Is Uber Safe in Brazil? What Gets Checked, and What Does Not

The missing number has two halves, and Uber fills both abroad

To put a number on it — incidents per million rides — you need two figures. Brazil publishes neither.

The numerator would be incidents tagged as ride-hailing. No public dataset carries that category — the three crime datasets and what they separate instead is the longer version, and the same silence is why there is no robbery rate for visitors.

The denominator would be rides. 99 publishes a list of cities and Uber claims the national territory with a footnote redefining what a city is; neither figure is a trip count.

Then the detail that settles it. Uber has published exactly this arithmetic — for the United States. It released a U.S. Safety Report in December 2019 and a second in June 2022, counting fatal crashes, 3,824 reports across the five most severe categories of sexual assault and misconduct for 2019 and 2020, and the share of trips finishing with no safety report at all — more than 99.9%. Its stated reason for publishing at all, in that announcement: "By sharing our safety record, we can help end the silence surrounding issues like gender-based violence". The number is not impossible to produce. It is just not produced here.

The criminal-record certificate is a snapshot of one system

Federal law sets four conditions on a driver, and the fourth is a clean criminal-record certificate — required only in municipalities that chose to regulate the service, and named without an issuing authority. The one we could read in full is the Federal Police's, and it describes its own scope in a single line: it reports criminal records held in the Federal Police's computerised systems, is issued free online, and is valid for 90 days. That is a true statement about a federal database: it does not claim to read what a state court holds, and the law never says which certificate satisfies the requirement.

The 90 days matter: the document is a photograph of one system on one morning, not a subscription. Whether a second photograph is ever taken is a separate question, with a separate answer.

São Paulo keeps the register and hands the checking to the company

Of the three big cities we opened, only São Paulo's decree is still in force. It requires the driver to hold a municipal registration, CONDUAPP, and the car a safety certificate, CSVAPP — and it is explicit about who guarantees the paperwork. The decree puts on the platform itself the duty to register, manage and assure the truthfulness of the information drivers provide.

So the company that describes its own verification process on its website is also the party the city holds responsible for that verification being true.

How often the check repeats is not in the decree: it delegates the validity of both documents to a resolution of the road-use committee. We opened the committee's Resolution 33 of September 24, 2024, and what it fixes is the platforms' credentialing — valid to December 31 of the following year, renewed automatically — not the driver's registration. The same resolution does require platforms to report driver and vehicle registrations and removals daily.

The city also receives the trip records. The decree lists origin and destination, duration, distance, waiting time, route map, price items, rating, and identification of driver and vehicle, routed through the city's mobility data lab. Its final chapter then forbids the city and its staff from disclosing information protected by legal secrecy. The data exists in a municipal system. Publication is what does not exist.

The one public check a passenger is promised

The duty predates that resolution: the 2024 text rewrites a paragraph already in Resolution 16 of 2017, under which the city's finance secretariat must publish an online lookup showing whether a driver and a vehicle are in good standing. What 2024 adds is the next paragraph: those lookups must always be current.

The page is real: it lists three lookups, and the public one needs no password, taking a CPF and a plate and returning CONDUAPP and CSVAPP status.

⚠️ Checked on September 16, 2026, the public lookup returned "500 - Internal server error". The host's root address answered normally, so the server was reachable and the application behind it was not. One day is one day — but that register is required to be always current, and on the day we looked it answered nothing.

There is a second limit even when it works: the key is a CPF and a plate, and before a ride the app gives you a name, a photo and a plate, never the tax number.

What the companies say they do, and the conditionals they attach

Uber's Brazilian safety page describes a multi-step registration before a first trip, involving a check of criminal records and analysis of the driving licence, plus a selfie the app requests at random afterwards; passengers are verified by credit card or by tax number and date of birth against a government database. It also lists audio recording, live trip sharing, an automatic route check, and a police button — still naming Rio alone for the automatic hand-off, where the company's own newsroom counts seven places. At the foot of the page sits the sentence that governs all of it: requirements and features vary by region and may not be available.

99 counts more than 50 safety features. On drivers, it says the app checks licence and vehicle documents against more than 130 public sources, and describes criminal-record searching as a possibility its partnership affords rather than a step it completes. Its police button shares trip data depending on your federal unit, and it names no state.

None of this is audited outside the two companies: it is a process described by the party running it. What a reader can do is notice which sentences are promises and which are conditionals.

What changes with the category, and what changes with the city

The tail of this search asks by product and by city — UberX or Black, Salvador or Belém — and the two halves have different answers.

The category changes the car and the price. Every requirement we opened is written about the driver or the vehicle, never about a tier: the federal law lists its conditions for the driver, and São Paulo registers a driver and certifies a car. Nothing creates a stricter check for a more expensive category.

The city changes the rulebook itself, since the power to regulate is exclusively municipal — two of three cities we checked had repealed their decrees, which also leaves no register to look up. Your state, separately, decides whether an emergency call from the app carries the trip data automatically, which is why knowing what each number does still matters. The airport is a third regime: at Guarulhos the pickup plaza runs on the operator's rules, not a city's.

If the ride has two wheels, the legal identity changes entirely before any of this applies.

Sources

• Presidency of the Republic — Urban Mobility Law 12,587/2012, arts. 11-A and 11-B: the conditions on the driver, and the clause limiting them to cities that choose to regulate. Accessed September 16, 2026.
• Polícia Federal — Antecedentes Criminais: records held in its own computerised systems, free online, valid 90 days. Accessed September 16, 2026.
• Prefeitura de São Paulo — compiled Decree 56,981/2016, art. 4 (trip data shared with the city), 15 and 15-H (CONDUAPP, CSVAPP, delegated validity), 16 (the platform assures the data is true) and 35 (the data lab, and the disclosure ban). Accessed September 16, 2026.
• CMUV Resolution 33 of September 24, 2024 — arts. 5 and 6 on the lookup duty, the daily feed, the platforms' credentialing term. Accessed September 16, 2026.
• Secretaria Municipal da Fazenda — the three lookups, stamped February 3, 2021, and the public one, which answered 500. Accessed September 16, 2026.
• Companies — Uber's Brazilian safety page and 99's safety page. Accessed September 16, 2026.
• Uber's Brazilian newsroom — the count above. Accessed September 16, 2026.
• Uber newsroom, the second U.S. Safety Report, June 30, 2022 — the 2019–2020 counts, the 99.9% share, and the reason for publishing quoted above. Accessed September 16, 2026.

Method on how we research; author Jeff Bruno, in Curitiba. Neighbours: staying safe, getting around, all guides.

What we could not verify

• Which certificate the platforms actually request. Federal law names the document without an issuer, and neither company publishes which one it asks a driver to upload — the federal one, a state one, or both.
• Whether São Paulo's public lookup works when the server does. It answered with an error on the day we checked, so we never saw its form, and cannot say whether a plate alone is enough without a CPF.
• How often a driver's registration must be renewed in São Paulo. The decree delegates that period to a committee resolution; the 2024 resolution we opened sets the platforms' term, not the driver's, and the 2017 resolution it amends did not open at the catalogue URL that served the 2024 one.
• Whether Uber or 99 publishes any Brazilian incident report. Uber's Brazilian newsroom listed 706 articles on September 16, 2026, and the safety items there announce features, not counts; we found no Brazil equivalent, and none from 99.
• Whether either company's checks run as described. Nothing we opened audits them, and the municipal decree makes the platform itself responsible for the truth of the driver data.