An election with open questions
On Sunday, October 4, 2026, Paraguay elected its mayors and municipal councillors. Now that election day is over, the assessment is not only about who won, but about how many people were left out, how much we really know about the machines that counted the votes, and who was able to observe the process up close.
At TEDIC we follow the use of technology in electoral processes because an election is also a data system: a voter roll, a piece of software, a flow of public information. When that system fails or becomes opaque, what is at stake is the right to vote and to trust the result.
In this summary we describe the warning signs from this election that we believe require a solution: the voter roll that left thousands of young people out, voting machines without an independent audit, assisted voting without oversight, the biometrics proposal, the illegal publication of exit polls, a campaign with no rules on social media, the exclusion of organizations from electoral observation, and the use of AI. And the great challenge for the Superior Court of Electoral Justice (TSJE): regulating technology.
The first “year of democracy” in the era of social media and artificial intelligence
The latest Reuters Institute reports confirm that young people get their news mainly through social media and AI chatbots. Since 2022, the structural changes have accelerated even further toward a media environment that is more digital, more mobile and dominated by content platforms, with new consequences for the business models and formats of journalism.
Looking more closely at how this access to news plays out in our country’s elections, El Surti reports that various experiments suggest that platforms such as X and TikTok amplify right-wing content and disinformation, and that this is the ecosystem in which new Paraguayan voters form their opinions.
In this context, an MIT study found that false news spreads much faster, farther and to more people than true news. In fact, it can spread up to six times faster than verified information. False news works because it exploits human emotions such as fear, anger, outrage or surprise. The more intense the emotional reaction, the more likely a person is to share a piece of information without stopping to check it. It also fits the business model of the platforms, which prioritize sensational content in order to keep users engaged longer, which in turn allows them to collect more data and monetize it.
In an election campaign, the risk grows when this logic is combined with microtargeting. It is no longer just that misleading content travels fast, but that it can be aimed at those most likely to react to it. Since 2022, TEDIC has worked to explain how parties and candidates cross-reference official voter records with data from commercial brokers, location data and social media activity to build profiles and send messages tailored to each person. In that circuit, the voter roll stops being merely a tool for organizing the vote and becomes one of the foundations for reaching each voter. That is why its transparency must not be confused with its exposure. What must be public is how it is managed, by what criteria it is updated and who is left out of it, never the personal data of each voter. Today, the personal data protection law gives us a tool to mitigate these abuses.
Document A/HRC/63/CRP.6 of the United Nations Human Rights Council warns that parties and campaigns increasingly rely on data-driven technologies to influence and target voters. It therefore calls for data protection laws to apply fully to political organizations, so that every person can know where their data came from, access the profiles that measure their political opinions, and object to how that data is used. It also requires parties to publish binding policies on profiling, artificial intelligence and targeting, to carry out human rights impact assessments before collecting data, and to protect that information with high security standards. Finally, it calls on election management bodies to develop guidelines on the use of technology in campaigns, together with data protection authorities and civil society.
Another major problem is the digital propaganda built on that data. In our 2024 publication we also warned that propaganda on social media is practically absent from the Electoral Code. That gap has concrete consequences: our monitoring identified national and departmental candidates who spent significant sums on digital ads without declaring them in their financial reports. As long as advertising on platforms remains outside the reach of campaign finance rules, electoral competition will have an opaque zone precisely where much of the contest now takes place.
The UN document A/HRC/63/CRP.6 is especially clear about the risks of microtargeting. It acknowledges that microtargeting can lead to voter discrimination and disenfranchisement, a chilling effect on political participation, and the weakening of electoral integrity. It therefore calls for laws requiring parties to disclose what data they process, how they obtain it and how they build profiles. It also calls for parties to carry out human rights due diligence before hiring technology services or buying data from companies. In addition, it proposes limiting geolocation tracking to cases of informed consent and banning the large-scale automated collection of social media data (scraping) to build voter profiles.
The obligations do not fall on the State alone. A/HRC/63/CRP.6 calls on parties to publish a complete list of the individuals and groups, including influencers, with whom they have contractual or financial relationships or who amplify their messages. It also calls for political messages to be easily recognizable as such, and for data collected during campaigns not to be shared with platforms for digital advertising without consent.
