Mexico has set midnight on June 30, 2026 as the moment every one of its roughly 144 million mobile lines must be linked to the national identity code (CURP) and a valid official ID, or face suspension on July 1. By the government's own numbers, that deadline is on track to fail. The Comisión Reguladora de Telecomunicaciones (CRT) reported only about 48 million lines registered as of mid-May 2026 — barely a third of the market — leaving some 96 million numbers exposed to disconnection. The regulator has explicitly ruled out any extension. The result is a collision between a hard legal cutoff and a public that is, in effect, voting against the policy by not showing up.
The case for the registry is real
It is worth stating the strongest version of the government's argument, because it is not frivolous. Telephone extortion and "virtual kidnapping" run on anonymously purchased prepaid SIMs are a genuine and large-scale problem in Mexico. Linking each number to a verifiable, accountable identity is a coherent way to raise the cost of using a throwaway line to extort a family or defraud a pensioner. Most postpaid customers already hand over identity documents; extending that to prepaid is, on its face, a modest step toward removing the anonymity that organized crime exploits. A state has a legitimate interest in being able to trace a line used to commit a felony.
But the Court already weighed this — and said no
The problem is that Mexico has run this experiment before. In 2021 it built PANAUT, the Padrón Nacional de Usuarios de Telefonía Móvil, and on April 25, 2022 the Supreme Court (SCJN) struck it down. Nine of eleven justices, ruling on Acción de Inconstitucionalidad 82/2021, found the registry unconstitutional. Justice Norma Piña wrote that a mandatory user registry "is not a necessary measure in a democracy, since it does not maintain a balance between the need for data in limited circumstances and the right to privacy." The Court's logic was a textbook proportionality test: the state had not shown the database would actually reduce extortion or kidnapping, while the privacy and security risks of a centralized honeypot of citizen data were concrete and severe. That evidentiary gap has not closed. The GSMA, the global mobile-operator association, has repeatedly found no evidence that mandatory SIM registration reduces crime — and some evidence it fuels SIM-swap fraud and identity theft instead.
"No biometrics" — except the key it links to
The government's defense is that the 2026 padrón is narrower than PANAUT. The CRT insists it stores no fingerprints or iris scans; lines are tied only to the CURP and an official ID, with at most a real-time facial "proof of life" check that is not retained. On paper, that directly answers the 2022 ruling, and the courts have agreed that ID-linkage without stored biometrics can stand.
Two things complicate the reassurance. First, the CURP itself is being converted into a biometric CURP — capturing fingerprints, a facial photograph and an iris scan, administered by RENAPO under the Secretaría de Gobernación. Linking every phone line to that single key wires the telecom registry into precisely the kind of centralized biometric identity platform the Court found disproportionate. The fact that the operator does not hold the biometrics is little comfort when the identifier it does hold resolves to a government database that does. Second, safeguards have moved the wrong way. R3D, the digital-rights group leading the objection, points out that Mexico simultaneously expanded intelligence powers letting authorities pull telecom data without prior judicial authorization, and that a Telcel security flaw already exposed data tied to phone lines. A registry is only as safe as the access controls around it, and those controls are weaker, not stronger, than in 2021.
The disconnection is the policy's real cost
Mass non-compliance is not apathy; it is a signal. When two-thirds of a market declines to enrol in a scheme that threatens to cut off banking apps, government services and messaging, the proportionality problem becomes practical, not just doctrinal. Suspending tens of millions of lines would fall hardest on exactly the people least able to absorb it — prepaid users, the elderly, rural households, and undocumented migrants who cannot produce the required ID and for whom a working phone can be a lifeline. R3D specifically warns that journalists, activists and human-rights defenders face elevated risk when every line is mapped to a state-held identity.
A proportionate path exists
None of this requires tolerating anonymous extortion. It requires matching means to ends. Operators already collect know-your-customer data; the legitimate law-enforcement need — tracing a specific line tied to a specific crime — is met by targeted, warrant-based requests against that existing data, with independent oversight and audit logging, not by a permanent, biometric-linked registry of the entire population. A least-restrictive design would decouple the padrón from the biometric CURP, bar bulk access without judicial sign-off, set a hard retention sunset, and drop the all-or-nothing disconnection threat in favour of enforcement against fraudulent activations.
Mexico's own highest court has already drawn this line once. Building a slightly relabelled version of a registry the SCJN invalidated, and enforcing it with a deadline most of the country is ignoring, is not a proportionate answer to a real problem. It is the same answer the Court rejected, wearing a different acronym.