What happened

LRCO Paraná, a facial recognition-based student attendance system used by the Brazilian state of Paraná, has been criticised for being overly intrusive, prone to errors and for collecting sensitive data including facial expressions and emotional attributes without the explicit consent of parents or students.

Teachers use a mobile app to take photos of classrooms; within seconds, the images travel to a cloud server, where a facial recognition algorithm detects each student's face, extracts it, and compares it against a database of biometric profiles. Students identified in the photos are marked present; those the system does not find are marked absent. 

Estimated to affect approximately 430,000 to 1,000,000 students, the system has been found to be insufficiently inaccurate. A 2025 study conducted by researchers at São Paulo State University found that the facial recognition system achieved an average accuracy rate of 91.1 percent, below the 95 percent performance requirement specified in the procurement contract. 

This inaccuracy may have significant downstream impacts. Eligibility for Brazil's Bolsa Família welfare programme depends in part on school attendance, meaning families stand to lose payments should their child miss school. 

More broadly, critics say the "noxious" system risks fundamentally altering the educational environment by eroding privacy and normalising mass surveillance, eroding interpersonal trust, inhibiting self-expression, and marginalising students feeling targeted.

The system has also been accused of failing to gain the meaningful consent of students and parents for biometric processing. Early enrolment forms did not include an option allowing families to refuse the use of facial recognition technology, according to a lawsuit brought by public prosecutor Marcos José Porto Soares - an allegation later contested by Paraná.

The system was developed by Brazilian state-owned IT company Celepar and the private firm Valid, using biometric technology from Slovakian company Innovatrics. 

A March 2026 Investigate Europe deep dive showed how Innovatrics' facial recognition software came to be deployed in Paraná’s schools, despite being restricted across the European Union under the EU AI Act. 

Why it happened

The system's rollout was driven by a political and administrative agenda shaped by Paraná's education secretary, a technology entrepreneur who took office in 2019 with an explicit mandate to digitise the state's schools. 

Citing an OECD study showing that Brazilian teachers spent a third of each lesson on non-teaching tasks, the state argued that automating attendance would recover lost instructional time. 

However, it appears the authorities relied on "assumed" or "opt-out" consent rather than explicit "opt-in" permission required for sensitive biometric data under Brazil's General Data Protection Law (LGPD).

Furthermore, a lack of a pre-launch Data Protection Impact Assessment (DPIA) indicates the risks to minors were not adequately weighed against the perceived benefits.