In addition, our research on elections and technology sets out the limitations already identified in the use of WhatsApp as the most widely used tool for spreading electoral information, followed by Facebook as the most used application among adults and among peasant and Indigenous communities. This is because internet service providers (ISPs) offer WhatsApp for free (zero rating), which limits users’ ability to verify and validate the information they receive through the app, since they do not have enough data to browse outside it. The 2018 Brazilian case, analyzed by CELE, showed why WhatsApp is one of the hardest spaces to audit. Business owners financed mass messaging using databases bought from digital agencies, on a network that allows mass communication but leaves no trace of who produces the content or how many people receive it. That opacity left the Electoral Justice system without the tools to measure the scale of the phenomenon, and it is a risk Paraguay shares, because the same app concentrates much of the political conversation.
On top of this, AI has heightened the capacity to create and spread disinformation online, which undermines the integrity of electoral information, trust in democratic processes and the safety of users. There is a growing trend of using AI in elections without labeling it as AI. Our country already has concrete examples: in Ñemby, a candidate for city council was questioned on social media for using AI-generated content in her campaign without informing her voters. The case shows that the problem lies not only in the tool, but in the lack of clear rules on when and how its use must be disclosed.
The risk is greater when AI is used to attack. In the run-up to this year’s municipal elections, TEDIC documented cases of gender-based disinformation against women councillors in the Central department, who were targeted with AI-altered audio and video. These practices aim to discredit women candidates, discourage their political participation and, ultimately, distort the equal conditions of competition that the TSJE should guarantee.
The UN document A/HRC/63/CRP.6 also addresses political advertising and AI, and it starts from a point worth underlining: the response to disinformation cannot be censorship. States must ensure an enabling environment for freedom of expression and address electoral disinformation through multi-stakeholder, human rights-based strategies. Those strategies should strengthen independent and pluralistic media, fact-checking and the electorate’s digital literacy. On that basis, the document calls on election management bodies to set up legitimate, accessible and transparent mechanisms so that citizens can report irregular political advertising, microtargeting and disinformation campaigns.
On artificial intelligence, the document proposes banning high-risk uses, such as inferring political opinions from biometric data. It also calls for mandatory measures against AI-generated disinformation, including deepfakes, and for considering mandatory disclaimers whenever this technology is used.
Regulating this space is urgent, but not at any cost. Any restriction must be limited to speech that is not protected by the American Convention on Human Rights, decided with due process before a judicial authority, and built with the participation of all sectors.
The integrity of electoral information: where is the TSJE?
The arrival of this avalanche of technological developments has pushed traditional electoral regulation to its limits, in Paraguay and across the region. It has created the illusion that politicians, parties and voters talk to one another freely, without intermediaries.
For some time now, the TSJE has been sidestepping the chaos, and in its latest electoral reform it did not take the opportunity to address technological issues that affect the integrity of electoral information. The previous model, based on an internet laissez-faire approach, is no longer compatible with the real dynamics of electoral contests. Today’s scenario is different: elections are held in a deeply unequal information environment, mediated by digital platforms that decide, using opaque criteria, what circulates, what gains traction, what is downranked and what must disappear. This does not remove the need for constant attention to the legal limits of the TSJE’s powers, nor to the public and participatory nature of the process for updating its resolutions.
Today there is talk of updating the rules of the game: banning deepfakes in certain information contexts, content moderation for labeling AI-generated content, electoral propaganda on platforms, provisions for content removal, and transparency and due diligence on the part of internet platforms.
Since 2024, TEDIC has documented the regional meetings and forums that the TSJE attends, where it takes part in discussions on moderating “problematic” content and regulating prohibited speech such as hate speech. We believe it is essential to open this conversation to other actors in Paraguayan civil society, in order to strike a balance between the impact on the informational integrity of elections, freedom of expression and the mitigation of prohibited and problematic speech.
In our view, the regulation the TSJE must undertake should keep it neutral toward the competitors, but not toward the conditions of the contest or the guarantee of voters’ autonomy.
