Brazil's national telecommunications regulator approved a mandatory biometric enrollment norm Wednesday, requiring all 263 million mobile subscribers in the country to submit a live facial scan — or lose their phone lines — while the national data protection authority's framework for governing facial recognition data remains unfinished.

The approval of Technical Norm GT-SEG.2026.11 by Anatel's Superintendence of Planning and Regulation sets a new global benchmark for technically mandated biometric enrollment in telecommunications — and does so ahead of Brazil's own comprehensive data protection rulebook for biometric data, which the Autoridade Nacional de Proteção de Dados (ANPD) opened for public consultation in June 2025 but has not yet finalized.

What Anatel's New Norm Actually Requires

Every provider of Brazil's Serviço Móvel Pessoal — personal mobile service — including mobile virtual network operators (MVNOs) and credentialed resellers, must now integrate facial recognition and liveness detection into subscriber enrollment and re-enrollment workflows. The norm applies without exemption by company size, pulling in the smallest resellers alongside Vivo (Telefónica), TIM (Telecom Italia), Claro (América Móvil), and Oi.

The technical floor is deliberately demanding. Facial verification must comply with ISO/IEC 30107-3 Presentation Attack Detection (PAD) Level 2 — the second of three tiers in the international liveness-detection standard — meaning systems must resist not just a flat photo replay, but sophisticated attacks including realistic 3D masks, high-quality printed images, and high-definition video replays. At PAD Level 2, a system's false-rejection rate for legitimate users (the Bona fide Presentation Classification Error Rate, or BPCER) must stay below 15%. Independent testing is conducted under ISO 30107-3 by iBeta Quality Assurance, a NIST-accredited testing lab. This means off-the-shelf consumer liveness libraries that detect only screen replays will not meet the standard — carriers must contract with or build systems that have cleared formal third-party certification.

Any private biometric database used for matching must also have been built using liveness checks at the same PAD Level 2 threshold. Every verification event must generate an auditable record capturing its timestamp, whether the subject matched a biometric database, and which identity verification provider ran the process. That audit trail is itself a new category of sensitive biometric data carriers will be obligated to protect.

Subscribers can complete verification in person at carrier stores or remotely through official carrier websites and apps.

A Phased Rollout With Non-Negotiable Deadlines

Anatel's deadlines are firm:

• By September 2027: All new prepaid line activations require facial biometric verification.
• By December 31, 2027: All new postpaid line activations require facial biometric verification.
• By December 31, 2028: All existing subscribers not yet verified must be re-enrolled by their carriers.
• From January 2029: Lines belonging to users who have not completed facial validation will be suspended — and ultimately canceled.

The norm also requires carriers to establish alternative procedures for subscribers who cannot complete the biometric check, acknowledging that facial recognition is not universally accessible, particularly for the elderly, people with disabilities, or individuals whose faces recognition systems fail to match accurately. Critically, the norm makes no provision for users who refuse on privacy grounds — for them, the consequence is identical to missing the deadline: suspension of service.

The Fraud Problem Anatel Is Trying to Solve

The regulation was developed by Brazil's anti-fraud working group, the Subgrupo Técnico de Enfrentamento de Fraudes e Golpes (SGT-Fraudes), and approved by consensus within Anatel's Grupo Técnico de Suporte à Segurança Pública (GT-Seg) as a direct response to Brazil's chronic mobile fraud environment.

SIM-swap attacks — in which criminals convince carriers to transfer a victim's phone number to a SIM card under their control — give fraudsters access to SMS-based two-factor authentication, enabling bank-account drains, social-media takeovers, and identity impersonation. In Brazil, this is often paired with a scheme known locally as "Mão Fantasma" (Ghost Hand), in which attackers remotely take over a victim's smartphone after seizing their mobile number.

No official government statistics on SIM-swap incidence exist in Brazil; industry estimates suggest tens of thousands of Brazilians are affected annually. According to the FBI's 2021 Internet Crime Report, the United States recorded 1,611 SIM-swap complaints that year, with $68 million in associated losses — figures that provide scale context even though the U.S. mobile market is significantly smaller than Brazil's.

The deeper structural vulnerability the norm targets is the ease with which Brazilian mobile lines can be registered under false identities or in another person's name. By requiring a live biometric match before a line can be activated or retained, Anatel aims to close that registration loophole entirely.

