Brazil Enrolled a Million Schoolchildren in a Facial Recognition System Without Their Consent

What happened

The state of Paraná in southern Brazil installed a facial recognition system across more than 1,700 public schools to automate student attendance. By the time legal challenges and international criticism caught up with the program, it had enrolled the biometric data of nearly one million minors, none of whom, or whose guardians, had meaningfully consented to having their faces processed by a government database.

The system was built by Celepar, Paraná's state technology agency, working with the companies Innovatrics and Valid. Its stated purpose was practical: scan students on arrival, match their faces against enrolled records, and mark them present without teachers calling roll. The efficiency case was real. The legal foundation was contested. Brazilian law requires explicit, informed consent before collecting biometric data from children, and critics argued the state had substituted administrative convenience for legal compliance rather than making the harder case that the deployment actually met that standard.

The backlash reached beyond Brazil. International coverage raised questions about whether technology developed by companies operating under European data protection frameworks was being deployed to populations in jurisdictions where comparable protections are weaker or more slowly enforced. That pattern, where a surveillance tool that would face significant legal friction at home gets exported to a lower-scrutiny environment, is a documented risk in the governance of biometric systems, and Paraná's school program became a pointed example cited alongside similar deployments in Sweden and France that regulators also moved to shut down.

The incident record flags accuracy and reliability as concerns alongside the consent failures. A facial recognition system running with uncertain error rates does real damage in a school context. A false non-match marks a present child absent. A false match ties a child's face to the wrong identity record. Neither the error rate nor the oversight mechanism for correcting those mistakes appears to have been made publicly verifiable before the system expanded to more than 1,700 schools and nearly one million enrolled faces.

That is where the accountability gap sits most clearly. The enrollment happened through an administrative contract, not a public deliberation, and there was no mechanism requiring the government to produce a provable record of what the system did with each scan, how often it erred, and who reviewed the outputs. When a government cannot be compelled to show its work on a system of that scale touching children's biometric data, the students who passed through those school gates have no reliable way to know what decisions the system made about them, or whether those decisions were ever correct.

Reported impact

Affected parties

Not publicly disclosed

Harm type

Not publicly disclosed

Scale

Not publicly disclosed

Financial impact

Not publicly disclosed

Regulatory action

Not publicly disclosed

Classification

Organization

Not publicly disclosed

AI system

Not publicly disclosed

Industry

Not publicly disclosed

Country

Not publicly disclosed

Provider

Not publicly disclosed

Incident type

Not publicly disclosed

Relevant governance controls

Governance control mapping is not available for this record.

• No controls mappedNot publicly disclosed

Control mapping is analytical. It does not state that any control would have prevented the incident.

Sources and evidence

This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.