPR protects far more strictly.
Misuse. This is the risk flagged on the technical side: according to the German authorities, ETSI has identified 19 critical points, among them “unauthorised sensing” the possibility that someone exploits the signals to map buildings, follow people or intercept sensing data. A function designed for road safety becomes, in the wrong hands, a surveillance or reconnaissance tool.
The countermeasures on the table
The good news is that the debate is arriving before the standard rather than after a meaningful difference from how other technology transitions have gone. The authorities moved deliberately now, while the specifications are still being written.
Three technical directions are under discussion in European research consortia and standards bodies. The first is signal obfuscation: injecting controlled noise into the parameters describing the radio channel state, preventing the extraction of detailed micro-movement signatures. The second is resolution limiting: setting by design a spatial detail threshold below what is needed to identify a person or their physiological parameters. The third is zone control: hardware or logical mechanisms that disable sensing in sensitive areas or at sensitive times.
On the European research side, one concrete example is the NEMO project, involving Fraunhofer IDMT, which concluded in December 2025. The question that matters remains open: whether these approaches make it into the final standard, and whether they work in practice.
Why this matters beyond telecoms
For those buying and deploying infrastructure public administrations, large property owners, industry the consequence is that over the coming years networks will not be judged on speed and connection density alone. Being able to demonstrate which sensing functions are active, at what resolution and with what safeguards will become a line item in procurement, exactly as happened with cybersecurity when it moved from technical feature to contractual requirement.
Vendors that arrive first with native obfuscation protocols do not just gain a reputational edge: they remove a regulatory risk in a market the European one where regulatory risk is what stalls supply contracts.
Frequently asked questions
What is ISAC? Integrated Sensing and Communication: using the same radio infrastructure to transmit data and, simultaneously, sense the environment by analysing reflected waves.
Can 6G see through walls? German authorities flag sensing “potentially even through walls” as a risk to be regulated. Physically, penetration decreases as frequency rises: through obstacle sensing works better at lower frequencies, WiFi included.
Do I need a smartphone to be detected? No and that is the core concern: sensing relies on reflected radio waves and covers anyone within the coverage area.
When is 6G arriving? The new generation is expected from 2030. Sensing functions, however, are already being demonstrated on 5G networks.
Who raised the alarm? The Datenschutzkonferenz, the body bringing together Germany’s federal and state data protection authorities, in a position paper adopted at its 111th conference in Stuttgart in June 2026.
Can you protect yourself? Complete individual protection is difficult, because radio waves pass through obstacles and require no participation from the person. That is why the debate focuses on design rules within the standard rather than on personal countermeasures.
Sources
- Datenschutzkonferenz — Position paper “Datenschutz im Kontext von Integrated Sensing and Communication (ISAC)”, 111th conference, Stuttgart, 16–18 June 2026
- DSK press release, 18 June 2026
- heise online — interview with DSK chair Tobias Keber
- Baden-Württemberg data protection commissioner — statement on the 111th conference
- ETSI — ISAC security risk reports (19 critical points), as cited by the DSK
