Brazil's telecom regulator Anatel has published Technical Norm GT-SEG.2026.11, which makes facial-biometric verification mandatory for mobile lines. Operators must confirm identity by face match against a government or private biometric database, with liveness detection meeting ISO/IEC 30107-3 presentation-attack detection level 2 or higher, according to ID Tech's October 28, 2026 report. It follows the biometric SIM-registration wave in Indonesia, India and Vietnam. It matters to US readers for two reasons: it is a template that other governments will cite, and US and global verification vendors will compete to supply it.
The strongest case for the mandate
The regulator's motive is real. Anatel drafted the norm through a fraud-and-scams subgroup, and the problem it targets is familiar: lines registered with stolen or invented identities are the raw material for phishing, social-engineering and account-takeover schemes. A liveness-checked face match is much harder to fake than a typed tax number. Level 2 presentation-attack testing is a serious standard, not a checkbox. If the goal is to make bulk anonymous line registration expensive, biometrics are a credible tool, and Anatel has not simply banned anything.
What the norm requires
Per ID Tech, new prepaid activations must comply by September 30, 2027. New postpaid activations, number portability, SIM swaps and account changes follow by December 31, 2027. Existing customers must be re-registered by December 31, 2028. From January 2029, lines that remain unvalidated face a 120-day suspension with emergency calls preserved, then cancellation. Lines registered to companies are exempt, but business customers must keep records of who actually uses each line.
That last clause shows the design logic. The goal is not just to verify a purchaser once but to bind a durable, accountable human identity to every number. This is the step that moves a fraud control toward an identity registry.
Where the tradeoffs bite
First, the data. Brazil's data-protection statute, Lei 13.709/2018 (LGPD), classifies biometric data linked to a person as sensitive personal data, and it contains a basis for processing such data to prevent fraud and secure authentication in electronic registration systems. That basis is likely what makes the mandate lawful. But a lawful basis for collection is not a limit on retention, secondary use or breach exposure. Letting verification run through either a state database or a private provider creates a large biometric honeypot, and a face, unlike a password, cannot be rotated after a leak.
Second, access. A re-registration deadline for every existing line means that anyone without a smartphone camera, a document, or a clean database match is pushed toward suspension. People in precarious circumstances are the most exposed to being cut off, which is a speech and access cost as much as a privacy one. The norm's document-comparison fallback for failed database matches helps, but it adds friction at exactly the point where vulnerable users drop out.
Third, function creep. A phone number tied to a verified face is also a convenient tracking key. The risk is not hypothetical in the US. EFF reported on November 3, 2026 that records released under FOIA show the Postal Service's internet Covert Operations Program routinely sifted social media posts about protests, with very few disclosed internal rules. The lesson is not that Brazil will behave the same way. It is that identity infrastructure built for fraud control tends to be used for other purposes when oversight is thin.
What the US does instead
The US has avoided a national identity-to-number registry. Its main approach to this class of fraud is account protection. The FCC's November 2023 order, FCC 23-95, requires wireless providers to authenticate customers securely before moving a number to a new device or carrier, to notify customers of SIM-change and port-out requests, and to offer an account lock. It sets a uniform floor but lets providers choose the authentication method. This targets the actual attack, which is hijacking an existing number, without creating a registry of every subscriber's face.
That approach is not perfect. It does little to stop fraudsters buying fresh prepaid lines in bulk, and that is the gap Brazil is trying to close. A proportionate US-style answer would be narrower: stronger know-your-customer checks on high-volume reseller and bulk-activation channels, rate limits on activations per buyer, and risk-based step-up verification rather than a universal biometric gate.
Recommendations
For Brazilian policymakers, the norm can still be improved before the 2027 deadlines. Anatel should publish retention and deletion limits for biometric templates, forbid operators from reusing them for marketing or credit scoring, require independent audits of private verification providers, and set a clear, no-penalty offline path for people who cannot complete a face match.
For US vendors and policymakers, the practical point is procurement. Companies selling liveness and face-matching to foreign telcos should adopt data-minimisation defaults, such as storing a one-way template rather than the raw image, and should be transparent about government access requests. US lawmakers weighing similar proposals at home should require the same evidence Brazil should have to show: that the mandate reduces fraud by more than targeted controls would, at lower cost to privacy and access.
The bottom line
Anatel is responding to a genuine fraud problem, and its technical bar is high. But a mandatory face-to-number link for every mobile subscriber is a blunt instrument whose costs fall on privacy, access and long-term data security. The better path is the narrower one: authenticate the account holder where fraud happens, tighten bulk-activation channels, and keep a biometric database out of the telecom stack unless the evidence shows no lesser tool works.