A test case for consent-based identity
On August 6, 2026, the Décimo Tribunal Colegiado en Materia Administrativa del Primer Circuito is set to rule on Amparo en Revisión 100/2026 — an appeal by the press-freedom group Artículo 19 seeking to revive indirect amparo 1466/2025, its constitutional challenge to Mexico's biometric CURP system and the interconnected government databases built around it. A lower court, the Juzgado Séptimo de Distrito, had thrown the case out on a technicality: no concrete harm exists, it reasoned, until the Plataforma Única de Identidad (PUI) is fully operational. Artículo 19 argues that reasoning gets the timeline backwards — the injury began the moment the underlying reforms took effect.
What actually changed
On July 16, 2025, Mexico's Diario Oficial de la Federación published a package of reforms to the Ley General de Población and six other statutes — covering the National Guard, telecommunications, forced-disappearance search protocols, and national intelligence — that together made the CURP (Clave Única de Registro de Población) a biometric credential incorporating fingerprints and photographs, and established it as a mandatory identifier that public agencies and, per the reform, private organizations must accept on presentation. The digital rights group R3D, which filed parallel amparos against the same package on September 2, 2025, estimates the resulting architecture touches "más de 130 millones de personas que habitan o visitan el país" — effectively the entire population plus visitors — through interconnected records spanning health, education, transport, telecoms, financial services, social security, and migration.
Steelmanning the case for it
The government's justification is not frivolous. Mexico's forced-disappearance crisis is real and unresolved — the reform package was bundled explicitly with amendments to the General Law on Forced Disappearance, and officials have framed biometric identity infrastructure as a tool to accelerate the search, location, and identification of missing persons across fragmented civil registries. A March 16, 2026 ruling by a separate tribunal, the Decimocuarto Tribunal Colegiado, made exactly this argument when it overturned a suspension against biometric CURP requirements for mobile-phone registration: the panel held unanimously that blocking the rule would harm "public order and social interest" because linking phone lines to verified identity aids investigations into disappearances and phone-enabled extortion. Fragmented, unverifiable identity records genuinely do hamper both social-service delivery and criminal investigation in a country where forged IDs and duplicate registrations are common. A single, biometrically anchored identifier is not an inherently illegitimate policy goal.
Why the design still fails a proportionality test
The problem is not that Mexico wants better identity verification — it's that this system was built without the two features that make biometric ID schemes elsewhere (India's Aadhaar post-Puttaswamy, the EU's eIDAS) survive judicial review: purpose limitation and independent oversight. Artículo 19's amparo lists the rights it says are implicated — privacy, personal data protection, legal certainty, and freedom of expression — precisely because the reform authorizes real-time consultation and interconnection across sectoral databases with no judicial warrant requirement and no notice to the person being tracked, according to R3D's parallel filing. And Mexico dismantled its independent data-protection regulator at the worst possible moment: the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) stopped operating on March 20, 2025, with its functions folded into Transparencia para el Pueblo, a single administrator appointed directly by the executive rather than a collegiate, autonomous board. A mandatory, centralized biometric database is precisely the kind of system that most needs an independent watchdog with subpoena power — and Mexico built the database first and removed the watchdog months before switching it on.
The consent problem is not cosmetic
Government officials, including Secretaría de Gobernación head Rosa Icela Rodríguez, have stressed that biometric CURP enrollment is voluntary through 2026. That framing understates the coercion built into the design: once public agencies and private companies are required to accept the biometric CURP when presented, and once telecom carriers can be compelled to cancel service for unlinked phone lines, the choice not to enroll carries a real cost — a point R3D raises directly, arguing consent becomes illusory when refusing it forfeits access to essential services. A consent mechanism that only works if you're willing to lose your phone line is not meaningfully consensual.
The fix is achievable, not radical
None of this requires scrapping biometric identity or the disappearance-search mission that motivated it. It requires narrowing database interconnection to specific, judicially authorized investigative purposes rather than blanket real-time access; restoring an autonomous data-protection authority with enforcement teeth; and building an actual opt-out path that doesn't require forfeiting a phone line or a bank account. The August 6 ruling won't resolve any of that — at most it decides whether Artículo 19's case gets heard on the merits rather than dismissed on standing. But it's the first moment a Mexican court will have to engage with whether "the platform isn't live yet" is a legitimate reason to defer scrutiny of a surveillance architecture that, by design, only works once it's everywhere.