Facial Recognition Rejected In Europe Is Monitoring Brazil’s Schoolchildren

As Europe tries to restrict AI technologies at home, systems developed on the continent are being rolled out overseas. Reporting by Investigate Europe, published in partnership with Tech Policy Press, tracks how Europe-made biometric software has embedded itself into Brazil’s education sector — with potential consequences far beyond the classroom.

This story was supported by the Pulitzer Center’s AI Accountability Network.

At Colégio Estadual Professor Loureiro Fernandes, a public high school in the southern Brazilian state of Paraná, a class begins like any other. The teacher opens an app on their phone, holds it up, and takes several photos of the room. Within seconds, the images travel to a cloud server, where a facial-recognition algorithm detects each student’s face, extracts it, and compares it against a database of biometric profiles. The app LRCO Paraná returns a list of names. Students identified in the photos are marked present; those that the system does not find are marked absent.

This facial recognition software was built to identify close to 1 million children in Paraná each day. Since 2023, the technology has been deployed in more than 1,700 schools across the state, replacing the traditional roll call with an automated identification system rendered in moments.

But the system can make mistakes. Ingrid Adam, a guidance counselor at the school, says she has learned to expect them. One morning, a student who had been sitting in class discovered that, in her Escola Paraná student app, she had been marked absent. When Adam raised the issue with the teacher, his response was familiar. “I’m not marking her absent,” Adam recalled him saying. “I’m using the camera roll call, and it said everything was okay.” If a student discovers a mistake, they are able to correct the record with the instructor. Until then, the system’s judgment stands.

For some students, a false absence is a bureaucratic irritation. For others, it could threaten their family’s access to welfare. In Brazil, eligibility for the Bolsa Família program depends in part on school attendance, and in Paraná, such records are now largely generated by an algorithm.

The recognition technology that makes this possible was developed in Europe by a Slovak company called Innovatrics. While not outright prohibited in the European Union, comparable uses of facial recognition in schools have been blocked by courts and authorities in multiple instances, who ruled that children cannot meaningfully consent to biometric surveillance in the classroom under the EU’s GDPR data protection rules. But in Brazil, where the data protection authority only began issuing sanctions in 2023 and has handed down just a handful of penalties to date, similar software can now scan hundreds of thousands of children each day. Privacy advocates call it regulatory arbitrage: European companies exporting the kind of surveillance tools that regional regulators have deemed too invasive for use on children. In April 2025, public prosecutor Marcos José Porto Soares in Paraná filed the first legal challenge, arguing the system violates Brazilian law. The case is still pending. Meanwhile, the technology is spreading to other Brazilian states such as Rio de Janeiro and São Paulo, and even back toward Europe.

Pushback in Europe

In August 2019, the Swedish Data Protection Authority imposed a fine on the school board of Skellefteå, a small town in northern Sweden. A local high school had piloted an attendance system that used facial recognition software, developed by a Finnish IT company, to register 22 students over three weeks, the same basic premise now operating at scale in Brazil.

The Swedish authority ruled that the experiment violated the GDPR. Attendance monitoring via facial recognition, the regulator found, was disproportionate and excessively intrusive. “Attendance monitoring can be carried out in other ways which involve less infringement of the students’ integrity,” the decision stated. At the heart of the ruling was the question of consent. The authority emphasised that schoolchildren cannot freely agree to surveillance technologies in the classroom. “The relationship between the Board and students will generally be one of considerable imbalance,” the regulator noted, describing attendance monitoring as “a unilateral control measure where this inequality exists.”

A few months later, in February 2020, an administrative court in Marseille reached a similar conclusion. The court halted two pilot projects that would have installed facial-recognition access systems at high schools in Nice and Marseille.

The judges struck down the experiment on multiple grounds. The regional government, they found, lacked the legal authority to implement such a system. The consent obtained from students was invalid, given the inherent power imbalance between schools and minors. The government had failed to demonstrate that facial recognition was necessary or served a substantial public interest. And the biometric system was manifestly disproportionate, the court held, given that less intrusive alternatives, such as badge-based entry, were readily available.