In this sense, for us at TEDIC, there are two essential tasks the TSJE must take on after these municipal elections and ahead of the 2028 presidential elections. The first is to update its regulatory toolkit at the pace at which technologies and electoral tactics change, addressing the need to deal with new actors: Big Tech, ISPs and AI companies that generate content at scale, and influencers who operate as genuine informal campaign operatives. Furthermore, the UN document A/HRC/63/CRP.6 also requires platforms, including AI chatbot services, to maintain public archives of political ads, with their targeting criteria and the amounts paid. It also requires enhanced due diligence ahead of each election, with investment in local languages, contextual knowledge and fact-checking. In addition, it requires platforms to review their recommender and monetization algorithms so that they support access to accurate information about the electoral process.
The second is to move toward models for the effective enforcement of rules against actors with significant influence on the contest, even if they are not platforms in the strict sense. The response must be institutional before it is normative: the point is not to add new rules, but for the TSJE to create mechanisms that make existing obligations verifiable, measurable and enforceable while the political contest is under way, and not only after it has ended. The TSJE cannot limit itself to recommending what to say or what to keep quiet, nor act as a referee who calls fouls without the tools to sanction them. We need concrete instruments that guarantee equal conditions among campaigns and protect voters’ freedom to choose their representatives.
Along these lines, the codes of conduct provided for in Europe’s Digital Services Act (DSA), especially those under Article 45, are not mere voluntary agreements. They work as an enforcement technology: they set verifiable commitments, require transparency and oblige platforms to be accountable. They make it possible to audit platform behavior, distinguish good-faith diligence from neglect, and build common technical standards to protect electoral integrity. Closer to home, Brazil’s data protection authority (ANPD) does something similar with its compliance plans, which correct the practices of regulated entities and follow up on the results. None of these instruments, however, was designed as a channel for requesting sanctions against specific users. That is the distinction Paraguay should keep in mind if the TSJE moves toward similar mechanisms.
The Brazilian experience also reveals a risk. There, compliance plans were created as transparency tools to give the Superior Electoral Court an overall picture, separate from the debate over the legality of each individual piece of content, which falls under its judicial function. When those plans began to be used to request specific measures, a shortcut opened up: any campaign could invoke its own reading of the companies’ policies and ask for sanctions case by case, without filing a lawsuit before the electoral courts. The problem becomes more serious with the suspension of entire channels. Deleting a post whose illegality has been proven is not the same as shutting down a channel, because the latter also affects future and possibly lawful expression. That is why it requires specific evidence and justification.
It is true that the speed of digital communication outpaces judicial timelines and demands the capacity to respond. It is also true that platforms’ due diligence obligations need concrete consequences so that they do not remain empty promises. But the answer cannot be that a body that concentrates rule-making, administrative and judicial functions, such as the TSJE, crosses the boundaries between them without clear criteria. If accountability instruments end up being used to remove content or channels at the request of campaigns, this institutional progress would produce the opposite of the intended effect.
Ahead of the 2028 general elections, the TSJE has the opportunity to step up as a technology regulator with its own governance tools. That means looking beyond individual pieces of content, which remain an urgent concern, and paying attention to the systemic conduct of the intermediaries that organize and amplify information. Sanctioning obvious violations is no longer enough. The electoral contest must take place under minimally fair conditions, in an environment where the battle over information is also shaped by transnational interests and global asymmetries of power.
Assisted voting with electronic voting machines
In this 2026 cycle, TEDIC did not carry out its research on the implementation of the voting machines and voter perceptions. The surveys from previous cycles nevertheless remain a useful starting point for understanding what happened this year, together with what was documented in the media. Since the first election with machines, the 2021 municipal elections, we surveyed 438 people at 20 polling centers in Asunción, and in the 2023 general elections, 836 people at 30 polling centers in Asunción and Ciudad del Este. These data allow us to compare them with the 2026 elections, and what this year’s events show is less something new than the repetition of problems that had already been flagged.
| Indicator | Asunción 2021 | Asunción 2023 | Ciudad del Este 2023 |
|---|---|---|---|
| Entered the voting booth accompanied | 15.8% | 1.5% | 7.4% |
| Checked their vote on the printed ballot and with the chip reader | 31.3% | 23.9% | 14.0% |
| Polling station staff reminded them to check with the chip reader | 30.1% | 23.4% | 16.7% |
| Believes the vote is also stored in the machine | 64.0% | 58.5% | 59.2% |
Sources: TEDIC, 2021 municipal elections survey and TEDIC, 2023 elections survey.
