In the state schools of Paraná, in southern Brazil, attendance was taken by machine. A teacher photographed the class, software matched each face against a database of enrolled students, and children the software did not find were marked absent — that is how Núcleo Jornalismo and Investigate Europe documented it in March. The programme, Escola Paraná Biometria, built by the state IT company Celepar with the contractor Valid Soluções, reached roughly 2,136 schools and about a million students. Those counts come from press reporting; the order that follows contains none.
On 4 August, Brazil's national data protection authority, the ANPD, ordered the scanning stopped. The order — Despacho Decisório nº 2/2026/SFI, signed by its Superintendent of Enforcement, Fabrício Guimarães Madruga Lopes, as a preventive measure under article 55-J of Lei nº 13.709, the LGPD — suspends all biometric processing for school attendance across the state's network and gives Paraná ten working days to prove the shutdown: a formal declaration signed by a competent public authority, plus a technical report naming every affected system and database, where each biometric database sits, and who holds custody of it.
Read it the way a parent would, and the loudest thing in it is a silence. Nothing in the order says the children's faces will be deleted. It says they will be kept. Stopping a thing and undoing it are different acts, and the distance between the two is where a million face templates now sit.
Nobody ordered the faces deleted
The order runs five pages, and not one word in it means delete. This desk searched its full Portuguese text for every term Brazilian data-protection law and practice use for erasing data — eliminate, exclude, discard, anonymise, wipe, destroy and their variants, eight terms in all — and each occurs exactly zero times. Erasure is simply not in the document.
What the text orders instead, at item 1.3.2(b), is that the state's report describe "as medidas adotadas para impedir novas operações de tratamento e o respectivo regime de preservação ou bloqueio" — the measures taken to prevent new processing, and the corresponding regime of preservation or blocking. The scanning stops; the templates stay, in databases whose locations and custodians Paraná must now put on the record.
There is a defensible reason, and it is probably the right call. This is a preventive measure in a live enforcement proceeding, not a sanction — and the same order refers the file onward to the agency's sanctions unit, which will assess whether to open a formal sanctioning case. A regulator does not order evidence destroyed mid-proceeding; you cannot later assess what you have had erased. But preservation being correct does not make it a remedy. The children whose faces were collected do not, today, get them back. They get a promise that nobody is currently matching against them — and an open file in which the question of erasure has not yet been put.
One timestamp will settle it
The ten working days run from neither the 4 August signature nor the order's publication on 6 August. Item 8 is blunt: "a contagem dos prazos acima corresponde à intimação desta decisão" — the clocks start at formal notification of the state. Counted from 4 August they would expire on Tuesday 18 August; notification almost certainly came later, so 18 August is the earliest the filing can be due. The same window is the state's window to appeal. It would be easy, and wrong, to report that Paraná has failed to respond. It has not. Today is roughly day two or three of a ten-day clock.
What makes the filing worth the wait is a single field. Paraná's public defence is that the programme was a pilot that stopped of its own accord in July. Item 1.3.2(c) requires the state to file "a data e o horário da efetiva desativação" — the exact date and time the facial-recognition functions were switched off. A timestamp before 4 August means the state is right, and the ANPD suspended something already dead. A timestamp after it means the system was live when the regulator reached it. One line in a compliance report, due in process 00261.007049/2024-06, ends that argument either way.
A press release for Discord, silence for Paraná
The order reached the public at all only because the ANPD's internal bulletin — the Boletim de Serviço Eletrônico, where it appeared on 6 August — is published, and somebody read it. The agency announced nothing.
Three days after signing it, on 7 August, the same agency opened an enforcement proceeding against Discord, following the death of a 13-year-old and allegations about a group instigating self-harm. That action came with a press release, the initiating document attached, and same-day pickup by O Globo, CartaCapital, Poder360 and Olhar Digital.
Some of the difference is explainable. A child's death is more newsworthy, and a public warning may have been the point. Moving against another arm of the state can involve notification protocols that moving against a foreign platform does not. A press release is not a legal obligation, and the bulletin formally is publication. Credit the underlying act, too: most data protection authorities move slowly and preferentially against private companies, and this one ordered a state government to switch off its flagship school system within days.
All of that is true, and the residue is still uncomfortable. A press release is how an agency tells the public which of its actions it wants seen, and the bulletin route requires a reader who already knows where to look. In one week, on children's data, the foreign platform got the announcement and the state got silence. The silence has carried: as of 8 August there was no English-language coverage of the order at all — zero items located, against 61 in Portuguese.
