The Instrumented City: Urban Sensing, Consent, and Who Gets to Decide

Cities have always tried to see themselves. Before there were sensors, there were ledgers, maps, and enumerators walking door to door — each generation's best attempt to render an unruly, half-visible system legible enough to govern. What's changed is not the impulse but the resolution: a nineteenth-century census taker could tell you roughly where people lived; a modern sensor grid can tell you, block by block and minute by minute, where they are right now. This essay traces that arc from pre-digital origins through the branded "smart city" era to the project that pushed urban sensing further than any other and ran straight into a wall no amount of accuracy could get past — Sidewalk Labs' attempt to build a sensor-rich neighborhood on Toronto's waterfront, and its collapse under a challenge not of measurement but of legitimacy.

I. Introduction: A Personal Vantage Point

I came to this question from the inside of the instrument rather than from outside it. At Social Bicycles, and later at Superpedestrian, the fleets I helped build were, functionally, urban sensors that happened to be shaped like bikes and scooters: each vehicle reported its location, its lock state, and its usage pattern back to a server that cities increasingly wanted access to, in aggregate, to manage curb space, plan transit, and enforce fleet caps. The clearest version of that idea I built, though, wasn't a fleet vehicle at all. At Social Bicycles I originated Social Cyclist, an app that let ordinary riders — not just company-owned bikes — feed cities the same kind of aggregate infrastructure data: preferred routes, road hazards, and votes on where new bike-share stations and lanes should go. It was named one of three finalists, alongside Djump and Peerby, in the New Cities Foundation's 2014 AppMyCity! competition, judged in partnership with Guardian Cities and presented that June at the New Cities Summit in Dallas, Texas. That work — fleet sensor and citizen-facing app alike — sits squarely inside what this essay calls urban sensing, and it is the reason this essay treats the question as more than academic: the data a city can see about how people actually move through it is genuinely useful for planning, and the terms on which a private operator, whether a fleet company or an independent app, shares that data with a public agency are exactly the kind of governance question the rest of this essay is about.

The argument proceeds in five further parts. Part II sketches urban measurement before the "smart city" label existed, from John Snow's 1854 cholera map through Los Angeles's 1984 Olympics-era traffic control system. Part III describes the branded smart-city era of the 2010s and the case for what it accomplished. Part IV is a close case study of Sidewalk Labs' Quayside project in Toronto, the most ambitious recent attempt at comprehensive urban sensing and its collapse under public objection. Part V takes the same governance problem outside city hall entirely, to the browser, the messaging app, and the data-protection regulators now writing versions of it into law, and distills four practical tests a product manager or a city planner can run before building the next Quayside rather than after its backlash. Part VI concludes with the distinction this set of essays turns on: unlike a wearable, which a person chooses to put on, a city sensor is ambient by design, and that design choice is the source of the legitimacy problem the rest of this series pursues.

II. Before "Smart": A History of Urban Measurement

The founding case study of urban measurement predates computing by more than a century. During the 1854 cholera outbreak in London's Soho neighborhood, which killed 616 people, the physician John Snow plotted the addresses of the dead against the water pumps that served them and found the deaths clustering tightly around a single pump on Broad Street. The local council removed the pump's handle on September 8, 1854; Snow, who was not trained as a cartographer, is now credited as a founder of the discipline of disease mapping, and his map remains the textbook example of how spatial data, correctly instrumented and correctly read, can settle a public-health question that pure theory — the era's dominant "miasma" account blamed foul air, not water — could not.

The twentieth century added continuous, mechanical sensing rather than one-time cartographic reconstruction. Los Angeles built its Automated Traffic Surveillance and Control system, ATSAC, for the 1984 Olympics, initially wiring 118 signals with inductive loop detectors and closed-circuit cameras feeding a central control room that adjusted signal timing in real time based on measured traffic flow. It was, functionally, exactly what a "smart city" system would later be marketed as, deployed decades before that marketing term existed, and it worked: independent evaluation credits the fully built-out system, now covering more than 4,500 signals, with cutting intersection delay by roughly a third and vehicle emissions by several percent across the network. ATSAC is a useful corrective to the idea that urban sensing is a recent phenomenon dressed up in new vocabulary; the vocabulary is recent, the practice is not.

III. The Sensor Grid Arrives

What changed in the 2010s was not the existence of urban sensors but their density, their networking, and their branding. IBM's "Smarter Cities" campaign and deployments like Rio de Janeiro's centralized operations center — a single room aggregating feeds from traffic cameras, weather sensors, and utility systems into one dashboard — marketed a vision in which a city's entire operational state could be observed continuously from a single point, in the same way ATSAC had observed only traffic. Dockless mobility fleets, the sector I worked in, added another sensor layer on top of the fixed municipal grid: instead of loop detectors embedded in pavement, a fleet of GPS-equipped bikes and scooters became a moving census of trip origins, destinations, and demand, refreshed continuously rather than sampled periodically the way a traditional origin-destination travel survey had been.

