Published July 14, 2026 by Ranking Digital Rights, following the organization's 2022 Red Card on Digital Rights series with SMEX on Qatar.
Scope and method
The research draws on "publicly available sources—primarily press releases, news reports, and bidding contracts" and "identified at least 21 different companies directly participating in building a surveillance stack for the 2026 World Cup."
"Surveillance stack" is used in the sense proposed by NYU's Vincent M. Southerland: technologies that "surveil indiscriminately, and which are rarely governed by a warrant requirement or any of the traditional legal oversight mechanisms," guiding decisions about "who to police, where to police, how to police, and when to police."
The tournament's scale is part of the finding: a new 48-match format across three host countries and sixteen cities, with the technological build described in coverage as an "iPhone moment" for the sport, and "more than 17,000 devices deployed in the stadiums" supporting a hybrid cloud-and-edge model.
The five layers
| Layer | Technologies | Stated human-rights impact |
|---|---|---|
| Data harvesting at scale | Video recording, audio detection, licence-plate readers, biometric collection and authentication — at borders, transit hubs, and stadium entrances | "Indiscriminate and pervasive surveillance violates the right to privacy and the principles of necessity and proportionality"; facial recognition is "known for exacerbating overpolicing bias towards minorities" and linked to wrongful arrests |
| Predictive policing | Algorithmic systems assigning risk scores from video, location history, and communications metadata | Trained on "historically biased datasets," risking amplification; "likelihood scores" implicate fair-trial and privacy rights |
| Communications interception | IMSI catchers impersonating cell towers; telecom providers subject to wiretap requests | Collect "indiscriminately from everyone within their radius," shown to disproportionately affect Black communities in the US |
| Data integration and command centers | Merging feeds into unified profiles combining facial recognition, plate data, communications metadata, location history, and behavioural predictions | Integration "eliminat[es] the fragmented safeguards that existed while the systems remained separate" and "may also create permanence: data that might have been deleted in individual systems persists indefinitely" |
| Aerial surveillance | Drones with cameras and sensors; counter-drone systems | Counter-drone systems "carry exposure risks, potentially sweeping mobile data via radio frequency monitoring, even if they do so unintentionally" |
The integration layer is the one the report treats as qualitatively rather than quantitatively new: consolidating separate systems removes the practical safeguards that separation provided, and makes data "accessible across jurisdictions and agencies."
The authors state their own limit: "we cannot confirm whether all of these layers were in place and operating at the same time in the context of all 2026 World Cup-related events."
The companies
Lenovo was announced at its 2024 Tech World event as FIFA's official technology partner under a multi-event agreement covering the 2025 Club World Cup, the 2026 Men's World Cup, and the 2027 Women's World Cup.
The report distinguishes new World Cup contracts from pre-existing municipal relationships: Axon Enterprise, Clearview AI, Flock Safety, Palantir, and L3Harris "enjoy longstanding relationships with local governments and law enforcement agencies where their products are being used," making them "the cornerstone of increased policing capabilities, especially across host cities in the United States."
Thirteen of the 21 mapped companies "have received more than 15 billion USD in contracts with the US government over the past 18 years": Axon Enterprise, Booz Allen Hamilton, Clearview AI, Flock, Fortem Technologies, L3Harris Technologies, LiveU, MoboTrex (Derq), Motorola, NWN, Palantir, Parsons, and Peregrine. In Mexico, Seguritech "has obtained more than the equivalent of 3 billion USD in contracts with public institutions in the country in the last fourteen years." Nine of the companies carry "a total of 22 human rights allegations" in the Business and Human Rights Centre database.
The report's structural argument about the sector: "In a highly concentrated sector with strong ties to law enforcement agencies, companies operating in the surveillance industry have little to no market incentives—or public policy pressure—to improve their transparency, address human rights risks, or implement due diligence mechanisms."
The mega-event pattern
The report's central claim is about persistence rather than deployment, evidenced across four prior events.
The general mechanism: governments "have used the outsized urgency, attention, and commotion around these events to fast-track legislation, expand the surveillance powers of law enforcement agencies, and acquire products circumventing the usual public bidding processes." The infrastructure then "becomes part of the urban fabric," accompanied by "changes in how authorities perceive the role of technology for policing."
South Africa 2010 — the World Cup "was not the beginning of surveillance in downtown Johannesburg, but the event was an inflection point, as both the number of cameras and their geographic coverage increased." Cape Town's metropolitan area now has an estimated 2,000 cameras, the majority belonging to "private surveillance companies that have offered no public consultation process."
Brazil 2014–16 — acquisitions included facial-recognition goggles, licence-plate-reading drones, surveillance balloons, and 2,000 cameras, plus Integrated Command and Control Centers "each connected to a network of up to 4,000 cameras." Federal and state police forces "continue to enjoy access to the technology that was bought more than ten years ago, as does the military."
Qatar 2022 — CCTV, drones, and facial recognition deployed for security, with documentation of use "not just for event security" and disproportionate effect on women, people of colour, and LGBTQ+ people. "Years after the tournament ended, these biometric systems remain operational."
Paris 2024 — the May 2023 Olympic and Paralympic Games Act was "the first legislation of its kind in the country that aimed to legalize algorithmic video surveillance," and the French government's later authorization of algorithmic video surveillance "through 2025, long after the games were over," is described as setting "a worrying precedent."
For 2026 the report "found little evidence of a clear definition of if and how the newly acquired surveillance stack would be dismounted after the 2026 World Cup ends," naming Boston, Toronto, and Vancouver as "the notable exceptions."
Human rights action plans
FIFA required host cities to publish Human Rights Action Plans for the first time in World Cup history, against the June 2024 "FWC26 Human Rights Framework," whose public-safety category encourages "addressing potential risks to the right to privacy" and "the responsible use of personal data and surveillance and AI technology."
RDR's assessment is that the requirement was welcomed but underdelivered: "these roadmaps fell far short of what should be expected of an event of this magnitude." The final plans "were published not long ahead of the first match in mid-June, limiting meaningful analysis and feedback"; "very few cities considered potential privacy violations associated with the widespread use of surveillance tech," and most "failed to specify how both the host cities and the companies involved would respect and protect attendees' freedom of expression and information as well as privacy."
Chilling effects
The report's account of the harm to ordinary attendees runs through chilling effects rather than through specific abuses. Citing Jon Penney, it holds that chilling effects extend beyond legal self-censorship to "shape speech and behavior toward social conformity," with "even the mere possibility or reminder that they might be under surveillance" leading people "to act more in conformity with pro-social norms."
Technology adds a further layer: some technologies identified "are deployed covertly, so their use is not immediately apparent," and "even if people know or realize they are being recorded, they may not be aware of who is watching, what authority they hold, and how the data collected will be used or shared with third parties."
Relationships
- supports: Surveillance Technology — documents deployment at mega-event scale across three jurisdictions
- related: AI and Surveillance — supplies the five-layer stack taxonomy and the persistence argument
- supports: Predictive Policing — one of the five stack layers
- related: Clearview AI, Palantir Technologies, ICE — Immigration and Customs Enforcement (AI Deployer), Ranking Digital Rights, AI and Privacy