On July 1, 2026, every Mexican mobile line not linked to its owner's CURP — the unique population ID now being converted into a biometric record of face, fingerprints, and iris — is supposed to go dark. The Comisión Reguladora de Telecomunicaciones (CRT) has set a June 30 deadline for roughly 127 million active lines and ruled out any extension. The rollout continues despite a Yucatán court suspension on privacy grounds and a pledged legal challenge from digital-rights group R3D. As of late May, only about 52.4 million lines had been linked, according to CRT figures cited by El Imparcial — meaning tens of millions of working numbers could be cut off in a matter of weeks.
The case the government is making
The state's argument deserves to be stated at its strongest. Extortion, virtual kidnapping, and SIM-enabled fraud are real and pervasive in Mexico, and anonymous prepaid lines are a genuine instrument of those crimes. When a federal collegiate tribunal revoked an earlier suspension against the registry, it reasoned — as El Cronista reported — that halting the measure would damage orden público e interés social, invoking the state's capacity to locate disappeared persons in a country with more than 100,000 missing. A verified line, the logic runs, is a thread investigators can pull. That is not a frivolous goal, and any honest critic should concede the registry could, at the margin, aid some investigations.
Why the architecture matters more than the denial
The CRT's public defense rests on a careful claim: there is no central database. Its official portal, registratulinea.crt.gob.mx, states plainly that no fingerprint or iris data is collected for the phone link, that registration is a one-time "proof of life" against a government ID, and that each carrier — not the state — stores the customer record under Mexico's data-protection law. Taken alone, that sounds proportionate.
The problem is what the CURP itself has become. Under 2025 reforms to the Ley General de Población championed by President Sheinbaum, the CURP is being upgraded into a mandatory biometric credential housed in a new Plataforma Única de Identidad. R3D, the group now litigating, documented the design: the platform is built for real-time monitoring of CURP usage, integrates telecom, financial, and health records against a single identity, and — critically — grants federal prosecutors, the National Intelligence Center, and the armed forces consultation access without prior judicial authorization. Once every phone line is keyed to that biometric identifier, the question of where the row physically sits becomes cosmetic. Carrier-side storage does not decentralize anything when the join key is a pointer into one centralized biometric hub that security agencies can already query. The government is technically correct that phones store no faceprints, and substantively wrong about what the system can do.
Mexico has already lost this argument once
This is not a novel concern; it is settled Mexican constitutional law. In 2022 the Suprema Corte struck down PANAUT, the previous biometric phone registry, finding it disproportionate and a violation of the right to privacy and data protection. The new scheme is an attempt to route around that ruling by having carriers, rather than a single regulator, perform the linkage. R3D's response is direct: the distinction dissolves the moment the CURP carries biometrics, because the constitutional defect the Court identified — a coerced, mandatory, mass biometric system with weak controls — is reproduced one layer up. A workaround that recreates the exact harm a court already condemned is not compliance; it is evasion.
The institutional backsliding underneath
The surveillance question is compounded by a governance one. The CRT did not exist a year ago. Mexico's new Ley en Materia de Telecomunicaciones y Radiodifusión, enacted in July 2025, dissolved the independent Instituto Federal de Telecomunicaciones and replaced it with the CRT as a órgano desconcentrado of the executive-branch Agencia de Transformación Digital y Telecomunicaciones, which began operating in October 2025. The regulator now enforcing a biometric mandate over the objection of courts is, by design, no longer independent of the government that wants the data. That is precisely the configuration under which surveillance infrastructure tends to expand without friction.
The proportionality test it fails
A pro-innovation, proportionate-regulation standard does not reject identity verification outright — it asks whether the least-intrusive means was chosen and whether the benefit is evidenced. Here it was not. There is no published evidence that PANAUT-style registries reduced extortion; criminals migrate to stolen identities, foreign eSIMs, and over-the-top messaging, while the compliant majority surrenders permanent, irreplaceable biometrics. The early returns underline the cost: The CIU estimates more than 3.26 million lines simply went inactive in the first quarter of 2026, and with only about 40% of lines registered by late May, a hard cutoff threatens working numbers, small businesses, and the elderly and disabled who struggle with biometric capture.
The better path is narrower and already lawful: targeted, court-authorized access to subscriber data for specific investigations, paired with strict purpose limitation and an independent regulator to police it. Mexico has dismantled the last of those guardrails while building the database the Supreme Court told it not to build. The deadline should be paused until the constitutional challenge R3D has promised is resolved — not enforced against 127 million people first and adjudicated later.