The case for this density of sensing is a straightforward extension of the case for ATSAC: better data produces better-timed interventions; a city that can see where trips actually start and end can plan a bus route or a bike lane against real demand instead of an inference from a travel survey conducted once every few years. That argument is not wrong, and it is the reason transit agencies and city planning departments were, and are, eager customers for exactly this kind of data. The problem, as the next section shows, is not the case for sensing; it is the question of consent that fixed municipal infrastructure like ATSAC never had to answer, because a traffic light does not know whose car it is timing, while a comprehensive neighborhood sensor grid, by design, would.

IV. Where It Broke: Sidewalk Labs and the Quayside Backlash

In 2017, Sidewalk Labs — an Alphabet subsidiary, meaning a corporate sibling of Google — won the bid to develop Quayside, a stretch of Toronto's eastern waterfront, as what the company described as "the world's first neighbourhood built from the internet up": heated pavement that could report on its own ice conditions, sensor-driven waste management, adaptive traffic signals, and a pervasive network of environmental and movement sensors feeding a shared data layer. It was, in ambition, the fullest realization of the smart-city sensor grid described in Part III, proposed for an entire neighborhood rather than retrofitted onto an existing one.

The backlash arrived quickly and did not center on whether the sensors would work. Residents, privacy advocates, and members of the project's own advisory panel objected specifically to the governance question: who would own the data a comprehensive neighborhood sensor grid generated, who could access it, and what would stop the arrangement from becoming a template for privately-operated civic surveillance elsewhere. Sidewalk Labs responded by proposing an independent "civic data trust" to steward the data on the public's behalf rather than the company's, a structural concession that amounted to an admission that the original plan had not adequately answered the consent question in the first place. Waterfront Toronto, the public body overseeing the project, later stated plainly that the concerns raised about data governance had been legitimate. Alphabet cancelled the project outright in May 2020, citing pandemic-driven economic uncertainty as the proximate cause, but the project had already spent nearly three years fighting a legitimacy battle the pandemic did not create.

Quayside is the cleanest available case study of a general pattern: an urban sensor system can be technically sound and still fail, not on a measurement question but on a consent question that has no equivalent in the wearables essay in this set. A person who finds their sleep score anxiety-inducing can simply remove the ring. A resident of a fully-instrumented neighborhood has no equivalent exit, short of not living there, which is precisely why the ambient, non-opt-in character of civic sensing raises a harder governance problem than the personal, opt-in character of a wearable device.

V. Beyond City Hall: The Same Problem in the Browser and the App

The distinction Quayside forced into the open — a sensor a person can walk away from versus one built into the ground they walk on — does not stay contained to city government. It shows up anywhere an entity controls the ambient layer through which a population is measured, and two of the clearest cases today are not municipal at all: the browser, and the messaging app. This is where a short history of urban sensing has to stop being only about cities, because the governance problem it describes has already migrated somewhere most city planners never have to think about, and most product managers building it don't recognize as the same problem they'd immediately flag in a city council meeting.

A web browser is, functionally, a piece of civic infrastructure for the internet: it is the street every user walks down to reach every other destination, and whoever controls it can see, by default, an enormous amount about who is walking where. Google's Chrome carries roughly two-thirds of the world's browser traffic, and Google is also the company with the largest single stake in the advertising business that ambient browsing data feeds. In 2019 Google proposed Privacy Sandbox, an initiative meant to replace third-party tracking cookies with ostensibly more private, on-device measurement APIs. After six years of development, weak adoption, and sustained antitrust scrutiny over the fact that the company profiting most from tracking was also the one designing its replacement, Google retired Privacy Sandbox entirely in October 2025 and left third-party cookies in place indefinitely. It is the browser-scale version of the exact conflict Sidewalk Labs ran into as an Alphabet subsidiary proposing to build both the sensor grid and the civic trust meant to govern it: an entity that profits from ambient measurement cannot easily also be the referee who decides its own limits, and regulators, competitors, and the public tend to notice when it tries.

Apple took a different, unilateral route to the same governance question. Its 2021 App Tracking Transparency policy required apps to ask explicit, opt-in permission before tracking a user across other apps and websites, converting a previously ambient, invisible measurement practice into something closer to Quayside's abandoned civic-data-trust model — except imposed by fiat from the one company that controls the operating system, rather than negotiated with the people being measured. Roughly three-quarters of users declined to be tracked once actually asked, and the policy is estimated to have cost Meta on the order of $10 billion in advertising revenue in 2022 alone — a company I do this same kind of measurement work for today, in ads growth, which is part of why I'd rather diagnose this governance problem honestly than take either company's side in it. Whether Apple's move is best understood as a device maker finally collecting the consent no one had actually asked for, or as one platform using its operating-system chokehold to disadvantage a rival's ad business under cover of privacy, is a genuinely open question — and it is the same question the Sidewalk Labs episode raised about who gets to hold a civic data trust. Legitimacy requires that someone hold that position. Controlling the pipe does not automatically qualify a company to hold it well, whichever company it is.

