Brazil's Data Protection Agency Faces Landmark Test on Kids and Facial Recognition

Brazil’s largest income transfer program, Bolsa Família (PBF), currently covers more than 20 million families and is often considered the largest in the world in terms of beneficiaries. In April alone, public spending reached R$12.8 billion. Eligibility criteria are currently based on family income, measured by R$218 per capita; mandatory registration in the Single Registry (CadÚnico); prenatal care monitoring; keeping children’s vaccination records up to date; and school attendance. Therefore, schools are a central venue for the allocation of welfare programs, and also a focus of increasing automated decision-making technologies.

Monitoring school attendance, especially, increasingly relies on artificial intelligence tools, specifically facial recognition. A considerable number of states have deployed the technology in their attendance checking systems, as recent studies show. More recent evidence was reported in March by Núcleo Jornalismo and at Tech Policy Press, especially about the state of Paraná, where facial recognition systems manufactured and rejected in Europe have been broadly used. The reporting has sparked a public civil action (ongoing) by the State Prosecutor's Office of Paraná (MPPR) against the state administration and the technology provider (Valid Soluções S. A).

The Public Prosecutor’s Office initially argued that the adoption of facial recognition to measure school attendance violates fundamental principles of the General Data Protection Law, such as purpose, transparency, and the necessity of the measure. According to the MPPR, "one of the violations of the purpose principle stemmed from the fact that the purposes of the biometric data processing were not explicitly stated or communicated to the data subjects," and that "despite the mention of 'school attendance' in the transcribed authorizations, it was not properly disclosed that attendance would be recorded via facial recognition, nor that the personal data used would consist of the students' facial biometrics."

As a result of the court’s proceedings, the Data Protection Agency (ANPD) was summoned as the regulatory authority, which has decided on the "immediate suspension of the processing of biometric data of children and adolescents of the public education system in the state of Paraná.” The decision is paradigmatic and marks a turning point regarding the protection of children’s personal data and also is a pathway to understanding the systemic risks of data processing regarding basic fundamental rights seen, for instance, in welfare programs such as the PBF, as discussed below.

The policy environment on child protection and facial recognition

Putting the pieces together, it becomes clear that the use of facial recognition on students is closely tied to the allocation of the country’s most important social benefit. Earlier this year, Bill No. 1.225/2026 was introduced in the Brazilian Congress, seeking to regulate “the use of facial recognition systems and other biometric technologies in basic education institutions.” Shortly afterward, the Ministry of Education (MEC) published the “Guidelines for the Responsible Use and Development of Artificial Intelligence in Education.” Both efforts come on the heels of the enactment of the Digital Statute of the Child and Adolescent (ECA Digital), another turning point for the protection of such a segment concerning the social media environment.

Although not legally binding, the “Guidelines” take a cautious approach and categorically state that “facial recognition systems in school environments are not recommended due to the risks associated with the exposure and processing of children’s personal data.” When linked to attendance monitoring:

In light of LGPD principles such as purpose, adequacy, necessity, security, and prevention, institutional policy should discourage the adoption of such systems in schools. It is therefore recommended to prioritize manual methods or conventional digital systems that do not involve the mass collection of biometric data (…) In this sense, AI policies in education should prioritize reducing disparities and ensuring that the benefits of these technologies reach the most vulnerable groups.

The Bill No. 1.1225/2026 seeks, among other provisions, the prohibition of automatic linking between attendance data generated by algorithms systems and granting process of social assistance benefits; if attendance is recorded through facial recognition without a review mechanism, the record is deemed invalid; and establishes that any implementation of facial recognition systems in basic education must be preceded by a data protection impact assessment, be auditable, and have its results submitted to oversight bodies such as the Data Protection Agency.

Therefore, the recent ANPD decision allows us to foresee what will likely be the position of the body concerning facial recognition in schools, which might have a nationwide effect. The decision, combined with the prosecutor's claim, is a landmark understanding for grounding the protection of personal data to social values as well as responsible and accountable innovation—and not questionable arguments about de-bureaucratization and administrative effectiveness.

Globally, discussions around facial recognition and injustices are almost a cliché. The technology is broadly known to be biased because the data trained for them to be developed are based on specific population segments (mostly white-male-cis people), without meaningful consent or clarification about their final uses, resulting in technologies “illegal by default.” Recently, for instance, following a complaint by the American Civil Liberties Union, the company Clearview AI was “permanently banned, nationwide, from making its faceprint database available to most businesses and other private entities.” The company was also fined by several European data protection authorities because of their illegal practices of data collection. Several other cases have shown that the accuracy of facial recognition technologies is considerably lower when identifying Black people, not rarely resulting in jail time for innocent people.

Back to school and beyond: the social reach of data protection

The case of Brazil is emblematic because the demographics of students in public school systems are normally from low-income families, and there is a high probability that such families are beneficiaries of welfare programs such as the PBF. As school attendance is a central criterion for having the benefit granted, and if the attendance system is based on facial recognition, children’s biometric data becomes one of the keys for low-income families to achieve basic needs such as housing, food, and education. Beyond evidencing a clear violation of children’s fundamental right to personal data protection (as the Brazilian Constitution guarantees), the case makes it clear that the reach of such a protection is increasingly interconnected with a holistic approach to other social, political, and economic rights.

Datafication is transforming traditional social justice claims. In this context, data justice is increasingly a political priority and has to be addressed in AI accountability frameworks, including digital literacy efforts and policy advocacy as traditional issues of material redistribution, recognition, and representation are now intertwined with new informational environments. A necessary balance must be aimed for, including vulnerable communities while ensuring fair technological systems, reliable data, enforceable rights, and well-tailored oversight institutions instead of solely relying on the agency of individuals exercising their rights. In other words, individual “consent” for personal data processing might be a fragile legal statute if it is assumed the societal dimension of data protection. As a result, AI accountability rules also don’t exist individually or as another category separate from “traditional” rights: they are contemporary preconditions of and intertwined with foundational elements of human dignity.