In the first week of May 2026, Bahia's Public Security Secretariat (SSP-BA) announced that its public-space facial-recognition network had passed 5,310 fugitive arrests since 2019, including 863 in 2026 alone, with cameras now running in more than 80 municipalities. The state that pioneered police facial recognition in Brazil has become the model others copy. It has also become the clearest test of a question Brazil has spent seven years avoiding: who sets the rules when a surveillance system this powerful operates with no specific federal law governing it at all?
The case for Bahia's network is real
It would be dishonest to dismiss the program. The arrest curve is steep and consistent — 680 captures in 2023, 1,132 in 2024, 2,059 in 2025 — and SSP-BA Secretary Marcelo Werner frames it as intelligence-led policing deployed at Carnival, football matches, and other mass events where manual identification is hopeless. In a country where violent fugitives routinely evade capture for years, a tool that locates thousands of them is not a gimmick. Other states drew the obvious conclusion and built their own systems; by 2025 a national mapping study counted 376 active facial-recognition projects.
For a publication that backs innovation and effective state capacity, the instinct to defend Bahia is strong. The technology is not the problem. The absence of any rulebook around it is.
The same years produced documented harms
The May 2025 report Mapeando a Vigilância Biométrica, published jointly by the federal public defender (DPU) and the Center for Security and Citizenship Studies (CESeC), maps the other half of the ledger. Those 376 projects already expose roughly 83 million people — about 41% of Brazil's population — to biometric monitoring, on more than R$160 million in public spending. Bahia leads that spending at roughly R$66 million.
The accuracy record is where the case for guardrails becomes undeniable. CESeC documented 24 wrongful-identification cases between 2019 and April 2025, and found that more than half of facial-recognition-driven police stops it could review resulted in mistaken identifications. The burden is not evenly distributed: error rates for Black, Indigenous, and Asian faces run, per NIST testing the report cites, ten to a hundred times higher than for white faces, and in 2019 some 90% of those arrested through facial recognition in Brazil were Black. The case of João Antônio Trindade Bastos — a 23-year-old Black personal trainer wrongly flagged and aggressively searched at a stadium in Aracaju in April 2024 — is the human face of that statistic.
A 5,000-arrest success rate and a coin-flip error rate on stops are not contradictory claims. They describe the same system from two ends: a tool that genuinely finds wanted people while also subjecting innocent ones — disproportionately Black ones — to detention on a machine's say-so.
A vacuum that is filling itself
Brazil still has no statute governing facial recognition in public spaces. PL 2338/2023, the AI bill the Senate approved in December 2024 and sent to the Chamber of Deputies in 2025, borrows the EU's risk-tiered structure but, as drafted, neither bans nor squarely regulates law-enforcement biometrics — which is why the Rights in Network Coalition is pushing for an outright prohibition before the final votes. Meanwhile the national data-protection authority, the ANPD, has named biometric data and AI systems among its enforcement priorities for the 2026–2027 biennium under the LGPD.
That is the real story behind Bahia's milestone. Into the legislative vacuum, two non-legislative forces are rushing: state security secretariats deploying ever-wider camera networks, and a privacy regulator preparing to police them after the fact. Neither is a substitute for a clear national standard set in advance.
Proportionate rules beat both extremes
The abolitionist position — ban public facial recognition for policing outright — is the strongest civil-society argument, and its premise (a tool this error-prone and this racially skewed is incompatible with due process) deserves to be taken seriously rather than waved away. But a blanket ban throws away a genuinely effective capability and ignores that the documented harms trace to how these systems are run, not to their existence. The errors flow from missing match-confidence thresholds, no mandatory human verification before detention, opaque watchlists, and no audit trail — all of which are fixable by rule.
A proportionate federal framework would do what Bahia's success and CESeC's findings jointly demand:
- Mandate a human-in-the-loop: no detention on an algorithmic match alone, with an independent officer confirming identity before any stop.
- Set and publish accuracy floors: minimum match-confidence thresholds and demographically disaggregated error reporting, so a system failing on Black faces cannot keep running unexamined.
- Require transparency and redress: public registries of where cameras operate, retention limits, and a fast channel for the wrongly flagged to clear their records.
- Independent audits: periodic third-party testing tied to ANPD oversight, with deployment paused where systems fail.
None of this stops Bahia from catching fugitives. It stops Bahia — and the states copying it — from catching the wrong people in the dark. Brazil's lawmakers have a working example and a rigorous risk map sitting on the same desk. The evidence-based move is not to ban the model or to keep rubber-stamping it, but to give it the rules a tool of this reach should never have operated without.