Our legislation reserves assisted voting for people with visual impairments or impairments of the upper limbs who cannot mark the ballot themselves, and requires the companion to be a trusted person expressly designated by the voter. In practice, that exception has expanded without control. In 2021, almost one in six people surveyed by TEDIC in Asunción (15.8%) entered the voting booth accompanied, and among those who had only completed primary school the figure reached 28.6%. In 2023 the percentage dropped to 1.5% in Asunción, but in Ciudad del Este it reached 7.4% overall and 18.1% among people over 50. That same year, the European Union Election Observation Mission found assisted voting contrary to the law at 19% of the polling stations it visited, with people with no apparent disability receiving help, and recommended prohibiting party agents, poll watchers and polling station members from assisting voters. When the vote stops being secret, the door opens to vote buying and vote control.
In these elections, assisted voting persisted. During the Colorado Party primaries on June 7, the Public Prosecutor’s Office received complaints of irregular assisted voting in different parts of the country. In Luque, prosecutor Sophía Galeano intervened at a polling center where wheelchairs were being used to pass voters off as people with disabilities and steer their vote. Ahead of the municipal elections, the TSJE and the Public Prosecutor’s Office agreed that only people with disabilities could receive assistance and that anyone providing assistance had to be recorded in the polling station’s official record. Days before the election, however, the ANR (Colorado Party) announced that it would not comply with that regulation.
To curb these abuses, in July 2026 the TSJE approved Resolution No. 148/2026, which regulates assisted voting. The rule establishes that a person may assist only one voter per election day, except in the case of immediate family members, and requires the companion’s details to be recorded in the official record. It was a step in the direction the European Union had recommended three years earlier, but it came with a significant gap. The OAS Election Observation Mission warned that the regulation sets out no sanctions or clear consequences if the companion is not recorded, leaving open the question of whether the vote becomes invalid or whether the assistance should be prevented.
That gap turned into conflict before the vote. The PLRA (Authentic Radical Liberal Party) filed a formal complaint over the risk of irregularities, and days before the election the ANR announced that it would comply only with the general law and rejected the new regulation. During the elections, the Public Prosecutor’s Office received complaints of assisted voting abuses and violations of ballot secrecy at various polling centers. Faced with this scenario, the OAS recalled that assisted voting is an exceptional measure and that the rule must be applied rigorously, without being subject to the will or agreements of the parties. It also recommended outreach and civic education campaigns aimed at citizens and polling station authorities on accessible voting procedures, including assisted voting, Accessible Polling Station No.1 and the Vote at Home program, in order to protect the integrity and secrecy of everyone’s vote.
During the elections, the TSJE’s response was to distance itself from the complaints about assisted voting. Its Director of Advisory Services, Luis Alberto Mauro, acknowledged that these cases could constitute electoral crimes, but argued that polling stations are autonomous, that the Electoral Justice system cannot intervene and that only the Public Prosecutor’s Office can act. He added that the Court had asked for the law to be changed four years ago, with no response from Congress.
The result is a rule that exists on paper but that no one enforces at the moment it matters. It is the same problem we pointed out regarding digital platforms: an electoral authority able to identify the violation but without the instruments to correct it while the contest is under way. As long as that gap persists, each electoral cycle will keep documenting the same irregularities without previous warnings turning into change.
Voting machines: an audit run by the audited
After the first attempts in the 2001 municipal elections, and their abandonment in 2007, Paraguay approved an electoral reform in 2019 that provided for the use of electronic voting machines. This technology was used in the 2021 municipal elections, the 2023 general elections and these 2026 municipal elections.
Our measurements from previous cycles, presented above, raised a warning sign that remains valid. In 2021, almost two out of three voters in Asunción believed their vote was stored in the machine, contrary to what the TSJE itself explains. Most also did not double-check the printed ballot and the chip, and that practice worsened between 2021 and 2023. In this cycle we do not have verifiable data on that perception, but the question we have been asking for years remains open: how can citizens scrutinize a system they do not fully understand? A voting mechanism that the electorate does not understand is hard to oversee, and that opacity clashes with the constitutional principle of public vote counting.
