Your Kid's School Is Scanning Their Face. No Law Says It Can.

More than 1,700 schools in the Brazilian state of Paraná are already scanning students' faces every day. Not as a test. Not as a pilot. Just... happening — with no law specifically written to allow it, limit it, or tell parents what happens when the system gets it wrong.

Brazil's Congress is now considering a formal legal framework — think of it as the rulebook — for when and how face-matching technology (software that compares your face to a database to figure out who you are) can be used in everyday public places. Roads. Schools. Transit. The places you and your kids actually move through every Tuesday.

"Legal basis" sounds like the world's most boring phrase. Bear with me. It is, in fact, the single most important thing in this story.

The Gap Between "We're Using It" and "We're Allowed To"

Here's the thing about technology: it doesn't wait for permission slips. An investigation by Pulitzer Center AI Fellows found that those 1,700-plus schools in Paraná are running face-scanning systems right now — and it was that investigation that pushed lawmakers to introduce Brazil's Bill 1225-2026 in the first place. The law is chasing the technology, not the other way around.

That's a pattern worth paying attention to, because it's not unique to Brazil.

What makes this particular moment interesting is what the proposed bill actually contains. It would ban fully automated decisions — meaning a computer cannot, on its own, flag someone as a threat or deny someone access based purely on a face match. A human has to be in the loop. It would also ban using face-matching on children without explicit permission from a guardian, ban systems that haven't been checked for accuracy, and block any setup that automatically connects a face match to someone's government benefits. This article is part of a series — start with Eu Deepfake Labeling Law Unlabeled Fakes Real Danger.

That last one. Think about that for a second. Someone is apparently worried enough about it to write it into law.

What Europe Already Figured Out (That Brazil Is Still Debating)

Here's a detail that should make you put your phone down for a second: some of the face-scanning systems running in Brazilian schools were built by European companies. The same systems — or close cousins of them — were blocked from use in European schools, because European law says children cannot meaningfully agree to have their biometric data (their face, essentially — the unique physical information about them) collected. Kids can't truly consent, so you can't collect.

Brazil, without equivalent rules, became the place those systems could go instead.

Investigate Europe documented this pattern explicitly — calling it "Blocked in Europe, Deployed Abroad." That's not a metaphor. That's a business strategy.

And Brazil's data protection authority — the body that's supposed to catch exactly this kind of thing — only started handing out real penalties in 2023. A few fines so far. The bill itself quietly acknowledges the agency has "still limited capacity for oversight." That is the most diplomatically worded way of saying: we know we're behind, and we're building the house while people are already living in it.

"Blocked in Europe, Deployed Abroad" — how European facial recognition systems are deployed in Brazil without equivalent safeguards. — Investigate Europe, investigative reporting on face-scanning in schools

The Part Nobody Talks About: What Happens When It's Wrong

Face-matching systems make mistakes. Not rarely — more often than you'd expect, and more often with certain faces than others. Studies have consistently found these systems perform worse on darker-skinned faces, on women, and on children. This is documented, not disputed. Previously in this series: Your Face Just Became 512 Numbers And The Store Doesnt Need .

So imagine the scenario: a school's system flags the wrong kid. Or a road camera misidentifies a driver. Or a transit system flags you as someone you are absolutely not. Under the current no-rules situation in Brazil, what do you do? Who do you call? How do you challenge it?

The answer is: there isn't a clear answer. And that's exactly what a legal framework is supposed to fix.

Look, nobody's saying face-matching has no legitimate uses. Security at school entrances, tracking unauthorized access to campus grounds — these are real concerns that real parents have. The bill recognizes what it calls "the legitimate interest in modernizing school management." That's fair. The question is never really whether to use a tool. It's what happens when the tool is wrong, and whether anyone is accountable when it is.

What "Good Rules" Actually Look Like

For comparison: U.S. states have been wrestling with this same question, and the better frameworks have a few things in common. According to TechPolicy Press, state-level laws that actually protect people tend to require clear notice — you should know a system is in use — and they require a human to review any match before action is taken. No computer alone deciding anything consequential.

Brazil's proposed bill hits those marks on paper. Human review required. Parental consent for children. Accurate, regularly audited systems only. A prohibition on using face matches to automatically affect government benefits.

The harder question — and this is where most laws quietly fall apart — is enforcement. Brazil's data protection authority acknowledged its own limited oversight capacity in the bill's text. Writing good rules and actually enforcing them are very different things, and right now Brazil has a lot more of the former than the latter. Up next: That Voice On The Phone Sounds Exactly Like Your Mom It Isnt.

The Center for Strategic and International Studies has noted that across jurisdictions, the weakest link in facial recognition governance is almost never the initial rule — it's the audit trail (the documented record of every time the system was used, and what happened next). Without that paper trail, even a good law becomes unenforceable. You can't prove a system was misused if nobody was required to log how it was used in the first place.

If you've ever wondered whether a photo or a digital profile actually matches the real person — whether someone is really who they claim to be — that's the exact problem this technology was built to solve. The catch is that solving it responsibly requires guardrails that are just as carefully built as the technology itself. One useful thing you can do right now, wherever you live: ask your kid's school, your employer, or your local transit authority whether face-scanning is in use, what data is kept, and how long it's stored. Most organizations are legally required to tell you. Many are surprised anyone asks.

Brazil's debate is not abstract. It's a country of 215 million people deciding, right now, whether "we're using it" and "we're allowed to use it" will ever mean the same thing — and whether ordinary people will have any real say when they don't.

Here is what stays with me about the Paraná number. Over 1,700 schools. Already scanning. Before the law. The bill is being written after the technology moved in, not before. That means the strongest argument for getting the rules right isn't idealistic — it's practical. The systems are already there. The only question left is whether the people those systems scan will have any power over what happens next.

So: where would you actually be okay with your face being used as your ID — schools, roads, airports — and only if you were clearly told about it first? Or nowhere at all?