Mexico just told 127 million people: scan your face, or lose your phone. Then, quietly, they backed down.
A story about what happens when a government asks too much, too fast — and people simply say no.
Governments rarely announce that they’re building a surveillance system.
They announce that they’re keeping you safe. They announce that they’re stopping criminals. They announce that it’s just a phone registration, or a traffic filter, or an age check, or a digital ID, and that if you’ve got nothing to hide, you’ve got nothing to worry about.
Mexico said all of those things. And then 127 million people quietly said no.
This is what happened.
Here’s what they announced
On 1st July 2026 (today), every mobile phone in Mexico that wasn’t linked to a real, named person whose identity the Mexican government could verify was due to be switched off.
Not some phones.
Every pay-as-you-go phone.
An estimated 158 million active mobile lines.
In a country of around 130 million people.
To keep their phone working, Mexican phone users had to register it using their CURP (Clave Única de Registro de Población) - pronounced ‘kurp’ (Spanish for Unique Population Registry Code). Think of it a bit like a National Insurance number, but used for even more things, tax, healthcare, school enrolment, driving licences, benefits. It’s been around since 1996. Most Mexicans have one from birth. Without it, navigating daily life in Mexico is genuinely difficult.
But the 2026 law takes this somewhere new. Registration doesn’t just require a CURP number. It requires biometric data.
Biometric data is physical information that is unique to you and you alone, and I want to explain this carefully, because many people think of it as just a fancy photo or moving your head in front of a screen. It’s much more than that.
Think of it this way. Your fingerprint. The precise shape of your face. The pattern of the iris in your eye, the coloured ring around your pupil (this is as unique as a fingerprint and just as permanent). These aren’t things you chose. They’re simply part of you. What makes biometric data fundamentally different from any other kind of personal information is this, if your password is stolen, you change your password. If your bank card details are stolen, you cancel the card and get a new one. But if your fingerprints, your facial map or your iris pattern are stolen or misused, you cannot change them. Not ever. They are permanent. Once that data exists somewhere, it exists forever.
Mexico is asking for, a photograph, fingerprint scans, and iris scans, all linked to each person’s CURP code and stored by their individual phone company.
The law also created something called a Unified Identity Platform, managed by Mexico’s Ministry of the Interior (the closest equivalent to our Home Office, the department responsible for domestic security, identity and internal affairs) and a Digital Transformation Agency. This platform connects the biometric CURP with the healthcare system too.
In other words
The same system that knows their phone number
Will also know their medical history.
This isn’t quite the same as a single, unified digital ID (the kind that has been much discussed but not yet introduced in the UK). It’s something a little quieter, but in some ways more significant. A government identity number that is slowly becoming compulsory for more and more parts of everyday life in Mexico, a phone, tax affairs, social security, healthcare. Not all at once. Piece by piece, until life in Mexico without it becomes almost impossible.
And to be fair, the Mexican government has a point
I always want to give you both sides. So let’s start with the case for this, because it’s a genuine one.
Mexico has a serious, well-documented problem with extortion and kidnapping carried out by criminals using anonymous, untraceable phones. Before this law, anyone could walk into a petrol station, buy a SIM card, the small chip that connects a phone to a network, put it in a phone and make calls without giving anyone their name. Criminals and organised gangs used this to carry out kidnappings, extortion and fraud without being traceable, and this is well documented in Mexico.
The Mexican government’s official position, from their own press release:
“For the safety of all, every telephone number must be registered in the name of one person, in order to eliminate the anonymity that has allowed crime such as fraud or extortion.”
Source: The Last American Vagabond, citing the official CRT press release, 25 June 2026)
The Mexican government also points out that requiring ID to buy a SIM card is already common around the world, they claim 166 countries already do it. Independent research from the GSMA puts the number somewhere between 90 and 157 depending on the year of the research.
A note on the GSMA (Groupe Spéciale Mobile Association), the international trade body that represents mobile phone network operators worldwide, with members in more than 220 countries. When the GSMA publishes research, it carries real authority because it represents the industry itself. And the GSMA statistics indicate that the Mexican government’s figure is on the high end.
But the more important point is this, most of those countries simply ask for a name and a photo ID. What the Mexican government is asking for goes significantly further, facial scans, fingerprints and iris patterns, all stored by phone companies and linked to a government identity platform. Very few countries in the world currently require that level of biometric data just to own a phone. And the GSMA’s own research confirms there is no clear evidence that even basic SIM card registration has reduced crime anywhere it has been introduced. None.
Here’s the part most people don’t know
This is actually Mexico’s third attempt at this. The first two failed.
2008, the first attempt. Mexico launched a phone registry called RENAUT, asking everyone to register their phone number with their national ID code. According to multiple verified sources including CBS News, the database was hacked and the data sold on the black market, allegedly by or through corrupt government officials, though this was never proven in court, for as little as $500. Instead of helping catch criminals, it became what one source called ‘a shopping list for extortionists’ who now had verified names and addresses linked to phone numbers. RENAUT was abandoned by 2012.
