The National Telecommunications Agency (ANATEL) published, On October 28, 2026, the Technical Standard GT-SEG.2026.11, which mandates facial recognition with proof of life for the registration of users of the Personal Mobile Service (SMP). For SMP providers, the measure will require new systems, a review of corporate contracts and customer service channels, as well as monthly reporting of metrics to ANATEL.
The Technical Standard was issued by Anatel’s Superintendence of Planning and Regulation and developed within the scope of the Technical Subgroup for Combating Fraud in the Telecommunications Sector (SGT-Fraudes), which is part of the Technical Group for Public Safety Support (GT-Seg). The standard’s objective is to combat fraud on mobile lines, ensure the accuracy of user registration data, and strengthen the security of mobile phone registrations, thereby making it more difficult to activate lines using false or third-party information.
This requirement applies to all SMP providers, regardless of the type of license, including accredited providers and mobile virtual network operators (MVNOs). The Original or Authorized Virtual Network Providers are fully liable for the actions of their Accredited Providers.
Registrations for individuals and individual microentrepreneurs (MEIs) must use biometric validation via facial recognition. Other legal entities are exempt from biometric requirements, but the contract must include an obligation to maintain up-to-date records and monitoring of the actual users of the access, as well as the possibility of immediate suspension in the event of use for illegal purposes.
The registration must contain, at a minimum, the following information:
- Individuals: valid CPF number, full name, ZIP code, address, and date of birth
- Foreign nationals: passport, full name, ZIP code, accommodation address, and date of birth
- Legal entity: CNPJ, business name, ZIP code, address, as well as the full name, CPF, and date of birth of the person responsible before the service provider
Validation will be required upon activation of new prepaid and postpaid accounts, during number portability or SIM card replacement, for any registration or contractual changes requested by the consumer, and when re-registering users in the database who have not yet been validated. Specific rules are provided for:
- Multiple accounts: If a single user has multiple accounts, the service provider may perform biometric validation only once, provided the user can identify any lines they do not recognize;
- Minors and legally incapacitated individuals: Activation and validation of access must be performed by the legal guardian, who will be considered the account holder;
- Power of attorney: exceptional admission, via a notarized document or a power of attorney signed through Gov.br, with biometric validation of the attorney-in-fact.
Technical Requirements of the Standard
The validation process consists of 6 (six) steps: civil identification, CPF validation, biometric capture, proof of life, comparison with the biometric database, and SIM/eSIM activation. Until registration and validation are complete, the chip will only allow interaction via voice, SMS, and data between the user and the service provider.
The main technical requirements are:
- Proof of life: in accordance with ISO/IEC 30107-3, PAD Level 2 or higher, using an active method (blinking, moving the head, reading a random phrase) or a passive method based on automatic analysis of biometric characteristics;
- Biometric databases: comparison with pre-existing government or private-sector databases, provided they were obtained using proof-of-life methods that meet the same standards established in the standard;
- Minimum architecture: facial capture module, liveness detection, biometric comparison, document scanning for identity verification, and a mechanism for detecting fraud and digital manipulation;
- Image quality: minimum resolution of 480p, with the face occupying between 50% (fifty percent) and 80% (eighty percent) of the image;
- Fraud detection: ability to identify photographs, pre-recorded videos, the use of two-dimensional and three-dimensional masks, deepfakes, and synthetic content generated by artificial intelligence.
If the biometric data cannot be validated, the user’s identity may be confirmed through document verification and comparison with the photo on the identification document (face match). If validation remains impossible, registration may be approved through in-person service, with a copy of the user’s document retained and a record kept of the person responsible for approving access.
Deadlines and Implementation Phases
- September 30, 2027: deadline for new prepaid line activations;
- December 31, 2027: deadline for new postpaid activations, number portability, SIM card replacements, and registration changes;
- December 31, 2028: deadline for re-registration of already active lines;
- January 1, 2029: Suspension of service provision for unvalidated accesses for 120 (one hundred twenty) days, with only number retention, contact with the provider, and emergency calls permitted;
- May 1, 2029: Cancellation of unvalidated lines if the user does not take action;
- June 1, 2029: Prohibition on the operation of access lines by individuals or MEIs without proper biometric validation.
Service providers must notify consumers via, at a minimum, SMS, WhatsApp, and the provider’s logged-in area every 5 (five) days, and daily when there are 5 (five) days remaining until the end of each deadline.
Impacts for Users and SMP Providers
For users, signing up for the service will now require facial biometric validation. Consumers who refuse validation after the deadlines will have their access revoked. Validation must be available at the providers’ own stores, accredited locations, and resellers, as well as on the providers’ official websites and apps.
For service providers, the regulation requires investments in contracting authentication providers and technologies. It also requires adjustments to corporate contracts, customer service workflows, and the reseller and authorized dealer network.
Noncompliance subjects the service provider and its representatives to penalties under telecommunications law. Registration data must be retained for 5 (five) years after the contract’s termination or until the conclusion of the follow-up process with Anatel. The service provider is liable for the actions of its accredited agents and must collaborate with MVNOs, while registrations made by power of attorney, without biometrics, or validated solely by a document will be subject to specific indicators and periodic review.
Providers are recommended to map out the user base requiring re-registration, select suppliers that comply with technical requirements, and review contracts with corporate clients, resellers, and accredited parties. It is also recommended to update the data protection impact assessment and structure the collection of indicators required by Anatel.
Our Digital Infrastructure and Telecommunications team remains available to answer questions regarding mandatory biometric validation and its regulatory implications.