Does Biometrics Actually Stop Mobile Fraud? The South Korea Data

Brazil is not acting in a vacuum. South Korea launched facial recognition as the primary verification method for new mobile subscriptions in July 2026, with civil rights groups immediately raising objections about consent and data breach risk. A coalition including Open Net Korea and four other organizations argued the mandate removes meaningful free consent from mobile users — and pointed to China's 2019 SIM facial recognition scheme as a cautionary example: that program was eventually abandoned after data leaks occurred without a demonstrable reduction in fraud, according to Open Net Korea's public statement.

The South Korean precedent is directly relevant because the SK Telecom breach in April 2025 — which exposed SIM-related data for approximately 27 million subscribers — was cited by Korean civil society as evidence that concentrating biometric data inside carrier infrastructure creates a large-value target for attackers. Brazil's GT-SEG.2026.11 creates a comparable concentration: auditable biometric verification records held across every Brazilian carrier's infrastructure, linked either to Serpro's government database or to private identity verification providers.

Critics of mandatory biometric SIM schemes also note a structural limit to the anti-fraud rationale: SIM swap is at least partly an authentication problem, not purely an identity problem. Biometric enrollment at the carrier level does not automatically reform the SMS-based 2FA systems that make phone number control so valuable to attackers.

The Infrastructure: Serpro's 376-Million-Face Registry

Much of Brazil's biometric matching infrastructure is already built. Serpro — the federal government's information technology company — operates AIBio, a facial biometric platform holding approximately 376 million face records drawn from driver's licenses (CNH), national identity cards (CIN), and voter registration data (TSE). The platform offers a Datavalid API that private companies — including carriers seeking compliance with GT-SEG.2026.11 — can integrate for government-backed 1:1 facial verification.

That infrastructure enables carriers to cross-reference a live subscriber scan against a government-held facial record rather than building or purchasing a private biometric database. It also means that compliance with the Anatel norm will, in practice, frequently route subscriber biometric data through a government platform whose behavioral biometrics capabilities are already expanding.

Privacy Collision: LGPD Classifies This Data as Highly Sensitive

Brazil's Lei Geral de Proteção de Dados (LGPD), enacted in 2018, explicitly classifies biometric data as sensitive personal data — in the same highest-protection tier as health records, religious beliefs, and racial or ethnic origin. Companies that mishandle biometric data face LGPD fines capped at R$50 million (roughly $9.3 million USD) per infraction, calculated as up to 2% of Brazilian revenue.

The LGPD was designed primarily around a consent-based framework. Mandatory biometric collection — where compliance is a condition of mobile service, not a genuine choice — makes meaningful consent legally questionable. Carriers processing biometric data under the Anatel norm will almost certainly invoke the LGPD's "regulatory obligation" legal basis for sensitive data processing (Article 11, II), which permits collection without consent when required by regulation. Critics may challenge whether this basis satisfies the LGPD's proportionality and necessity principles, given that the mandate applies to all 263 million subscribers as the mechanism to address fraud affecting tens of thousands annually.

The legal tension is sharpened by timing: ANPD opened a comprehensive public consultation on biometric data regulation in June 2025, gathering input on definitions, legal bases, facial recognition governance, and the rights of vulnerable groups. That framework has not yet been finalized. Anatel's norm has moved first.

How Documented System Failures Expose Existing Gaps

The civil rights concerns are not theoretical. A study by Coding Rights found that Brazil's existing government facial recognition infrastructure — used within the Serpro/INSS system — validates only 64.32% of attempts, meaning more than one in three verification attempts fails. Serpro's 93% similarity threshold means any significant change in a person's appearance — including gender transition — can drop a score below the matching threshold, effectively locking the person out of services.

Researchers Mariah Rafaela Silva (a sociologist) and Joana Varon of Coding Rights have documented higher false-negative rates for trans individuals and Black Brazilians, reflecting the well-established bias in facial recognition systems. The foundational bias research is equally stark: a 2018 study by Joy Buolamwini and Timnit Gebru found 34.7% error rates for dark-skinned women from the systems they tested, compared to as low as 0.8% for lighter-skinned men. Brazil, with one of the world's most racially diverse populations, is a particularly high-stakes environment for these documented disparities.

ARTICLE 19 Brazil, working with Idec, Intervozes, CADHu (the Human Rights Advocacy Collective), and the Public Defender's Office, previously succeeded in blocking São Paulo Metro facial recognition on grounds including LGPD violations, consumer protection violations, and constitutional concerns. That legal precedent is now available to civil society organizations that may challenge GT-SEG.2026.11. Raquel da Cruz Lima of ARTICLE 19 Brazil's Legal Center has argued that biometric data needs judicial protection as it "affects fundamental rights."

