User behaviour tracking is measuring what people actually do (where they walk, how long they stop, what they tap, where they abandon a video) rather than what they report doing. In a screen network it usually means dwell time and footfall past a display; in interactive video it means per-frame engagement and the exact point a viewer left.
It answers questions a survey cannot. Which of four creatives held attention past three seconds, whether the queue display is read while queuing or ignored, which branch of an interactive video loses people. Those are decisions worth data.
The caveat is that in-store tracking and web tracking are different legal objects, and treating them alike is how organisations get into trouble. A website visitor arrives having accepted terms; a person walking past a screen consented to nothing. Under GDPR and KVKK, anonymous aggregate counting is generally defensible, while anything that identifies or re-identifies a specific person (face signatures, MAC-address persistence, cross-visit matching) is a different obligation entirely, and often needs a lawful basis you do not have.
The practical version: count, do not recognise. Aggregate at the sensor, discard raw frames, and be able to explain in one sentence what is retained. If that sentence is hard to write, the deployment is the problem.