Part of the AI Regulation News hub.
Portugal enacts Lei n.º 59/2026, inserting Artigo 19.º-A into the TVDE law and prohibiting facial recognition, biometric identification, emotion detection and automated behavioural analysis of in-car video from 1 September 2026
The prohibition is unusually specific: facial recognition, biometric identification, emotion detection and automated behavioural analysis, named in one paragraph, and then closed with a catch-all covering any other form of extracting biometric or behavioural characteristics. The enforcement position is more unusual still. Artigo 19.º-A appears nowhere in the TVDE administrative-fine schedule, and of the nine articles this law inserted, only one was given a fine.
Bottom line: A binding statute, published in Diario da Republica n.º 164/2026, Serie I, on 25 August 2026 and in force on 1 September 2026. It amends the TVDE law, Lei n.º 45/2018, which governs individual paid passenger transport in unmarked vehicles booked through an electronic platform.
Who this affects: TVDE platform operators in Portugal, TVDE fleet operators, drivers, and the data-protection and compliance functions that sit behind them. Also anyone building in-vehicle camera or driver-monitoring products for the Portuguese market.
Date of legal event: The law's own date is 25 August 2026. It enters into force on the first day of the month following publication, which is 1 September 2026. That commencement rule is in Artigo 7.º of Lei 59/2026 itself.
What Artigo 19.º-A requires: In-car video is off by default and operates only on the express acceptance of both passenger and driver. Sound capture, recording and processing are prohibited outright, so it is image only. Footage is encrypted and inaccessible to the platform, the operator, the driver and the user, subject to a lawful-access exception for a judicial authority, criminal police body or competent administrative authority. It is deleted automatically by 30 days, unless a reported incident or a reasoned request from a competent authority justifies retention for the strictly necessary period.
The enforcement gap: Artigo 19.º-A is not referenced in Artigo 25.º(2), the schedule of contraordenacoes. The schedule is a closed list of 32 items citing 17 articles, and Artigo 19.º itself is in it. So the omission is specific to the new article, not a gap in retrieval.
Primary sources: Lei n.º 59/2026, de 25 de agosto, Diario da Republica · Lei n.º 45/2018, the TVDE law being amended
- Instrument
- Lei n.º 59/2026, de 25 de agosto
- Publication
- Diario da Republica n.º 164/2026, Serie I, de 2026-08-25
- Authority
- Assembleia da Republica, Portugal
- Jurisdiction
- Portugal
- Date of legal event
- 25 August 2026 (the law's own date, on its face)
- Entry into force
- 1 September 2026, under Artigo 7.º: a presente lei entra em vigor no primeiro dia do mes seguinte ao da sua publicacao
- Status
- Enacted and in force from 1 September 2026
- Bindingness
- Binding primary legislation (lei)
- What it amends
- Lei n.º 45/2018, the TVDE regime. Artigo 3.º of Lei 59/2026 inserts Artigo 19.º-A
- Acceptance model
- Opt-in. Artigo 19.º-A n.º 2: the system encontra-se desligada por defeito, off by default, and operates mediante aceitacao expressa de ambos, on the express acceptance of both, after prescribed prior information and for a specific trip. The statute says acceptance, aceitacao, not consentimento
- Audio
- Prohibited. n.º 3: sendo proibida a captacao, gravacao ou tratamento de som
- Access
- n.º 7: footage is encrypted and inaccessible to the platform manager, TVDE operator, driver and user, subject to lawful access by a judicial authority, criminal police body or competent administrative authority where legally necessary to investigate or appraise a relevant incident
- Retention
- n.º 9: automatic deletion by 30 days, unless there is a reported incident or a reasoned request from a competent authority, in which case retention is permitted for the strictly necessary period
- Prohibited processing
- n.º 11: facial recognition, biometric identification, emotion detection and automated behavioural analysis, followed by a catch-all, ou qualquer outra forma de extracao de caracteristicas biometricas ou comportamentais de utilizadores ou motoristas, so the four are examples and not a closed list. n.º 10 separately prohibits use for labour control, performance appraisal, commercial assessment, price-setting, profiling of users or drivers, and advertising
- Administrative fine
- None. Artigo 19.º-A is not cited in the Artigo 25.º(2) schedule of contraordenacoes
- Residual enforcement
- n.º 13 preserves the sanctioning regimes in applicable legislation on personal data protection, information security and other special regimes. It names no specific authority or instrument
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://diariodarepublica.pt/dr/detalhe/lei/59-2026-1161801432
What the new article actually does
Artigo 3.º of Lei 59/2026 inserts Artigo 19.º-A into the TVDE law. The architecture is stricter than most in-vehicle camera rules in Europe, and it is worth reading in the order the paragraphs fall.