Carriers Face a Compliance Countdown — With MVNOs Most at Risk

For Brazil's major operators, GT-SEG.2026.11 means integrating certified liveness detection into every subscriber-facing channel — in-store and digital — building auditable logging systems covering every verification event across their entire subscriber base, and negotiating data-handling agreements with identity verification providers.

The requirement also extends to resellers and MVNOs, which often lack the resources, engineering staff, and vendor relationships of the major carriers. Acquiring PAD Level 2-certified liveness detection is not free; smaller operators will need to select and contract with a certified identity verification provider rather than build in-house — an operational and commercial challenge whose enforcement pathway at the MVNO tier Anatel has not yet publicly specified.

No public statements from Vivo, TIM, Claro, Oi, or the Brazilian MVNO ecosystem on compliance planning for GT-SEG.2026.11 were available at the time of publication; the norm was approved Wednesday.

What Is the World's Largest Unstated Risk?

Brazil's norm does not merely set a technical standard for fraud prevention. By compelling private carriers to enroll the biometric facial data of every mobile subscriber — matched against government databases or certified private platforms — it effectively creates a population-scale facial registry maintained by commercial actors under regulatory compulsion. That structure exists before ANPD has finalized the rules governing how such a registry must be protected, how long data may be retained, and under what conditions it must be deleted.

If the Anatel model is treated as a legal precedent, other Brazilian sectoral regulators — banking, healthcare, energy utilities — could invoke the same "regulatory obligation" legal basis to mandate their own biometric enrollment from their regulated populations, each bypassing ANPD's as-yet-unfinished framework until after the fact. That implication is not addressed in GT-SEG.2026.11.

Currency conversions are approximate and are based on the exchange rate at time of publication.

Frequently Asked Questions

What is ISO/IEC 30107-3 PAD Level 2, and why does it matter for Brazilian mobile users?

ISO/IEC 30107-3 is the international standard for testing how well a facial recognition system can detect fake presentations — photos, video replays, and synthetic faces used to trick the system. Level 2 is the middle of three tiers and tests resistance to sophisticated attacks including realistic silicone masks and high-definition video replays. By mandating PAD Level 2, Anatel is requiring carriers to use systems that have been independently certified by a NIST-accredited testing lab, not just basic selfie-based liveness checks. For Brazilian subscribers, this means the facial scan they submit to keep their line active will be processed by a more robust system than most consumer apps currently use — but it also means the data collected is technically more sophisticated and, in the event of a breach, more valuable to attackers.

Do I have to give my facial scan to my carrier to keep my phone number in Brazil?

Yes, under GT-SEG.2026.11, compliance is mandatory for all 263 million Brazilian mobile subscribers. Carriers must provide alternative procedures for people who physically cannot complete a biometric check — but the norm makes no exemption for subscribers who object on privacy grounds. Refusing means the same outcome as missing the deadline: suspension beginning January 2029, and eventual cancellation of the line. The phased deadlines mean existing subscribers have until December 31, 2028 to complete enrollment.

Does requiring a facial scan actually prevent SIM swap fraud?

The evidence is mixed. Biometric enrollment at the carrier level can close the loophole of fraudulent line registration under false identities — which is Anatel's stated rationale. But SIM swap is also an authentication problem: the reason phone-number control is so valuable to attackers is that so many online services still use SMS messages as their second authentication factor. Biometric verification at activation does not reform those downstream authentication systems. South Korea's July 2026 facial recognition requirement for mobile subscribers drew civil rights objections, and critics cited China's 2019 SIM facial recognition scheme — which was abandoned after data leaks occurred without a demonstrable reduction in fraud — as a cautionary precedent.

What happens to a subscriber's biometric data if Brazil's ANPD later rules the collection was not compliant with LGPD?

That is the core legal uncertainty the norm creates. ANPD opened a biometric data public consultation in June 2025 but has not yet published a final governance framework. If ANPD's forthcoming rules set retention limits, deletion timelines, or consent requirements that Anatel's norm did not anticipate, carriers will face the question of what to do with years of already-collected biometric verification records. The LGPD imposes fines up to R$50 million (roughly $9.3 million USD) per infraction for biometric data mishandling — but it does not currently specify what happens to data collected under a sectoral regulatory obligation that is later found to lack adequate privacy safeguards. Brazilian civil society organizations, including ARTICLE 19 Brazil and Idec, are expected to scrutinize the norm's legal basis.