Customers in shopping centres are having their every move tracked by a new type of surveillance that listens in on the whisperings of their mobile phones.

The technology can tell when people enter a shopping centre, what stores they visit, how long they remain there, and what route they take as they walked around.

The device cannot access personal details about a person’s identity or contacts, but privacy campaigners expressed concern about potential intrusion should the data fall into the wrong hands.

The surveillance mechanism works by monitoring the signals produced by mobile handsets and then locating the phone by triangulation – measuring the phone’s distance from three receivers.

It has already been installed in two shopping centres, including Gunwharf Quays in Portsmouth, and three more centres will begin using it next month, Times Online has learnt.

The company that makes the dishes, which measure 30cm (12 inches) square and are placed on walls around the centre, said that they were useful to centres that wanted to learn more about the way their customers used the store.

A shopping mall could, for example, find out that 10,000 people were still in the store at 6pm, helping to make a case for longer opening hours, or that a majority of customers who visited Gap also went to Next, which could useful for marketing purposes.

In the case of Gunwharf Quays, managers were surprised to discover that an unusually high percentage of visitors were German - the receivers can tell in which country each phone is registered - which led to the management translating the instructions in the car park.

The Information Commissioner's Office (ICO) expressed cautious approval of the technology, which does not identify the owner of the phone but rather the handset's IMEI code - a unique number given to every device so that the network can recognise it.

But an ICO spokesman said, "we would be very worried if this technology was used in connection with other systems that contain personal information, if the intention was to provide more detailed profiles about identifiable individuals and their shopping habits.”

Only the phone network can match a handset's IMEI number to the personal details of a customer.

Path Intelligence, the Portsmouth-based company which developed the technology, said its equipment was just a tool for market research. "There's absolutely no way we can link the information we gather back to the individual,” a spokeswoman said. “There's nothing personal in the data."

Liberty, the campaign group, said that although the data do not meet the legal definition of ‘personal information’, it "had the potential" to identify particular individuals' shopping habits by referencing information held by the phone networks.

The receivers together cost about £20,000 to rent per month. About 20 the units, which are unobtrusive, cream-coloured boxes about the size of a satellite dish, would be needed to cover the Bluewater shopping centre.

Bluewater, in Kent, said it had no plans to deploy the equipment. A spokesman for Gunwharf Quays was not available for comment.

Owners of large buildings currently have to rely on manual surveys to find out how customers use the space, which can be relevant to questions of design such as where the toilets should be located or which stores should be placed next to one another.

Other types of wireless technology, such as wi-fi and Bluetooth, can be used to locate devices, but the regular phone network signal is preferable because it is much more powerful and fewer receivers are needed to monitor a given area.

Phone networks have long been capable of gauging the rough location of a handset using three phone masts, but the margin error can be as great as 2km. The process is also less efficient when the phone is indoors. Path Intelligence's technology can tell where a phone is to "within a couple of metres."

"You're basically going to know that that person has been in Starbucks," Toby Oliver, the company's chief technology officer, said.

Even when the owner is not using it, a mobile phone makes contact with the network every couple of minutes, which is enough for the receivers to get a reading on its position.

Explore Tech & Web

• Personal Tech

• The Web

• Gadgets & Gaming