The system is off by default. Paragraph 2 uses the phrase desligada por defeito and operates mediante aceitacao expressa de ambos, on the express acceptance of both the passenger and the driver, after prescribed prior information and for a specific trip. Neither party can switch it on over the objection of the other. Note the statute says acceptance, aceitacao, rather than consentimento, so do not import the data-protection concept of consent without checking it.
It is image only. Paragraph 3 prohibits the capture, recording and processing of sound, so this is not a dashcam regime with audio attached.
Paragraph 7 puts the footage beyond ordinary reach: encrypted and inaccessible to the platform manager, the TVDE operator, the driver and the user. That is a wider exclusion list than a typical data-minimisation clause, because it locks out the driver and the passenger as well as the company. It is not absolute: the same paragraph permits access by a judicial authority, a criminal police body or a competent administrative authority where legally necessary to investigate or appraise a relevant incident.
Paragraph 9 sets retention at a maximum of 30 days with automatic deletion, save where a reported incident or a reasoned request from a competent authority justifies keeping the footage for the strictly necessary period.
The prohibition paragraph, and the one next to it
Paragraph 11 is the clause worth quoting in full when advising a client. It prohibits processing the images for facial recognition, biometric identification, emotion detection and automated behavioural analysis, and then adds ou qualquer outra forma de extracao de caracteristicas biometricas ou comportamentais de utilizadores ou motoristas, any other form of extracting biometric or behavioural characteristics of users or drivers. Four categories named individually in a national statute about ride-hailing, and then an open-ended residual clause. Do not read the four as a closed list.
Paragraph 10 sits immediately above it and is easy to miss. It prohibits using the captured images for labour control, performance appraisal, commercial assessment, price-setting, profiling of users or drivers, and advertising. So the statute separates what the images may not be analysed with, in paragraph 11, from what they may not be used for, in paragraph 10.
Read together, they close the two routes by which in-car footage would ordinarily become commercially useful. A platform cannot run biometric or emotion analysis on it, and cannot use it to rate a driver or set a price.
The enforcement gap, and why it looks deliberate rather than accidental
Artigo 25.º(2) of the TVDE law is the schedule of contraordenacoes, the administrative offences that carry fines. It is a closed list: its chapeau introduces as seguintes infracoes and it runs to 32 items, from alinea a) to ff), citing 17 different articles.
Artigo 19.º-A is not in it. The string appears only three times in the whole law, in the insertion instruction in Artigo 3.º and in the two article headings.
The absence is testable rather than assumed, because Artigo 19.º itself is in the schedule, at alineas w), x) and z). A search that can find Artigo 19.º in Artigo 25.º(2) and cannot find Artigo 19.º-A is not failing to retrieve. The final item, alinea ff), is not a catch-all either; it covers Artigo 20.º-A paragraphs 5 to 7, a fiscal provision.
The strongest indication that this is a drafting choice rather than an oversight: Lei 59/2026 inserted nine articles into the TVDE law, and exactly one of them, Artigo 20.º-A, was added to the fine schedule. The legislature updated Artigo 25.º when it intended to.
The gap propagates. Artigo 25.º-A, on competence to process these offences, and Artigo 25.º-B, on imputability, both work by mapping the alineas of Artigo 25.º(2). An article that is not in the schedule does not acquire an enforcing authority through either.
Where enforcement does and does not go
Paragraph 13 of Artigo 19.º-A preserves the sanctioning regimes provided in applicable legislation on personal data protection, information security and other special regimes. That is a genuine saving clause, and it is the answer to anyone concluding the prohibition is unenforceable.
But be precise about what it says. It names no authority and no instrument. The CNPD is not named in it. The GDPR is not named in it. Regulation (EU) 2016/679 does not appear anywhere in the law, and neither does the phrase inteligencia artificial. Any report that has paragraph 13 pointing at the EU AI Act is reading something that is not there.
The CNPD does appear elsewhere. Artigo 24.º h) makes it one of the supervisory bodies for the TVDE regime. It is not, however, among the entities empowered to process contraordenacoes and apply fines under Artigo 25.º-A, which lists IMT, AMT, ACT, AT and ISS. Inside the four corners of the TVDE law, the CNPD can supervise but cannot fine.
So potential enforcement for a paragraph 11 breach may arise under applicable data-protection, information-security or other special sanctioning regimes. Paragraph 13 does not identify the authority or the instrument, and we are not asserting a specific route it does not name.
A commencement date other coverage has wrong
The entry into force is 1 September 2026, and it comes from Artigo 7.º of Lei 59/2026: the law enters into force on the first day of the month following its publication. Published 25 August, in force 1 September.
