On June 25, 2026, Mexico's Telecommunications Regulatory Commission (CRT) announced what it had publicly promised would not happen: an extension. The mandatory deadline to link all mobile phone lines to a biometric national identity number — the CURP — was pushed from June 30 to a staggered schedule running through December, with each user's new cutoff determined by the last digit of their phone number. The CRT's own announcement (Boletín 021/2026) confirmed that only 63 million of Mexico's roughly 145 million active mobile lines had been linked by that date — 40.2 million prepaid and 22.8 million postpaid. For a program marketed as a public-safety necessity, the numbers represent a significant institutional shortfall, and one with a history behind it.
The Government's Case Deserves to Be Stated Fairly
Mexico's extortion crisis is not a fabrication. Criminal organizations routinely use unregistered prepaid SIM cards to coordinate kidnappings, ransomware campaigns, and phone-based extortion — often without any trail linking a number to a real person. The CRT, issuing its formal guidelines in December 2025 (Boletín 008/2025), stated the rationale plainly: the mandate exists to eliminate "the anonymity that allows using this service to commit crimes." Similar arguments have driven SIM registration mandates across India, Nigeria, and Indonesia. The goal has genuine policy weight.
The problem is not the stated objective. It is whether this particular infrastructure achieves it — proportionately, and at tolerable cost to civil liberties.
Forty Percent Is Not a Registry
The enrollment figures make the structural problem visible. With 63 million lines linked and approximately 81 million still unregistered five months after the mandate launched on January 9, 2026, the majority of Mexico's mobile market had not complied. Prepaid lines — which represent the bulk of unregistered numbers — are disproportionately held by lower-income users, migrants, and rural populations who face the greatest friction in biometric enrollment processes that require in-person identity verification.
In April, the CRT's own president stated publicly there would be "no extension." The announcement of one on June 25 disproves the assumption underlying that statement: that compliance at this scale can be administratively compelled. Non-compliance of this magnitude is a signal, not a logistical problem.
The new staggered calendar assigns deadlines from August 15 (numbers ending in 0) through December 31 (numbers ending in 9). After each date passes, carriers must suspend service on unlinked lines within 72 hours, restricting them to emergency calls, citizen services, and seismic alerts. Users can restore service by completing registration afterward — but the practical consequence of missing the deadline falls hardest on users who lack the documentation or access to biometric enrollment modules to comply in the first place.
This Is Mexico's Third Attempt at This Idea
Mexico's first mandatory biometric SIM registry — PANAUT (the National Registry of Mobile Telephony Users) — was passed in April 2021 and required carriers to collect fingerprint and biometric data from over 120 million users. On April 25, 2022, Mexico's Supreme Court of Justice (SCJN) declared PANAUT unconstitutional by a 9-2 vote. Justice Norma Lucía Piña Hernández held that the registry was "not a necessary measure in a democracy, since it does not maintain a balance between the need for data in limited circumstances and the right to privacy." The court found that less restrictive mechanisms already existed to accomplish the same law-enforcement objectives.
The current system — built on a biometric CURP mandated by presidential decree in July 2025 and operationalized through the December 2025 CRT guidelines — is architecturally distinct from PANAUT but raises the same structural questions. Courts in Yucatán, Querétaro, and Mexico City have issued injunctions against aspects of the biometric requirements. The constitutional conversation is not closed.
What the Infrastructure Can Actually Do
Digital rights organization R3D (Red en Defensa de los Derechos Digitales) analyzed the January 2026 launch and found that registration began "without safeguards against abuse." The concerns are technically specific.
Mexico's National Intelligence Law permits security agencies to access private telecommunications data without judicial authorization. A registry that links biometric identifiers — facial photograph, fingerprints, iris scans — to every phone line in the country is not simply a directory of numbers. It is an indexed key capable of surfacing communication networks, geographic movement, and — via cross-referencing with Mexico's Unified Identity Platform launched in 2025 — health, financial, and civil registry records. R3D also documented a Telcel vulnerability that exposed personal data associated with phone registrations during the early enrollment period: an operational failure before the registry had even approached full coverage.
Access Now raised the same concern during PANAUT: in a context where security authorities have documented ties to organized crime, creating a national biometric-telephony database converts a public-safety tool into an instrument of potential capture.
Who Bears the Risk
The populations most exposed to anonymous SIM elimination are rarely extortionists. They include undocumented migrants who cannot produce standard documentation; domestic violence survivors who use unregistered lines to maintain contact with support networks; journalists whose source-protection protocols depend on communication privacy; and activists whose risk profile increases when their phone lines become indexed to a government biometric database. R3D specifically flagged that the registration requirement for foreigners — requiring passports or provisional identity documents — creates barriers that threaten migrant safety.
The biometric CURP requires in-person enrollment at government modules. For users in remote areas, or those who distrust state data systems on well-founded historical grounds, that friction is not incidental to the policy. It is the policy.
The Window the Extension Opens
The SCJN said in 2022 that less restrictive alternatives existed. Targeted judicial warrants allowing law enforcement to de-anonymize specific lines under investigation are one such mechanism — one that accomplishes the crime-fighting objective without requiring 145 million users to submit their biometric data to a centralized database governed by rules that permit warrantless intelligence access.
The CRT's extension to December creates a six-month window. The question is not whether Mexico should use it to push enrollment harder — but whether it should use it to ask whether bulk biometric collection from an entire population is proportionate to the problem a more targeted system could solve. A registry that 60 percent of the country has not joined is not, functionally, a registry. It is an infrastructure awaiting a legal theory that can hold.