Mexico does not ban or restrict VPNs. Searches turned up no such measure, and the platform-blocking Article 109 was dropped from the 2025 telecom law. The live policy that matters for online anonymity is a different one: the mandatory registry that ties every mobile line to a verified identity.
What is actually happening
The Comisión Reguladora de Telecomunicaciones (CRT) published its Lineamientos para la Identificación de Líneas Telefónicas Móviles in the Diario Oficial de la Federación on December 9, 2025. Registration opened on January 9, 2026. Individuals must present a voter credential or passport plus a CURP, and companies must present an RFC. In its press release, the CRT describes the rationale as eliminating anonymity in mobile use to prevent crime.
The original deadline was late June. On June 30, 2026, the CRT modified the guidelines to set staggered deadlines. Enforcement now runs by the last digit of the number. Lines ending in 1 were cut after August 31, and lines ending in 2 hit their deadline on September 15, 2026. Later digits follow through the end of the year.
According to the CRT figures reported by El Financiero, 9,550,278 lines ending in 1 were linked as of September 3. That is 83.4% of an estimated 11.45 million lines in that block. Another 1,902,619 were temporarily suspended, and 1,162,793 of those had already been reactivated. Nationwide, about 80.9 million lines were linked.
The strongest case for the registry
The case for the registry deserves a fair hearing. Mexico has a serious extortion and fraud problem, and prepaid SIMs are cheap, disposable and anonymous. Postpaid customers were already identified at signup, so the rule extends an existing norm to prepaid users. The CRT also stresses that suspension is not cancellation: service resumes immediately once the user registers, and suspended lines can still call emergency numbers. Suspending a line is milder than the permanent cancellation that some other countries have used.
Why the evidence for it is thin
The crime-reduction claim is weaker than the policy's confidence suggests. The digital-rights group R3D notes that the GSMA found no evidence that mandatory registration reduces extortion or kidnapping. It also argues that roughly 90% of phone extortion runs through VoIP services that bypass the registry. R3D warns that registration can push criminals toward SIM cloning, phone theft and contraband, and that its recommended transparency rules were not adopted. Those rules would have required reporting on how often authorities access the data and whether they held warrants. R3D also points to the 2025 National Intelligence Law, which it says lets authorities obtain carrier data without a judicial order. These are R3D's claims, and readers should weigh them as advocacy, but they are specific and checkable.
There is also a precedent. Infobae recalls that Mexico's Supreme Court invalidated the earlier PANAUT registry in 2022. It found biometric collection disproportionate and risky for data leaks. Infobae also reports that the current system keeps data with individual carriers rather than in one central government database. That design lowers the breach risk, but it multiplies the number of custodians. R3D cites a vulnerability in Telcel's registration system that exposed personal data.
Where VPNs come in
This is why the VPN question matters even though no VPN rule exists. A VPN can hide which sites a user visits from the local network and the carrier. It cannot change who the carrier believes the subscriber is. Once every prepaid SIM is bound to a CURP, the subscriber's identity sits with the carrier and is available to authorities under criminal-procedure requests. Data traffic, calls and location metadata all attach to that verified account. Users can still encrypt what they say and read, but they can no longer be anonymous at the network layer.
The irony is that Mexico's internet remains open. Blocking, filtering and VPN restrictions, the tools of more repressive regimes, are absent. The registry achieves a large part of the same identification effect through the SIM instead.
A proportionate alternative
A pro-innovation, evidence-based approach would not scrap fraud prevention. It would narrow the tool to fit the harm:
- Publish effectiveness metrics. The CRT should report extortion and fraud rates before and after each deadline wave, so the policy can be judged on results.
- Adopt the transparency rules R3D proposed. That means public counts of authority data requests and of how many came with a judicial warrant.
- Set retention limits and breach obligations for carriers. The rules should be enforceable, with penalties.
- Add a sunset review. The registry should be re-examined at a fixed date, not left in place indefinitely.
- Protect vulnerable users. Migrants and foreign nationals who depend on passports or provisional CURPs need access to service.
The registry's staggered rollout gives the CRT natural checkpoints. With lines ending in 3 due on September 30 and later digits through December, there is time to collect evidence before the last waves. If the data show the registry cutting fraud, the case for it strengthens. If they do not, Mexico will have given up a measure of mobile anonymity for little gain, and no VPN can win it back.