Messaging platforms complicate the picture further, because for many users they are not optional in the way Quayside's smart neighborhood was optional. WhatsApp reaches roughly 99 percent of Brazilian internet users and 81 percent of Indian internet users, and in both markets it functions closer to a utility than a product any individual consumer might simply decline. The exit that Quayside's critics correctly identified as the thing a resident of a fully-instrumented neighborhood lacks — the ability to just not live there — has a real analogue here: a person can, in principle, delete WhatsApp the way a resident could in principle move out of Quayside, but for a meaningful share of users that choice carries a cost closer to leaving a city than closing an app.

Regulators have begun writing a version of this same question directly into law, under the headings of purpose limitation and data portability. The EU's General Data Protection Regulation already required that personal data collected for one purpose not be repurposed for an unrelated one without a fresh legal basis; its 2022 successor, the Digital Markets Act, sharpens that into something closer to an explicit test. Article 5(2) of the DMA bars a "gatekeeper" platform from combining personal data across its own core services, or from using data collected by one of its services to benefit another, unless a user has been given a specific, symmetric choice and has actually consented to it — not merely been defaulted into it by internal policy. In effect, it converts an internal architecture question — should the signal one business line generates be allowed to improve another, and on what terms would that same signal be offered to an outside partner — into something regulators now expect a real, revocable answer to, rather than a decision a company is trusted to make quietly on its own.

Two ongoing cases show what enforcement of that principle looks like, independent of how either is ultimately resolved on appeal. The European Commission fined Meta €200 million in April 2025, concluding that its "pay or consent" advertising model did not offer users a genuinely equivalent, less-personalized alternative to accepting cross-service data combination — an Article 5(2) finding turning specifically on whether the choice on offer was real rather than notional. In a separate antitrust matter, a U.S. federal court ruled in April 2025 that Google had tied its publisher ad server to its own ad exchange in a way that favored Google's ad-buying tools over competitors without equivalent standing to compete on the same terms, a finding the European Commission reached independently in September 2025 with a €2.95 billion fine; both matters remain in remedies proceedings and are expected to be appealed for years before they are finally settled. Whatever their ultimate outcome, the question underneath both is the one this essay has been asking about sensor grids since the Quayside case study: does the entity that built the pipe get to decide, unilaterally, how its own downstream businesses may draw on what flows through it?

None of this is abstract for anyone actually building at this scale, and the cases above offer four tests worth running before shipping rather than after the backlash or the fine. The first is a purpose-lock test: is the data restricted to a specific, named use — ATSAC reads only traffic flow, for only traffic signals — or is it a general-purpose asset that can be quietly repurposed later, the way Quayside's "comprehensive neighborhood sensor grid" was and third-party ad cookies still are? The second is a standing test: who has the institutional authority to grant or revoke access to the data, and is that authority independent of whoever profits from collecting it? Sidewalk Labs proposing to govern its own civic data trust failed this test for the same structural reason Google proposing to govern its own tracking replacement did. The third is an exit test: can the measured party actually decline, at a cost proportionate to an ordinary consumer choice, or is declining closer to impossible — a resident of a fully-sensored neighborhood, a driver on a road whose signals depend on the system, a WhatsApp user in a market where it is the default utility? The fourth, now partly codified by GDPR's purpose limitation and the DMA's Article 5(2), is a parity test: would this signal be offered to an arm's-length partner on the same terms it is used internally, with the same real, revocable choice for the person it describes? A company that would only ever make its internal-use argument to a regulator, and never to a competitor asking for identical terms, has already answered the question. A system built on infrastructure with no realistic exit needs a materially higher standard of legitimacy than a feature someone can simply choose not to enable, and the product managers and city planners who ask all four questions before launch, rather than after the advisory panel resigns or the fine arrives, are the ones who end up building the ATSAC of their domain instead of its Quayside.

VI. Conclusion

Cities have been instrumenting themselves since long before the phrase "smart city" existed, and the case for doing so is genuinely strong: John Snow's map ended a specific outbreak; ATSAC measurably cut delay and emissions across an entire road network; a well-governed mobility-fleet data feed can direct a bike lane to where people actually ride rather than where planners guess they might. What Quayside demonstrated is that the case for accuracy and the case for legitimacy are separate arguments, and that a project can win the first decisively while losing the second entirely — a pattern that, as the previous section showed, is no longer confined to city government. The distinction that follows from this — between a sensor a person chooses to wear and a sensor that is simply present in the environment they occupy, chosen or not — is the dividing line the third essay in this series exists to blur, as contact tracing, insurance telematics, and congestion pricing each show a personal device being recruited, often without much genuine choice involved, into exactly the kind of ambient civic sensing this essay has just described.