AI Regulation Tracker / Enforcement action

Brazil's ANPD Opens Enforcement Against 23 Football Clubs Over Stadium Facial Recognition

The national data authority found irregularities in how 23 clubs use facial recognition for ticket sales and stadium entry, and it is drafting binding biometric rules for a wider set of controllers. Any business running facial recognition in Brazil is now on notice.

By Anthony Guerriero · Reviewed by The Leveraged Years Editorial Desk · Published July 7, 2026 · Last updated July 7, 2026

Brazil's ANPD Opens Enforcement Against 23 Football Clubs Over Stadium Facial Recognition regulation briefing

The Leveraged Years AI Regulation Tracker

Regulatory Briefing

Bindingness: Regulatory Guidance
Scope: Brazil. Any controller using facial recognition or biometric identification, including stadiums, retail, residential buildings, and security operators. Immediate action targets 23 football clubs.
What Changed: The ANPD announced a coordinated enforcement action finding indications of irregularity in the use of facial recognition for ticket sales and stadium entry by 23 football clubs. It opened supervisory processes and issued a preventive measure requiring the clubs to publish adequate information about biometric registration and identification on their ticketing platforms within 20 business days. Separately, the ANPD is drafting binding biometric-processing rules following a public consultation.
Who This Affects: The 23 named clubs directly, and by signal every controller in Brazil that captures biometric data, from arenas and retailers to residential and corporate access-control operators.
Current Status: Pending Enforcement
Effective Date: Preventive measure requires compliance within 20 business days of notification. Final biometrics regulation expected during 2026 (number and date not yet published).
Primary Source: Autoridade Nacional de Proteção de Dados (ANPD), notice "ANPD fiscaliza uso de sistema de reconhecimento facial na venda de ingressos e na entrada de estádios por 23 clubes de futebol". URL: https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-fiscaliza-uso-de-sistema-de-reconhecimento-facial-na-venda-de-ingressos-e-na-entrada-de-estadios-por-23-clubes-de-futebol
Secondary Analysis: Convergência Digital and Data Privacy Brasil reporting on the ANPD action.
Workflow Impact: Controllers using biometrics in Brazil should treat point-of-collection disclosure, a documented legal basis, and heightened protection for minors' data as active enforcement priorities, not future ones.
Operational Next Step: Review your biometric-processing notices and impact assessments against the LGPD, and confirm exactly what each data subject is told before their face is scanned.
Last Verified: July 7, 2026

Brazil's national data protection authority has moved from policy to enforcement on facial recognition. The Autoridade Nacional de Proteção de Dados, known as the ANPD, announced a coordinated supervisory action against 23 football clubs over the biometric systems they use to sell tickets and admit fans to stadiums. The authority said it found indications of irregularity and ordered corrective steps on a fixed clock.

The list of clubs is a roll call of Brazil's top divisions, including Flamengo, Palmeiras, Corinthians rivals such as Santos, plus Grêmio, Internacional, Cruzeiro, Atlético Mineiro, Bahia, Fortaleza, and more. For a US reader, the signal matters more than the sport. When a national regulator names two dozen high-profile controllers at once, it is establishing a standard that every other controller is expected to read and apply.

What the ANPD found

According to the ANPD, the irregularities center on two duties under the Lei Geral de Proteção de Dados, Brazil's general data protection law. The first is transparency. The authority concluded that fans were not given adequate information about how their facial data would be captured, registered, and used when buying tickets or entering the gates. The second is the treatment of children's and adolescents' data, a category the LGPD singles out for special protection and best-interest analysis.

The 20-business-day clock

The ANPD did not wait for a full adjudication to act. It issued a preventive measure requiring the clubs to publish, within 20 business days, adequate information on their ticketing platforms about how biometric registration and identification work. Reporting on the action indicates the clubs were also asked to present data protection impact assessments and to justify how the processing of minors' biometric data serves the best interest of that group. The supervisory processes remain open, so this is a first step, not a closed case.

A national rule is coming

The stadium action sits inside a broader plan. The ANPD has treated facial recognition in publicly accessible spaces as an enforcement priority for its 2024 to 2025 cycle, and it is now drafting binding rules for biometric data more generally. That drafting followed a public participation process in which the authority received 1,594 contributions from 88 participants, with a public hearing held in December 2025 ahead of final work on the text. The specific regulation number and its publication date have not been confirmed and should not be assumed.

What this does not do yet

The enforcement action does not ban facial recognition at stadiums, and it does not by itself impose a fine. It flags irregularities, demands disclosure and documentation, and keeps the investigation open. The forthcoming regulation, once published, will set the durable duties. Until then, the operative standard is the LGPD as the ANPD is now applying it: tell people clearly what you are doing with their biometric data, hold a lawful basis, and give minors heightened protection.

The cross-border angle

For US firms, the contrast is instructive. In the United States, facial recognition and biometric rules are a state-by-state patchwork, anchored by Illinois' Biometric Information Privacy Act and a handful of city bans, with no single national enforcer. Brazil is building one national biometric rule under one authority that is already issuing measures against named controllers. A US company operating venues, retail, or access control in Brazil cannot rely on the fragmented US floor. It faces a coordinated regulator that expects point-of-collection transparency and documented safeguards, and that is willing to name the controllers under scrutiny publicly before the rulebook is even finished.

Frequently Asked Questions

What did the ANPD actually change or announce?

The ANPD opened a coordinated enforcement action against 23 football clubs for facial recognition used in ticket sales and stadium entry, citing transparency and children's-data failures under the LGPD, and issued a preventive measure giving the clubs 20 business days to publish adequate biometric-processing information on their ticketing platforms.

Who is affected beyond the football clubs?

Directly, the 23 named clubs. By signal, every controller in Brazil that uses facial recognition or biometric identification, including retailers, residential and commercial buildings, and security operators, because the ANPD has declared facial recognition in public spaces a priority and is drafting a national biometric rule.

Is facial recognition now banned at Brazilian stadiums?

No. The action does not ban the technology or impose a fine by itself. It requires disclosure, impact assessments, and justification for processing minors' data, and it keeps supervisory processes open while the ANPD finalizes broader rules.

When will the national biometric regulation take effect?

The ANPD is expected to issue binding biometric rules during 2026, following a public consultation that drew 1,594 contributions and a December 2025 hearing. The final regulation's number and effective date have not been published and should not be assumed.