The European Union has since moved to regulate the use of facial recognition and other related technologies, with the introduction of its landmark Artificial Intelligence Act in 2024. While not outright prohibited, the deployment of such systems in schools is strictly regulated, though attendance registration tools are not explicitly labelled high risk. The legislation does not extend to monitoring the export of the technologies beyond Europe’s borders.

A different path in Brazil

Across the Atlantic, officials have embraced the use of these systems, seeing them as drivers for development and efficiency.

Paraná is Brazil’s fifth most populous state, home to nearly 12 million people spread across agricultural plains, industrial cities, and the sprawling capital of Curitiba. Its public school system serves more than one million students. In 2019, Renato Feder assumed control of the state’s education department. A tech entrepreneur by background, Feder arrived with a clearly articulated vision, one he had laid out years earlier in his book Carregando o Elefante. Brazil’s education system, he wrote, was crippled by “mismanagement and unbelievable waste on foolish projects, inefficiency, bloated administrative staff, and corruption.”

Feder had built a reputation as a reform-minded executive, having helped transform the small electronics company Multilaser into one of Brazil’s largest IT firms. In education, he sought to apply a similar logic: standardisation, measurability, and the pervasive use of digital tools. “Technology is here to stay, to enhance the content taught in the classroom,” Feder said after taking office. Under his leadership, Paraná’s education system was digitized across the curriculum.

Between 2021 and 2024, the state spent more than R$153 million (€25 million) on private educational platforms, according to a study by researchers at the Federal University of Paraná. Google Classroom became the state’s digital learning environment. The Swiss company EF Education First provided English instruction through a platform called Inglês Paraná. The Australian company Matific built a mathematics platform. And the US company Quizizz, now renamed Wayground, supplied a quiz-based learning tool.

The education secretariat did not stop at digitizing lesson plans and homework assignments. It also set out to digitise something more fundamental: determining which students were in the classroom, and which were not. The stated justification was not a dropout crisis or failing attendance rates, but administrative efficiency. Citing an OECD study showing that Brazilian teachers spent a third of each lesson on non-teaching tasks, the state argued that automating attendance would recover lost instructional time.

In September 2022, Paraná’s state-owned IT company, Celepar, signed a contract with the Brazilian firm Valid for what the documents describe as a “technological solution for the identification of persons.” The agreement covered “facial biometric recognition by means of image analysis,” along with cloud-based processing and ongoing technical support. In practical terms, the contract marked a shift: determining who was present in the classroom would no longer depend only on a teacher’s judgment, but on an algorithm’s assessment.

The scale of the undertaking was vast. Each month, the system was expected to process the biometric data of up to 1 million children in the cloud infrastructure. The images are stored on government servers for one year. To deliver the service, Valid partnered with Innovatrics, a Slovak facial-recognition company whose software formed the core of the identification system. In a case study published on its website, Innovatrics states that its solution would save 80 per cent time on roll call per class. And the solution has another advantage, according to the company: “Parents can instantly check if their child is present.”

The company behind the technology

From its headquarters in Bratislava, Innovatrics has built a global business around biometric identification with an annual turnover of more than €23 million. Since 2004, the company has been developing software that allows governments and corporations to identify individuals using facial images, fingerprints, or iris scans. Its products are used in national ID programs, voter registration projects, and border control systems around the world. According to the company, its technology has processed biometric data from more than one billion people in over 80 countries.

Innovatrics has also received support from the European Union. Between 2018 and 2019, the company was awarded close to €200,000 in public funding in an EU research project focused on the automated analysis, classification, and sorting of photographs using facial biometrics.

According to company information, Innovatrics has offices “on most continents”, among them one in Brazil. In response to a “surge in demand from South America,” Innovatrics opened its regional office in São Paulo in September 2021.

