Since April 13, 2026, the road into Mecca runs through a phone. Saudi Arabia's Ministry of Interior has closed the holy city to anyone without a Hajj permit, a Mecca-issued residency ID, or a holy-site work permit, with security checkpoints on every approach road turning back those who lack the right credential. From April 18, holders of Umrah and visit visas may not enter or remain at all. The permit that satisfies the gate is not a stamped paper. For Saudi citizens and residents it exists inside Tawakkalna, the government's all-purpose identity app; for international pilgrims it lives in Nusuk, the Ministry of Hajj and Umrah's booking platform, materialised as a smart "Nusuk Card" that pilgrims must present to enter Mina, Arafat, and Muzdalifah and to board group transport. The state app is no longer a convenience layered over the pilgrimage. It is the pilgrimage's only legal entrance.
The case for the gate is real
It would be dishonest to treat this as gratuitous control. Crowd management at Hajj is a genuine life-or-death problem, and unpermitted pilgrims are at the centre of it. In 2024, more than 1,300 people died during the pilgrimage amid temperatures near 50°C; Saudi authorities reported that roughly 83% of the dead were unauthorised pilgrims who had walked long distances in extreme heat with no hotel to shelter in, because they had no permit and therefore no booked accommodation (Journal of Travel Medicine, 2024). A permit system that ties each pilgrim to verified housing, transport, and a head-count is not bureaucratic theatre — it is a credible answer to a recurring mass-casualty event. Digitising it removes forgeable paper, speeds checkpoint flow, and lets organisers see capacity in real time. On the safety merits, a binding registration requirement is proportionate to the harm.
Where proportionality breaks
The problem is not that Saudi Arabia requires a permit. It is that it has fused permit, identity, and access into a single state-controlled app and made that app the exclusive channel for a religious obligation that 1.8 billion Muslims may undertake once in a lifetime. Three design choices turn a reasonable safety rule into something heavier.
First, the penalties are severe and tilted toward deterrence over harm. The Ministry of Interior set a fine of up to SAR 20,000 for performing or attempting Hajj without a permit, and up to SAR 100,000 — multiplied per person — for transporting, sheltering, or arranging visas for unpermitted pilgrims, with deportation and a ten-year re-entry ban for resident violators (Khaleej Times, citing the Ministry of Interior). Punishing the trafficking networks that abandoned pilgrims in the 2024 heat is defensible. Sweeping in a resident who gives a relative a lift, at six figures per head, is not calibrated to the risk.
Second, the app is a single point of exclusion. When the only door requires a smartphone, a working government login, biometric enrolment, and a successful registration draw, the people most likely to be locked out are the poor, the elderly, and pilgrims from countries with low digital penetration — precisely the populations that have historically reached Mecca through informal channels. A safety system that excludes by device ownership has quietly changed who may worship.
Third, and most important, the same digital apparatus is demonstrably dual-use. A state that can make your permit appear in an app can make other things disappear from your screen. In the same weeks this gate went up, Meta — at the Saudi government's request — geo-blocked the Facebook accounts of human-rights groups ALQST and Democratic Diwan and researchers including Abdullah Alaoudh and Yahya Assiri so they became "unavailable" inside Saudi Arabia, part of more than 100 pages and accounts restricted since March 2026 (Access Now/ALQST). The lesson is not that Tawakkalna will censor pilgrims. It is that concentrating identity, access, and presence inside government-run software hands the state a chokepoint, and Riyadh has shown in an adjacent domain exactly how it uses chokepoints.
The pattern is global, and worth naming
This is not a uniquely Saudi instinct. The Electronic Frontier Foundation warned on June 5, 2026 that mandatory digital identity and age-verification gates are "a growing global threat," forcing all users to surface private credentials to access ordinary online life and building surveillance infrastructure that affects everyone, not just the targeted group. Mecca's app-gate is the physical-world version of the same move: a legitimate goal (safety, or child protection) used to justify a mandatory, identity-bound, state-operated checkpoint that, once built, can be repurposed.
What proportionate looks like
A pro-innovation reading does not demand that Saudi Arabia abandon permits or digital tooling — both are good. It asks for the guardrails that keep a safety tool from becoming a control tool. Keep a non-app fallback (a verified paper card issued at consulates) so device ownership is never the dividing line between worship and exclusion. Scale fines to actual endangerment, not to flat per-head maximums that criminalise ordinary kindness. Publish, independently and routinely, what the permit apps collect and how long location and biometric data persist after the pilgrimage ends. And firewall the Hajj credential from the broader Tawakkalna surveillance stack, so the door to Mecca cannot double as a window into the people who walk through it.
The gate is defensible. The monopoly behind it is what deserves scrutiny.