Complied with, but not argued with
The order decides, but it does not explain. Its substantive reasoning — why this processing failed the law — is incorporated by reference from Nota Técnica nº 4/2026, a technical note the ANPD has not published. The document that orders is public; the document that reasons is not. A decision built that way can be complied with, but it cannot be argued with — not by the state, and not by parents at the next school, in the next state, where the same pitch will be made.
One person has a particular claim to read that note. Item 4 of the order directs that it be sent to "o titular de dados cujo requerimento levou à abertura" of the monitoring case — the data subject whose request, in 2024, led the ANPD to start watching this programme. One person filed a request; two years later, a state was ordered to stop scanning a million children. The note that explains why should be published for everyone else. Ask the agency for it.
Water already in the tank
A biometric template is not a photograph. It is a number derived from a face, and its whole purpose is to stay matchable for as long as the face exists. That is why a suspension is a smaller remedy than it sounds. The processing is a tap you can close. The templates are water already in the tank. Paraná's compliance report must say where that water is held and by whom. Nothing in it has to say for how long.
Systems that collect nothing never need this hearing. Everything else — every attendance scanner, every convenience that begins by measuring a child — eventually produces a page like this one, in which a regulator does the most it can do, and the faces stay where they are.
References (1 sources)
References
- Despacho Decisório nº 2/2026/SFI, ANPD Superintendência de Fiscalização, Processo de Fiscalização
00261.007049/2024-06, SEI 0317850, signed 4 August 2026, published 6 August 2026; signed Fabrício Guimarães Madruga Lopes. Retrieved at https://nucleo.jor.br/content/files/2026/08/SEI_0317850_Despacho_Decisorio_2-2.pdf — HTTP 200, 62,551 bytes, sha256 c83872723ab1477ea8c7831992bf5d75…, 8 August 2026. Text extracted with pdftotext -layout (9,655 characters; the file has a working text layer). Relied on: items 1.3, 1.3.1, 1.3.2(a)–(e), 1.5, 2, 4, 7 and 8; art. 55-J of Lei nº 13.709; art. 58 caput and §2 and art. 12(I) of the Regulamento de Fiscalização.
- String verification, this desk, 8 August 2026. Over the NFC-normalised full text:
eliminar,
eliminação, exclusão, excluir, descarte, anonimiza…, apagar, destruição — 0 occurrences each; preservação, bloqueio — present at item 1.3.2(b). Articles cited across the document: 6, 12, 13, 17, 29, 30, 31, 32, 45, 50, 55-J, 58. "Medida preventiva" appears three times in the singular, twice more in the plural.
- Nota Técnica nº 4/2026/CPDP/CGF/SFI/ANPD (SEI 0313541) — incorporated by the despacho, **not
published**; not retrievable from ANPD's site as of 8 August 2026.
- The Discord proceeding, 7 August 2026 — evidenced by same-day national coverage indexed via Google
News RSS (hl=pt-BR&gl=BR), including O Globo ("ANPD abre processo contra Discord após suicídio de adolescente no MS"), CartaCapital, Poder360 and Olhar Digital. Direct URL attempts at the ANPD press-release slug returned 404 and the release itself was not retrieved here.
- Portuguese coverage of the Paraná order — 61 items indexed, including G1 (6 August,
"Reconhecimento facial é suspenso em escolas no Paraná"), Tecnoblog, plural.jor.br, vermelho.org.br and APP-Sindicato, the state teachers' union (7 August).
- English coverage —
Brazil ANPD facial recognition schools suspension, Google News en-US index,
8 August 2026: zero items. Reported as a bounded null with the method named; one index at one moment, not a claim that nobody has written about it.
- Programme background and mechanism — Escola Paraná Biometria, Celepar with Valid Soluções; how
attendance capture worked (a teacher photographs the class; students the software does not match are recorded absent) per "O sistema de reconhecimento facial que monitora alunos no Brasil", Núcleo Jornalismo × Investigate Europe, 13 March 2026, https://nucleo.jor.br/reportagem/2026/03/13/sistema-reconhecimento-facial-escolas-parana-brasil/, on file as nucleo-mar13.txt; contract and procurement material developed in blog-research/2026-08-07-02/candidate-13-a-million-schoolchildren/. School and student counts are from press reporting, not from the despacho.
- Retrieval note.
gov.br/anpdserves a JavaScript shell to direct fetches and returns HTML regardless
of an Accept: application/json header; its news listing could not be enumerated. The page's Modificado em 07/08/2026 18:28 timestamp was read through r.jina.ai.