Brazil’s telecommunications regulator, Anatel, has made facial biometric validation mandatory for registering and keeping mobile phone lines active. Under the new rules, operators must confirm customers’ identities with facial recognition and a comparison against existing biometric databases, either government records or those held by private authentication providers.
Technical Norm GT-SEG.2026.11 was issued by Anatel’s Superintendence of Planning and Regulation. It was drafted by a technical subgroup on fraud and scams and approved by consensus within the agency’s public security working group, known as GT-Seg. The norm applies to every provider of Brazil’s personal mobile service, including mobile virtual network operators and credentialed resellers, with no exemption based on company size.
The requirement covers individual customers and individual microentrepreneurs, known as MEIs. Lines registered to other companies are exempt from biometric validation, but business customers must keep records of who actually uses each line, and contracts must allow service to be cut off immediately if a line is used for illegal purposes.
The facial check must include liveness detection that meets ISO/IEC 30107-3 at presentation attack detection level 2 or higher. Private biometric databases used for matching must also have been built with liveness checks at that level. The required system covers face capture, liveness detection, biometric comparison, document authenticity checks and detection of digital manipulation, including photos, pre-recorded video, masks, deepfakes, real-time video manipulation and AI-generated content.
Each verification must leave an auditable record with the date and time, whether the person was matched against an existing biometric database and which identity verification provider was used. If a face is captured but no database match is available, operators must authenticate an official document and compare its photo with the live image. Customers who still cannot be validated in person can be approved by store staff or the operator’s fraud team, with a copy of their document retained.
Validation must be offered in stores, on operators’ websites and in their official apps. Operators must apply it to new prepaid activations by September 30, 2027, and to new postpaid activations, number portability, SIM swaps and account changes by December 31, 2027. Existing customers who have not been validated must be re-registered by December 31, 2028. From January 2029, lines that remain unvalidated face a 120-day suspension, with emergency calls preserved, followed by cancellation.
Sources: TELETIME, TeleSíntese
–
By the ID Tech Editorial Team
