Mexico has set June 30, 2026 as the date on which roughly 90 million mobile lines could go dark. Under guidelines the new Comisión Reguladora de Telecomunicaciones (CRT) published in the Diario Oficial de la Federación on December 9, 2025, every mobile line must be linked to its holder's CURP — the unique population registry code — plus a valid photo ID. Lines that miss the cutoff face suspension to emergency calls only from July 1. The problem is that almost nobody is complying, and the legal architecture meant to protect the resulting database has been dismantled.
A mandate the public is quietly refusing
The numbers are stark. As of May 13, 2026, only about 48 million of roughly 144 million lines had been registered — reported in late May as the deadline loomed. By early June, an Infobae review of regulator and industry data found roughly 92.6 million lines still unlinked out of 158.9 million active lines at the close of Q1 2026 — nearly 58% non-compliant. The consultancy CIU projected that more than 60% of Mexican mobile users would not register in time. A mandate this widely ignored is not a public that misunderstands the rules; it is a public voting with its silence.
The case for the registry, stated fairly
The government's rationale deserves a fair hearing. Extortion, kidnapping-by-phone, and SIM-enabled fraud are real and devastating in Mexico, and anonymous prepaid SIMs are a genuine instrument of those crimes. Tying a line to a verified identity, the argument goes, raises the cost of using throwaway numbers and gives investigators a lead they currently lack. Notably, the CRT drafted these guidelines more carefully than its predecessor: the rules explicitly bar carriers and the registry platform from storing biometric data, photos, or copies of IDs, cap individuals at 10 lines, and prohibit charging users for the process. That is a real improvement over the 2021 design.
But a narrower mandate does not cure the deeper defect, and Mexico has already litigated exactly this question.
The PANAUT ghost the Court already exorcised
In April 2021, Mexico created the Padrón Nacional de Usuarios de Telefonía Móvil (PANAUT), requiring carriers to collect users' names, CURP, and biometric data. The INAI and a Senate minority challenged it. On April 25, 2022, the Supreme Court's full bench, resolving Acción de Inconstitucionalidad 82/2021, struck the registry down in its entirety by a 9–2 vote. Justice Norma Piña wrote that a national registry of phone users "is not a necessary measure in a democracy." The Court's core holding was a proportionality failure: the registry restricted privacy and data-protection rights when "equally suitable but less harmful" alternatives existed to pursue public security.
The CRT registry drops biometrics, and supporters argue that distinction places it outside the 2022 ruling. That reading is too convenient. The Court did not object only to fingerprints; it objected to building a centralized, identity-linked database of an entire population's phone use as a crime-fighting tool when the state had not shown such a database was necessary or that targeted, warrant-based access could not do the job. A CURP-keyed registry of 144 million lines still creates a single high-value map of who-uses-which-number — a permanent honeypot for breach, abuse, and function creep. The mechanism the Court found disproportionate is back; only one of its components has been trimmed.
The safeguard that no longer exists
What makes the 2026 version worse than 2021 is not the registry's design — it is the supervisory vacuum around it. The INAI, the autonomous data-protection authority that brought the case against PANAUT, no longer exists. A constitutional "organic simplification" reform approved on November 28, 2024 dissolved seven independent bodies; INAI's functions were folded into the executive-branch Ministry of Anti-Corruption and Good Government, effective March 21, 2025 under a new Federal Law on Protection of Personal Data Held by Private Parties.
So the entity now meant to guard citizens' data is part of the same executive that built the registry — the regulator marking its own homework. Worse, the implementing regulations for the 2025 data-protection law remain unissued, leaving carriers and the registry platform operating without detailed rules on retention, access logging, breach notification, or redress. A mandatory population-scale database is being populated before the rulebook governing it has been written, and the only institution that could have litigated against it has been abolished.
A proportionate path exists — Mexico just had it
The pro-innovation, proportionate position here is not "do nothing about extortion." It is the position the Supreme Court itself articulated in 2022: pursue the least-restrictive means. Investigators can already obtain targeted, judicially authorized access to subscriber and traffic data tied to specific suspects. That model fights crime without conscripting 144 million people into a standing registry, and without manufacturing a breach surface that the PeopleSoft and similar zero-days of 2026 remind us cannot be assumed secure.
The mass non-compliance is, in effect, the public re-running the proportionality test the Court already ran. Before July 1 turns a privacy dispute into 90 million suspended lines, Mexico should pause the cutoff, issue the data-protection regulations first, and restore independent oversight. A registry that the courts found disproportionate, that the public is refusing, and that no independent watchdog supervises is not a security measure. It is a liability the state is building on purpose.