2021, the second attempt. Mexico tried again, this time asking for biometric data too: fingerprints and facial recognition, under a programme called PANAUT. Civil rights organisations, including R3D (the Network in Defence of Digital Rights), challenged it in court. On 25 April 2022, Mexico’s Supreme Court — the highest court in the country — ruled the law unconstitutional, finding it wasn’t proportionate given the scale of what was being asked of ordinary people, and raising serious concerns about the government permanently holding everyone’s most sensitive physical data.
2026, the third attempt, now. Rather than accept the answer, told no by the courts (on behalf of the people), the Mexican government redesigned the system. The Supreme Court had objected to one centralised government database. So the 2026 system routes verification through individual phone companies instead, checked against a system run by a different government agency. The outcome for ordinary people is the same. The legal structure is different.
Legal firm Hogan Lovells, who published a detailed briefing on the new guidelines, confirmed:
“The CRT has insisted that there will be no centralised database managed by the government. Each operator will be responsible for safeguarding its customers’ information and may only share it with authorities through a court order.”
Whether this genuinely addresses the Supreme Court’s concerns, or whether it simply moves the same data to a different shelf, is a question only the courts can ultimately answer.
Six months in, here’s what actually happened
The system went live on 9th January 2026. On that very first day, an independent cybersecurity journalist discovered that Telcel (Mexico’s biggest mobile network), had a serious problem with its registration system.
When people went online to register their phone, everything appeared to be working normally. But behind the scenes, anyone who simply typed in a phone number could access the complete personal details of whoever owned that line (their name, date of birth, national ID number, tax reference and email address). No password. No verification. Just a phone number. Security experts who examined what happened said personal data was left publicly accessible for up to 36 hours before anyone fixed it.
To be clear, the biometric data itself, the fingerprints and iris scans, was not exposed. But the personal information being submitted as part of the registration was. And the government didn’t tell anyone. No announcement, no apology, no breach notification. The only reason the public found out was because an independent journalist published what he’d found.
The system was supposed to make people safer. This is what some of them said about the experience:
“They say it’s for security, but security for who? I mean, we’re always vulnerable. Our data is exposed everywhere.” - Mexico City resident, Azteca Noticias
One man who had ‘done everything right’, registered early, complied fully, told the same channel what happened next:
“Ever since I linked it, I’ve been getting messages saying I made a deposit into some illegal account, telling me it’s my bank when, well, banks don’t text you like that. And honestly, I feel like they’re stealing your information even faster.”
The system was supposed to reduce crime. For him, it appears to have increased it.
By late May, journalists found phones already registered in other people’s names being sold openly on the streets of Mexico City, for the price of a pizza, about £8. Which rather neatly answers the question of whether this stops criminals from having untraceable phones. It doesn’t. It just means they pay the price of a pizza for the privilege.
Meanwhile, R3D — the Network in Defence of Digital Rights — filed legal challenges against the law, arguing it creates ‘an unprecedented system of surveillance and social control’ giving authorities access to data about where people go, who they meet, and what they do every day. Their spokesperson José Flores put it plainly:
“We as citizens have the right to be skeptical, and the government has an obligation to explain as fully as possible what the benefits are and what security measures are being taken to safeguard our personal information.”
One detail from R3D’s challenge that’s easy to overlook: soldiers, intelligence officers and law enforcement officials all have personal phones too. If their identity, home address and workplace are now linked to a registered phone number held in a company database, that creates its own risks in a country where organised crime has a well-documented history of infiltrating official institutions.
And then, the government backed down
By late May 2026, Carlos Slim the Mexican billionaire, one of the wealthiest people on the planet, and chairman of América Móvil, the parent company of Telcel, publicly called for the process to be reconsidered. The registration process, he said at his annual press conference on 26 May, was ‘very complicated’ and should be ‘reestudiada’ (restudied). When the country’s most powerful businessman and the majority of its population are saying the same thing, something has clearly gone wrong.
The deadline was 1st July 2026, today. For months, Mexico’s Telecommunications Regulatory Commission, the CRT (Comisión Reguladora de Telecomunicaciones), the government body responsible for regulating Mexico’s phone and internet industry, had insisted the deadline was non-negotiable.
By late June, approximately only 49.5 million of an estimated 158 million active lines had been registered, around 31%.
Millions of ordinary people simply hadn’t complied.
Not through organised protest.
Not through court cases.
Just by quietly carrying on with their lives.
On Thursday 25th June, just days before today’s deadline, the CRT announced an extension. Importantly, contract phone users (people who pay a monthly bill) no longer need to register at all. Only pay-as-you-go lines still need to comply. The new staggered deadline for those lines runs from August to December 2026, based on the last digit of the phone number.
The government blinked.
Millions of ordinary people, not by marching or organising.
Just by carrying on with their lives.
Forced one of the most ambitious biometric registration programmes in the world to retreat.
