Mobile line identification and biometric data: new obligations and prohibitions as of today

As of today, 9 January 2026, the obligations set out in the Guidelines for the Identification of Mobile Telephone Lines, issued by the Telecommunications Regulatory Commission (CRT), come into force. This new regulatory framework imposes on Mobile Telephony Service Providers - concessionaires and marketers - the obligation to link all mobile lines to an Owner (natural or legal person), as well as to enable face-to-face and remote mechanisms for the linking, unlinking and consultation of these lines.

The Guidelines establish a staggered implementation schedule. Within 30 calendar days, providers must enable the Mobile Telephone Lines Management Platform to carry out the linking and unlinking processes; and, within 60 days, the Consultation Platform, which will allow the holders to know which lines are associated to their CURP or RFC. Once the implementation period has elapsed, any line that is not linked before 30 June 2026 will be suspended as of 1 July, and will be limited to emergency communications only.

Use of biometric data: allowed only for real-time validation.

One of the most relevant - and sensitive - aspects of the new scheme concerns the use of biometric data in remote engagement and disengagement processes. The Guidelines foresee the use of the so-called "Proof of Life" as a mechanism to validate that the person carrying out the procedure corresponds to the person presenting the official ID.

However, the regulatory framework is explicit and restrictive:

• Biometrics can only be used as a real-time verification mechanism, i.e. for immediate identity authentication purposes.
• Under no circumstances may it involve the retention, storage or generation of biometric records.

The Management Platforms must not store biometric data, photographs, copies of official IDs or any other documents of the Holders or Users. The "Proof of Life" operates, therefore, as a momentary digital mirror, leaving no permanent trace, in line with the principles of minimisation and proportionality in terms of personal data protection.

Minimum data that can be safeguarded

For the purposes of the linkage, providers may only store strictly limited information, which includes:

• Name or company name;
• CURP or RFC;
• Associated telephone number;
• Type of official identification presented;
• Result and source of identity validation; and
• A unique folio including date and time of processing.

Any further processing or retention of information other than that expressly authorised would constitute a direct breach of the Guidelines and applicable personal data protection regulations.

Immediate compliance implications

The entry into force of these provisions obliges providers to immediately review and adjust their operational, technological and compliance processes, in particular:

• The design and operation of technology platforms, ensuring that they comply with functional and security requirements.
• The governance of personal data, ensuring that biometrics are not stored or reused.
• The clear and timely dissemination of information to users on the requirements, deadlines and consequences of not linking their lines.

In addition, the Guidelines establish that the linking, unlinking and consultation processes must be free of charge, and set limits such as the possibility of linking up to ten lines per natural person, with differentiated rules for legal entities and other specific cases.

Overall, this new regime strengthens the identification of mobile telephony users, but at the same time imposes clear limits on the use of biometric data, confirming that its use is only valid as a one-off verification tool and not as a basis for the creation of permanent registers.

Article prepared by ECIJA Mexico's team specialised in technology regulation and personal data protection.