Caitlin Bishop, who coordinates work on surveillance technologies at the NGO Privacy International, has examined the Paraná deployment closely. The fact that European companies export facial recognition technology, the use of which has been contested in Europe, to other countries where it is then used, is something she calls “noxious.”

The law in Brazil is not even that different from European law, Bishop said. “But there is a huge problem with enforcement.” In her view, it is not a gap in formal law but the absence of effective oversight that allows the technology to be deployed in classrooms. Meanwhile, the absence of any export controls in the AI Act or other EU regulations has created “not a good situation,” according to Bishop, which allows "deeply invasive technology” to be sold by European companies internationally.

When the AI Act was being negotiated in Brussels, the European Parliament argued for a ban on such business. Its official position stated: “It is appropriate to prohibit the export” of systems whose use is classified as “unacceptable” under the AI Act. However, the proposal garnered little support among the other EU institutions and was excluded from the final law.

“The absence of such measures means that technologies banned here might still be sold and deployed elsewhere, undermining our values,” said Brando Benifei, an Italian social democrat MEP who supported the ban. “We should not allow the export and use abroad of systems we would not permit at home.”

Does it even work?

When the system was rolled out in Paraná, state-owned IT company Celepar framed it as efficient, secure, and unambiguously beneficial. In a press release, the company argued that teachers were losing “more than 100 hours per year” per class to routine administrative tasks such as taking attendance. The new system, Celepar said, would save teachers dozens of hours.

In interviews with Investigate Europe, teachers described a different reality. The algorithm, they said, often takes longer to register attendance than entering the information manually would. Errors in identifying students remain common.

Those accounts are supported by an independent study published in 2025 by researchers at São Paulo State University. The researchers tested the system in a Paraná public school and found it achieved an average accuracy of 91.1 per cent, below the 95 per cent threshold specified in the government’s procurement contract. The attendance check, promised to take 30 seconds, averaged two minutes in practice. Internet connectivity, student positioning, and camera quality all affected performance.

A survey by APP-Sindicato, one of Paraná’s most influential teachers’ unions, found that eight out of ten educators considered the facial-recognition system less effective than taking attendance in person. The union represents more than 65,000 teachers.

Inside schools, the system’s use has become uneven. “Every year, at the beginning of the school year, the State Education Secretariat instructs us to register students in the database,” said Vandré Alexandre, a teacher and union leader. “At first, teachers are required to use the facial-recognition roll call. But after a while, the bureaucrats stop asking us to do it.”

The welfare risk

The system’s errors take on a different weight when viewed against Brazil’s social-welfare architecture.

Under the Bolsa Família program, families must meet certain conditions to remain eligible for cash transfers, including ensuring their children attend school regularly. Pupils older than six must be present for at least three-quarters of their classes. Those attendance records are now generated, in Paraná, by the same facial-recognition system that marked the girl in Ingrid Adam’s school as absent.

The system’s 91.1 per cent accuracy rate, documented in the São Paulo State University study, may sound high. But in a state where more than a million children can be scanned daily, even a small margin of error could affect tens of thousands of records. Investigate Europe found no confirmed case in which a false absence led directly to the suspension of welfare payments. But teachers warned that the possibility is real.

Élio da Silva, a Portuguese language and philosophy teacher in Paraná, described how attendance data can be mishandled. He recalled seeing internal instructions that led schools to mark certain students as having “no attendance,” even when they had been present in class. In one case, a seventh-grade student with only three absences was excluded from official attendance records until after federal education data had already been compiled.

“They wrote that this student had no attendance,” da Silva said, “even though he was in my class.” He could not identify a confirmed case in which such errors led to the suspension of Bolsa Família payments. But he warned that if attendance databases were ever cross-checked with welfare systems, a student incorrectly marked as absent could, on paper, appear not to be attending school at all. “It could happen,” he said.

Privacy International’s Caitlin Bishop said that even the possibility of such a link raises serious concerns. “The link with Bolsa Família has been concerning,” she said, pointing to the risks that arise when attendance data, especially when inaccurate or poorly governed, becomes entangled with access to social welfare.

