Anatel, Brazil's telecom regulator, has approved a rule making facial recognition validation mandatory for anyone who has or wants to activate a mobile phone line in the country. The rule, announced on Wednesday (28), applies to individuals and solo micro-entrepreneurs (MEI) and will roll out in stages. Existing customers must be re-registered by December 31, 2028; lines that are not regularized can be suspended from January 2029 and later cancelled.

According to the agency, the goal is to make it harder to activate lines with false data or someone else's identity. Think of your phone number as the key to your digital life: it is how banks and social networks send you verification codes. One of the most common frauds, SIM swap, works like an illegal copy of that key: the criminal convinces the carrier to transfer the victim's number to another chip and starts receiving their calls and codes. Biometrics adds one more lock to that process.

How the validation will work

The technical norm, labeled GT-SEG.2026.11, requires CPF (tax ID) validation, face capture and a so-called liveness check, a mechanism similar to banking apps that ask you to blink or turn your head, confirming there is a real person in front of the camera rather than a photo. The image will then be compared with an existing biometric database, either public or run by private vendors. The procedure must be available at in-person service points and on the carriers' official websites and apps, with alternatives for those who cannot complete it, such as in-person service or matching a selfie against the photo on an official document.

The timeline published by Anatel is as follows:

• September 30, 2027: deadline for biometrics to apply to new prepaid line activations;
• December 31, 2027: the requirement extends to new postpaid lines, number portability, chip replacement and customer-requested registration or contract changes;
• by December 31, 2028: carriers must re-register customers who have not yet been validated;
• from January 2029: lines without biometrics become subject to suspension. According to Tecnoblog, the suspension lasts 120 days and cancellation can occur from May 2029 if the user does not regularize the registration.

Why carriers embraced the idea

For phone companies, the rule formalizes something part of the industry already does out of self-interest. Since 2021, carriers have used so-called Digital ID, with selfie and document upload, when activating some prepaid lines, and Vivo already requests facial validation via link in certain service interactions, according to Tecnoblog. Fraudulent registrations cost carriers money, and Anatel had already imposed other barriers, such as SMS confirmation for number portability and the Anatel Protege tool. The norm also allows comparison with biometric databases from private vendors, which opens a market for identity verification companies. In return, the rule requires compliance with Brazil's General Data Protection Law (LGPD), limits data collection to what is necessary, bans irregular sharing with third parties and mandates auditable records of the checks.

What we still do not know: which public and private biometric databases will be used for comparison, how carriers will communicate and pay for the re-registration of millions of customers, and what the experience will be like for people who struggle with digital processes. The norm provides alternative paths, but the practical details will depend on each carrier.

For now, there is nothing to do: the deadlines only start running in 2027. When validation arrives, it should happen through your carrier's official channels, such as its app, website or a physical store. Be suspicious of links and messages asking for a selfie or a document photo outside those channels, because the new rule may also become bait for fake re-registration scams.