CDMX operates 58,000+ C5 system cameras according to official data.[1] Puebla exceeds 3,000 active units across its municipal videovigilancia system.[1] Zero Mexican federal laws regulate real-time facial recognition on that footage.[1]

Brazil filed PL 649/2026 on February 23, 2026 — author: Dep Marcos Tavares (PDT-RJ).[3] It is the first federal bill mandating that military + civil police + federal-district security forces integrate body-worn + vehicular cameras with facial recognition + LPR/ANPR exclusively with the Banco Nacional de Mandados de Prisão (BNMP) and official vehicle-records databases.[3]

Three PL 649/2026 pillars that any LATAM procurement officer signing an enterprise CCTV contract in Q4 2026 should read:

  1. Mandatory human validation before any police action — Article 4 §2 makes human validation obligatory before any police stop resulting from an automated alert [3]
  2. 90-day retention ceiling — Article 8 caps image + metadata storage at 90 days, except under formal investigation or judicial order [3]
  3. Independent annual technical audit + periodic bias testing — Article 7 requires annual independent audit + public statistical-transparency reports + periodic accuracy tests + bias mitigation + detailed false-positive/false-negative logging [3]

( LFPDPPP was designed to regulate data processing in commercial + service relationships — and public videovigilancia systems don’t fit that frame, [1] which is why the regulatory gap persists. )

The contrast with Mexico: zero federal laws specific to facial recognition in public spaces [1]. The EU AI Act (effective since August 2024) prohibits real-time biometric identification except under prior judicial authorization + strict exceptions [1]. Mexico has no regulatory equivalent to that European safeguard [1]. La Silla Rota documents the Seguritech rollout operating under ISO 27001 and the absence of any Mexican regulatory framework limiting deployment [2]. In Brazil, PL 1828/2023 — which authorizes facial recognition in metros, buses, public roads, government buildings without the BNMP-exclusive integration — already passed the Chamber of Deputies on August 12, 2026 and now sits in the Senate [4]. Data Privacy Brasil criticizes it as a greenlight for broad biometric surveillance [4]. The operational gap vs PL 649/2026 is that 1828/2023 does not require BNMP-exclusive integration + does not impose mandatory human validation [3] [4].

P.D. How many of your external cameras are recording in a space where federal law has not yet decided what can be done with the face they capture?

📰 Source: AGMedios (Sep 2026), La Silla Rota (Sep 18 2026), Câmara dos Deputados PL 649/2026 (Apresentação 23/02/2026), Data Privacy Brasil (Sep 10 2026).

Sources

[1] AGMedios — Cámaras que todo lo ven, leyes que nada dicen — https://agmedios.com.mx/camaras-que-todo-lo-ven-leyes-que-nada-dicen/ [2] La Silla Rota — IA y reconocimiento facial: nuevas capacidades para la videovigilancia — https://lasillarota.com/negocios/2026/9/18/ia-y-reconocimiento-facial-nuevas-capacidades-para-la-videovigilancia-529039.html [3] Câmara dos Deputados — PL 649/2026 (Dep. Marcos Tavares, full text) — https://www.camara.leg.br/proposicoesWeb/prop_mostrarintegra?codteor=3085934&filename=PL+649%2F2026 [4] Data Privacy Brasil — Brazil’s Expanding Surveillance System: Security at the Cost of Privacy? — https://www.dataprivacybr.org/en/brazils-expanding-surveillance-system-security-at-the-cost-of-privacy/