Brazil’s National Telecommunications Agency (Anatel) approved on Wednesday (28) a rule making facial biometric validation mandatory to register or keep mobile phone lines active in the country. In practice, every citizen with a mobile number linked to their CPF (taxpayer ID) will have to hand over an image of their own face — with a “liveness check” — to keep using the service. Those who do not re-register will have their line suspended and then cancelled starting in January 2029.
The official justification is fighting fraud: according to the agency, Technical Standard GT-SEG.2026.11 aims to make it harder to activate lines with false data or in the name of third parties. The measure comes amid an explosion of digital scams in the country. But the path chosen opens a new and serious front of risk for millions of Brazilians: concentrating the most sensitive data a person has — their own face — in yet another database exposed to leaks.
How it will work
Under the approved text, customers will undergo facial recognition with a liveness check, and the image will be compared with existing public or private databases. The procedure can be done through the carrier’s app or in person at stores. Anatel says there will be alternative procedures for those unable to complete facial recognition.
Implementation will be gradual. New prepaid lines must go through validation by September 30, 2027. For new postpaid lines, number portability, SIM swaps and registration changes, the deadline is December 31, 2027. Users who already have a line and have not yet been validated will have to re-register by December 31, 2028.
The same face that opens your bank account
The most delicate point of the new rule is that facial biometrics have already become the main key to Brazilians’ financial and digital lives. A Deloitte survey with Febraban shows that 75% of the country’s banks use facial recognition to identify customers. Faces are also used to log into gov.br, authorize transactions, release INSS pensions and enter residential buildings.
In other words, the same physical trait that carriers will now demand is the one that unlocks bank accounts, loans, social benefits and health data. Every new company or agency that collects and stores this information is one more door through which it can escape — and the phone is precisely the device used to receive security codes and confirm financial transactions.
The Brazilian Institute for Consumer Protection (Idec) has warned about this risk for years. Lawyer Lucas Marcon, from the organization’s Telecommunications and Digital Rights program, has stated that if someone’s biometric data leaks, every place where that person has a biometric registration becomes vulnerable. Idec even notified Dataprev against the use of facial recognition until the successive data leaks involving INSS retirees and pensioners were resolved.
Leaks are not hypothetical
Brazil’s track record on data protection does not inspire confidence. Databases of public agencies and large companies have been exposed repeatedly in recent years, fueling scams, aggressive payroll-loan harassment and identity fraud. In 2020, Safety Detectives researchers reported finding, on a server of a biometric identification company, information linked to the fingerprints of tens of thousands of Brazilians — the company disputed this and said it was a test environment.
Brazil’s General Data Protection Law (LGPD) classifies biometrics as sensitive personal data requiring extra care. Even so, Anatel’s rule does not publicly detail who will store the collected images, for how long, with what level of encryption and who will be held responsible in the event of a leak. It is also unclear whether the comparison with “private databases” means carriers and outsourced companies will have access to these records.
The use of biometrics by governments or companies, for whatever purpose, is extremely sensitive and must be handled with the utmost rigor. Biometrics are permanent data. If a password is stolen, you simply create a new one. If biometrics are stolen, there is no way to create new ones: the face, the fingerprint and the iris are the person’s physical identity itself. Once leaked, the damage lasts a lifetime.
Fighting scams is necessary, but turning the faces of more than 200 million Brazilians into a requirement to keep a phone working, without clear guarantees on storage, auditing and accountability, shifts the risk onto citizens. Measures like this should come, at the very least, with real and accessible alternatives for those who do not want to hand over their biometrics, transparency about where the data is kept and severe penalties for anyone who allows leaks.
What Anatel says
In a statement, the agency said the proposal was drafted by the Technical Subgroup for Combating Fraud and Scams (SGT-Fraudes) and approved by consensus, with the aim of strengthening the security of mobile telephony registrations.
Illustrative image generated by AI.