International missions warned of the same risk. In its 2021 preliminary report, the OAS acknowledged that the machine sped up the vote count, but asked the TSJE to carry out its own technical tests and audit the equipment and chips, because in that election the security tests had been conducted solely by the supplier company. In its final report, presented in 2022, it also recommended assessing the risks of electronic voting. In 2023, the European Union Election Observation Mission went further. It concluded that the TSJE’s audits had been detailed presentations to party representatives rather than true audits of the system, that some technical questions went unanswered, and that the request for a real audit of the software was not addressed. In its 2026 report, the OAS mission commented on the lack of a formal sealing process for the software of the voting machines and of the TREP preliminary results transmission system.
For our part, TEDIC has called for independent audits since 2020, with the participation of civil society, academia and the technical community, not only party representatives. After the fraud allegations of 2023, we warned that the greatest risk of these machines is that, without transparency, they make any fraud narrative seem plausible.
That transparency deficit was repeated in 2026. The municipal elections were held with machines leased from the Comitia–MSA Consortium that never underwent an independent technical audit. The TSJE presented them as “unhackable,” but the available evidence casts doubt on that claim. Systems analyst Luis Benítez compared the protocol approved by TSJE Resolution No. 2/2026 against international standards such as those of INCIBE, OWASP and PTES, and concluded that what was called an audit was actually a controlled demonstration. Those who reviewed the equipment were the parties’ technical representatives, not independent auditors. They could not perform penetration tests, use their own tools, copy the source code, open the hardware or return the next day to a topic that had been deemed “exhausted.” It was the supplier itself that explained the architecture and generated the hashes that were then verified. In other words, it was shown that the machine works, not that it can withstand an attack.
The doubts also extend to the design of the equipment. In February, Benítez documented that the machine’s microcontroller includes internal flash memory, even though the tender specifications required the software to reside on an external USB drive. That memory opens up a layer that runs before the USB and that no one audited, which breaks the boot chain of trust. The system also runs on GNU/Linux under the GPL license, which requires the source code to be made available, and the contract signed with the consortium was not published on the Public Procurement portal either.
On top of this, the vote took place with known vulnerabilities. Using the list of versions that the TSJE itself submitted to the Senate in Note S.G. No. 306/2026, Benítez cross-checked the system’s components against public vulnerability databases. There is no public record that these flaws were fixed before October 4. Some findings:
| Component | Version used | Documented flaw | Fixed in |
|---|---|---|---|
| Linux kernel | 6.8.0-49 (Oct. 2024) | Dozens of unapplied security updates | Later 6.8.x builds |
| cryptography (Python) | 41.0.7 | CVE-2023-50782: decryption of RSA-based TLS traffic | 42.0.0 |
| Jinja2 | 3.1.4 | CVE-2024-56201: sandbox escape and code execution | 3.1.5 |
| Pillow | 10.4.0 | CVE-2025-48379: memory buffer overflow | 11.3.0 |
| FreeRTOS (firmware) | Not disclosed | CVE-2024-28115: privilege escalation | 10.6.2 |
None of this proves that votes were altered, and the analysis itself makes this clear: the machine operates in isolation, without a network connection, which reduces the risk of remote exploitation. But isolation does not eliminate physical attack vectors, nor can it be verified from the outside as long as the full code remains closed. A system with known, unfixed flaws cannot be presumed secure, and the burden of proof lies with whoever administers it.
Biometrics: a technological answer to a political problem
Following allegations of irregular vote loading in the June primaries, the opposition again asked the Senate to take up the bill on biometric voter registration by fingerprint. The initiative, introduced in August 2024 by Rubén Velázquez, Eduardo Nakayama, Esperanza Martínez, José Oviedo and Éver Villalba, seeks to stop “the dead from voting” and would only apply from the 2028 general elections.
The ruling party responded with irony and dismissive remarks, defending the TSJE as a trustworthy institution. The TSJE, on the other hand, supports the idea. In September 2025, its president, Jaime Bestard, described it as the final safeguard against identity fraud, acknowledged that it would require building a costly database, and proposed a pilot plan in Asunción and the departmental capitals if Congress increases the budget.