Some English-language coverage gives 1 November. The likely source of that error is identifiable. Lei 59/2026 republishes the amended TVDE law as an annex, and Artigo 33.º of that republished annex carries the original commencement rule from 2018, which runs to the first day of the third month following publication. Applied to an August publication date that produces 1 November.
If you are diarising this, the operative provision is Artigo 7.º of the amending law, not Artigo 33.º of the annex it republishes.
For a platform operating in Portugal the compliance date is 1 September 2026, from Artigo 7.º of Lei 59/2026, not the 1 November some coverage reports. In-car video must be off by default, image only, subject to the express acceptance of both passenger and driver, encrypted beyond the reach of the platform and the driver alike, and deleted at 30 days. Paragraph 11 names facial recognition, biometric identification, emotion detection and automated behavioural analysis individually and then closes with a catch-all for any other extraction of biometric or behavioural characteristics, and paragraph 10 separately bars using the footage for labour control, performance appraisal, price-setting or profiling. Do not, however, plan around a TVDE fine: Artigo 19.º-A is absent from the Artigo 25.º(2) schedule, and inside this statute the CNPD supervises but cannot impose one. Exposure may instead arise under the data-protection, information-security or other special regimes that paragraph 13 preserves without naming.
Source File
https://diariodarepublica.pt/dr/detalhe/lei/59-2026-1161801432
Open Lei n.º 59/2026 at diariodarepublica.pt and confirm the header reads Lei n.º 59/2026 de 25 de agosto and Diario da Republica n.º 164/2026, Serie I. Read Artigo 7.º and confirm the commencement formula, no primeiro dia do mes seguinte ao da sua publicacao. Then read Artigo 3.º, which inserts Artigo 19.º-A, and check paragraphs 2, 3, 7, 9, 10, 11 and 13 against the summary above. Finally open Artigo 25.º(2) and search it for 19.º-A: you should find Artigo 19.º at alineas w), x) and z) and no reference to 19.º-A anywhere in the schedule. Note that a plain curl of diariodarepublica.pt returns an identical 2,346-byte shell for any URL, valid or not, so use a JavaScript-rendering fetch.
É proibido o tratamento das imagens para efeitos de reconhecimento facial, identificação biométrica, deteção de emoções, análise comportamental automatizada ou qualquer outra forma de extração de características biométricas ou comportamentais de utilizadores ou motoristas. - Lei n.º 59/2026, de 25 de agosto, Artigo 19.º-A, n.º 11 (translated: the processing of images for the purposes of facial recognition, biometric identification, emotion detection or automated behavioural analysis is prohibited)
FAQ
When does Lei 59/2026 take effect?
1 September 2026. Artigo 7.º of the law provides that it enters into force on the first day of the month following its publication, and it was published on 25 August 2026. Coverage giving 1 November appears to be reading Artigo 33.º of the republished TVDE annex, which carries the older third-month rule from Lei 45/2018.
Does the law ban in-car cameras in Portuguese ride-hailing vehicles?
No. It permits video subject to conditions. Artigo 19.º-A requires the system to be off by default with the express consent of both passenger and driver, prohibits sound entirely, requires encryption that excludes the platform, operator, driver and user, and requires deletion after 30 days.
What exactly is prohibited by paragraph 11?
Processing the images for facial recognition, biometric identification, emotion detection and automated behavioural analysis, and then any other form of extracting biometric or behavioural characteristics of users or drivers. The four named categories are examples, not a closed list. Paragraph 10 separately prohibits using the images for labour control, performance appraisal, commercial assessment, price-setting, profiling of users or drivers, and advertising.
What is the fine for breaching the prohibition?
There is no TVDE fine. Artigo 19.º-A is not cited in Artigo 25.º(2), the schedule of administrative offences, which is a closed list of 32 items covering 17 articles. Of the nine articles this law inserted, only Artigo 20.º-A was added to that schedule.
So is the prohibition unenforceable?
Not unenforceable, but not enforceable through the TVDE statute. Paragraph 13 of Artigo 19.º-A preserves the sanctioning regimes in applicable legislation on personal data protection, information security and other special regimes. It names no authority and no instrument, so any specific route is inference rather than something the statute states.
Can the CNPD impose a fine under this law?
Not under the TVDE law. The CNPD is listed as a supervisory body in Artigo 24.º h), but Artigo 25.º-A, which sets out competence to process these offences and apply fines, lists IMT, AMT, ACT, AT and ISS. The CNPD's fining powers come from data-protection law, not from this statute.
Does the law mention the EU AI Act?
No. The phrase inteligencia artificial does not appear in Lei 59/2026, and neither Regulation (EU) 2016/679 nor the AI Act is cited anywhere in it, including in paragraph 13.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.