At least for now.
But there’s something else on the horizon
While all of this has been happening, President Claudia Sheinbaum announced a plan to end cash payments at petrol stations and toll roads, making digital payment compulsory.
“Our goal is that this year we make it mandatory to pay for gasoline and toll booths digitally,” President Sheinbaum said in a speech in March 2026.
This means payment by bank card, mobile payment app, or digital wallet, methods that require a bank account.
This matters because roughly half of Mexican adults do not have a bank account.
For them, a cash ban isn’t an inconvenience.
It’s an exclusion.
I mention this because it’s part of the same direction of travel. A phone linked to your identity. Healthcare linked to your identity. And now purchases linked to your identity too. Each step, individually, sounds reasonable. Together they paint a picture worth paying attention to.
Who this really affects
Those who rely most heavily on anonymous phones include journalists, domestic violence survivors, and ordinary people seeking safety. For someone fleeing an abusive partner, an anonymous phone isn’t a loophole. It’s a lifeline. It’s how you ask for help without that call being traceable to someone who shouldn’t see it.
Before I close, I want to say something about the word ‘activist’, because I think it deserves a moment.
In some people’s minds, an ‘activist’ is a troublemaker.
Someone who makes noise. Someone who should probably just get on with things.
But in practice, an activist is simply someone who speaks publicly about something they believe matters.
A parent campaigning for safer roads near a school. A journalist investigating corruption. A person documenting the impact of a planning decision on their community. Many people who would never call themselves activists are, by any reasonable definition, exactly that. The right to speak, to organise, and to hold power to account is one of the things that distinguishes a democracy from something else. When surveillance systems make that harder, when people can’t make an anonymous call, send a private message, or meet someone without their movements being logged, that right quietly shrinks.
This isn’t theoretical for me. It’s something I think about every time I read about systems that remove anonymity in the name of safety. Because sometimes those two things, safety and anonymity, aren’t opposites. Sometimes anonymity is the safety.
Why this matters wherever you live
I’m not writing this to tell you Mexico is right or wrong. I genuinely think there’s a real problem the Mexican government is trying to solve, and a real cost to the way they’re trying to solve it.
What I want you to notice is the shape of the story.
A government identifies a real problem.
It proposes a solution that requires every phone user, not just those suspected of any wrongdoing,
but every single person, to permanently hand over their most personal physical data.
That data gets breached almost immediately.
A black market workaround appears within months, for the price of a pizza (about £8).
And the people the system actually inconveniences most aren’t the criminals (who simply buy a pre-registered SIM from someone on the street).
They’re ordinary people, journalists, domestic violence survivors, and anyone who simply needs to remain safe and values the privacy that makes that possible.
And then, because enough ordinary people simply didn’t go along with it
The deadline moved.
These conversations are happening much closer to home too. About digital ID. About age verification. About the systems quietly being built that ask everyone to prove who they are just to go about their normal lives. Mexico isn’t a warning from somewhere far away. It’s a chapter in a story that’s still being written.
And it shows us something important. When a government moves too fast, asks too much, and the trust isn’t there, people notice. And sometimes, quietly, they just don’t comply.
That’s worth remembering.
I’ve linked the sources below so you can read more about anything that surprises you.
YOUR data is your gold.
And you have more control than you think.
Until next time. Stay safe and secure.
About the Author & Disclaimer
The content herein is for informational and educational purposes only. It does not constitute legal, financial, or specific professional security advice. Readers should consult qualified professionals for their specific circumstances.
The Author: Jane Murdoch is a veteran Chief Information Security Officer (CISO) - the most senior cybersecurity role in an organisation, responsible for protecting everything from data and systems to people and reputation. With over 30 years of experience leading strategies across UK/global financial services, government, critical national infrastructure, the charity sector, and more, she brings a unique, deeply technical perspective to the hidden risks of this increasingly digital world we live in. As one of the few female CISOs worldwide, she is the founder of Cyber Freedom Club, dedicated to demystifying the realities of personal data and digital security that most people never see.
Sources:
Mexperience — registration process, CURP explained, and updated extension details
Library of Congress — official record of Mexico’s Supreme Court ruling on PANAUT, 2022
Global Freedom of Expression, Columbia University — full PANAUT Supreme Court case
Ignacio Gómez Villaseñor — original Telcel breach disclosure on X, 10 January 2026
El Expat Insider Mexico — Telcel breach detail and SIM black market
R3D — Red en Defensa de los Derechos Digitales, legal challenges
The Mexican government aren't trying to solve any problem aside from implementing the Agenda 2030 goals of total surveillance and control for those who own money.
But i suspect you already knew that ;-)
A timely warning, our Government is talking about scanning any photos taken, downloaded, or uploaded from a mobile phone. This is to operate at O/S level so cannot be turn off, we are told it is to protect children from viewing, or sending indecent images.
Governments always say, “It's for the good of…”
Dictatorships say the same.