The TSJE’s interest in biometric identification is not new and dates back at least to 2013, but the proposal arrives in an unfavorable context. TEDIC has warned about this proposal since 2019 and, in our latest analysis, we recommended abandoning it. Law No. 7593/2025 on Personal Data Protection defines fingerprints, faces and irises as sensitive data subject to specific and limited processing. For the same reason, international human rights standards on elections and technology establish that biometrics should only be used in voter registration or verification when their use is based on law and is necessary and proportionate to a clearly identified electoral need.
The fundamental questions remain unanswered:
- What guarantees that a voter’s identity cannot be linked to their vote, in a system that already uses machines?
- If the voting machines are leased from a private company, will the biometric readers be leased too? Who will have access to the database?
- How will the database be protected from being sold or leaked, as has already happened with the identity card database?
- What happens if fingerprints are cloned, and what sanctions will there be for those who misuse the data?
Above all, that standard requires defining the problem to be solved. According to A/HRC/63/CRP.6, before adopting a biometric technology, States must establish the specific needs it will address and clearly identify the required technical specifications. The document also calls for the technology to comply with international human rights law. It further establishes that election management bodies must bear primary responsibility for the technologies used to obtain, store and process biometric data, with support from cybersecurity and data protection agencies. Paraguay is far from meeting these conditions. Its voting machines are leased from a private consortium, have never undergone an independent audit, and their source code remains closed. Nothing suggests that biometric readers would be managed any differently.
Biometrics can verify who votes, but not how they vote. It does not solve induced assisted voting, vote buying or the lack of oversight at polling stations, which are precisely the problems documented in 2026 and by the OAS and EU electoral missions. Law 7593/2025 on personal data protection is not yet fully in force and will only take effect at the end of 2027, and 187,572 young people were left off the voter roll because of flaws in existing databases. Before creating a new and far more sensitive database, the State should demonstrate that it can protect the ones it already manages.
The track record is not encouraging. In March 2025, the personal data of nearly seven million Paraguayans was offered for sale, allegedly linked to the cyberattack suffered by the TSJE itself in 2023. In May of that year, Paraguay Ciberseguro confirmed incidents in more than ten public institutions, with more than eight million records compromised, including names, identity card numbers, addresses, phone numbers and medical records. Weeks later, a criminal group demanded 7.4 million dollars from the Government in exchange for not publishing citizens’ data. A leaked password can be changed, but a fingerprint or a face cannot. As long as there are no verifiable guarantees about who safeguards that data, with what security measures and under what independent controls, an electoral biometric database would pose a greater risk than the problem it aims to solve.
The voter roll that left people out: 187,572 “unlocatable” young people
According to the TSJE’s own data, cited by the OAS Election Observation Mission, 187,572 people between the ages of 18 and 30 were classified as “unlocatable” and did not vote on October 4. Most of them would have been voting for the first time, and this mechanism is administrative, not voluntary.
The OAS Mission was informed that around 100,000 people are added to the Electoral Register each year based on data from the National Police’s Identification Department. When that data does not make it possible to determine a person’s address, they are placed in “conditional registration” until they complete an in-person procedure.
In practice, the burden of correcting an interoperability failure between two State databases is shifted onto young citizens. And unfortunately, almost no one found out: the issue barely appeared in election day coverage.
For us at TEDIC, this is a data governance problem with a direct impact on a political right. Several frameworks help to see it clearly: Law 5282/2014 on Free Citizen Access to Public Information and Government Transparency and its implementing Decree No. 4064/2015; the International Open Data Charter, agreed in 2015 by governments, civil society and experts; and the new Law No. 7593/2025 on Personal Data Protection, enacted in November 2025 and expected to be fully applicable by the end of 2027. Based on these, we define three main criteria the voter roll should meet:
- Data quality and interoperability. Public data must be complete, accurate and of high quality, and State registries must use common standards and identifiers so that they can be cross-referenced and made interoperable. The data protection law also includes the principle of accuracy among its principles for processing personal data.
- Transparency that protects privacy. Openness should be the default, any information that is withheld must be justified, and data must be disaggregated down to the lowest administrative level. Today, no one knows how many “unlocatable” people there are per district or what weight they had in close results.
- Barrier-free access. Bureaucratic hurdles and the digital divide leave out those with fewer resources. Requiring an in-person procedure from young people who live far from an office, or who work or study in another city, shifts a State error onto citizens. The Identification Department must make an effort to update this information so that citizens can exercise their political rights.