Paraná’s Secretary of Education disputed this characterisation. In a statement to Investigate Europe, the secretariat said that use of the facial-recognition system is optional for teachers, who would manually verify the list of students present and could make corrections in cases where the system fails to identify them. Students can also opt-out using the system “without any prejudice” if requested. Technical failures, the secretariat said, do not automatically result in a student being marked absent, and do not directly affect eligibility for social welfare programs.

A legal challenge

These concerns eventually reached the courts. In April 2025, the Paraná Public Prosecution Office filed a civil action against the state government, Celepar, and the contractor Valid, alleging violations of Brazil’s General Personal Data Protection Law. Marcos José Porto Soares, the prosecutor leading the case, said it was the first time his office had taken legal action against the state government over alleged breaches of data protection law. Among the issues at stake was consent itself: Investigate Europe confirmed with Paraná’s education secretariat that an earlier version of the student enrollment form did not allow parents to refuse the use of their children’s images for the facial-recognition program. They said the flaw has since been corrected. Investigate Europe was unable to independently verify the change.

In May 2025, a judge denied the prosecutor’s request to immediately suspend the system. The court found no concrete evidence of imminent harm that would justify urgent intervention. The decision also noted that halting the system could require the rapid adoption of an alternative attendance method, with potential implications for public spending.

In September, the Public Prosecution Office formally challenged that reasoning, arguing that the policy lacks a clear legal basis in statute or regulation. The case remains ongoing, with a ruling expected in the first half of this year.

Celepar said it “remains committed to the modernization of the state's public education through digital transformation”, and said they “continuously monitor teacher feedback to refine the algorithm and user interface” of the technology. The company said there are “multiple fail-safes” in place to ensure that welfare eligibility is not impacted by the system, including the ability to make manual changes and retrospective corrections.

With regards to the action by the public prosecutor, Celepar said: “The company maintains that all data processing activities are conducted in strict adherence to the General Data Protection Law. Celepar is actively collaborating with the MPPR to demonstrate the security protocols, data encryption, and public interest justifications that underpin the project.”

Paraná’s Secretary of Education said the system complies with Brazil's data protection law. It also informed that “prior to the implementation of the solution, a Data Protection Impact Assessment was prepared.” Regarding the ongoing trial, the Secretary stated that “the case is still under judicial review and, so far, there has been no court decision.”

Spreading system

Despite mounting complaints from teachers and the initiation of legal proceedings, Paraná has continued to rely on facial-recognition technology in its classrooms. In early September last year, the state extended its contract for an additional year, through September 2026.

Even as the legal case unfolds, Innovatrics has continued to market its school-surveillance technology elsewhere. In the summer of 2023, a company representative met with officials from Chile’s Ministry of Education. According to an internal note from the meeting, the representative advocated for the nationwide use of facial recognition to identify children in schools and kindergartens, citing the deployment in more than 1,000 Brazilian schools. A representative of NutreChile, a company involved in the proposed pilot, told Investigate Europe that the project never came to be, without giving further reasons.

Within Brazil, the model has spread. According to the research organization InternetLab, seven of the country’s 27 states are now using facial-recognition technology in schools, with others considering similar systems.

Less visibly, the technology has also begun to travel in the opposite direction, back toward Europe. In 2024, the government of Paraná announced that its facial recognition system had been exported to Portugal. The software was tested for three months at United Lisbon International School, a private institution serving students from around 50 countries. According to a government statement, the pilot was “approved by the school’s management.” When contacted, the school’s owner, the British company Duke Education, did not comment on the previous trial, stating, “The school does not use this tool.” Following questions from Investigate Europe, the Portuguese data protection authority announced that it would launch an official enquiry.

Celepar confirmed that no permanent contract had been signed in Portugal — at least for now.

***

Additional Reporting by Paulo Pena.

The investigation is being published globally with media partners including Núcleo Jornalismo (Brazil), Público (Portugal), EUobserver (Belgium), and Denník N (Slovakia).