Citizen observation: vague rules, organizations left out
One week before the election, the TSJE confirmed that civil society organizations described as close to opposition candidates in Asunción would not have national observers at polling stations. This was reported by ADN Digital on September 28, against the backdrop of what happened to Alma Cívica in 2023.
The official argument was twofold: the accreditation deadlines had already passed (the one for poll watchers closed on September 25), and the regulation requires observation to be impartial and excludes candidates, party leaders and party activists. Separating campaigning from observation is a reasonable principle; the problem is how it is applied.
National electoral observation has no detailed legal framework of its own: it depends on regulations issued by the very body being observed, with no public and verifiable criteria for deciding who is “linked” to a candidacy, no clear procedure for challenging a refusal, and deadlines that close before the debate reaches public opinion. Under these rules, exclusion can be used against any inconvenient organization.
This is not the first time this has happened. In the 2023 general elections, the European Union Mission noted that the TSJE rejected the accreditation of Alma Cívica and Decidamos, so there was no national observation. Decidamos was rejected because it planned to carry out a quick count, a common practice in citizen observation across the region. The mission warned that there is no adequate legal framework for national observation and no swift mechanism to appeal the TSJE’s rejections.
In the meantime, oversight remains in the hands of party poll watchers and international missions (OAS, UNIORE, A-WEB, AMEA). Both are necessary, but they do not replace independent citizen observation, with local and technical knowledge, which is precisely the kind that could have looked closely at the voter roll, the machines and the transmission of results.
Our requests for the 2028 elections
Ahead of the 2028 general elections, the TSJE has the opportunity to decisively take on its role as a technology regulator. The risks set out throughout our analysis require the TSJE to stop acting merely as a referee that calls fouls and to take on the role of a regulator with its own instruments. This applies both to polling stations and to the platforms and algorithms that now shape electoral information. With this horizon in mind, and looking ahead to the 2028 general elections, we put forward the following recommendations:
- Establish verifiable commitments for digital platforms during electoral processes, inspired by the codes of conduct of the Digital Services Act (DSA). These commitments should include transparency on content moderation, public political ad libraries and periodic reports on the algorithmic amplification of electoral content. These instruments should serve to assess the systemic conduct of intermediaries, not as a shortcut for campaigns to request the removal of channels or content without going through a judicial process, as happened in Brazil.
- Require transparency for paid political propaganda that circulates through influencers and content creators, so that it is known who commissions and who finances each message, and that these expenses are included in campaign financial reports.
- Establish an obligation to clearly label electoral content generated or altered with artificial intelligence, and create rapid-response mechanisms for gender-based disinformation, which in 2026 affected women candidates through manipulated audio and video.
- Regulate digital propaganda with due process, judicial oversight and no prior censorship. Any restriction must be limited to speech that is not protected by the American Convention on Human Rights.
- Regulate and effectively enforce Law 7593/2025 on personal data protection, with clear rules on the use of the voter roll and of personal data in digital campaigns on social media, including microtargeting through messaging apps.
- Abandon initiatives for the biometric identification of voters, which expose sensitive and irreplaceable data without solving the real problems of the process, in a country where public databases have already suffered massive leaks.
- Fix interoperability with the Identification Department and enable a simple, free online mechanism for updating addresses for the 187,572 “unlocatable” people on the voter roll.
- Release the full source code of the voting machines’ operating system, libraries, firmware and bootloader, with exact versions and verifiable hashes. This must be accompanied by real access to the equipment for universities, the technical community and civil society, publication of the contract with the supplier consortium, a public patching plan before each election, and the release of the failure data that the TSJE records in its CIME monitoring system.
- Issue clear guidelines to polling station authorities on assisted voting, keep a public record of assistance cases and establish sanctions for non-compliance with the regulation. It is also necessary to push for the legal reform that the TSJE itself is calling for so that it can act against abuses, together with civic education campaigns on accessible voting procedures, as recommended by the OAS.
- Pass a law regulating national electoral observation, with objective accreditation criteria, reasonable deadlines and an effective appeal mechanism against refusals.
The 2026 municipal elections were the dress rehearsal for the 2028 general elections. If these problems are not fixed now, they will be repeated on a larger scale.