The only way an authority can request data is through a written, grounded, and motivated warrant, within a formal investigation,” she pointed out. Finally, she stated that the measure aims to reduce the anonymity that today facilitates telephone crimes and to limit the black market for chips, while citing international experiences where the identification of lines led to arrests and reductions in extortion crimes. The Telecommunications Regulatory Commission (CRT) warned that the sale of telephone chips on the black market and the existence of millions of anonymous lines in the country represent a key factor in the commission of crimes such as extortion, fraud, and virtual kidnapping. Norma Solano Rodríguez, president commissioner of the body, stated that this practice allowed for the activation of lines without user identification for years, which today hinders the investigation of crimes committed by telephone. In an interview for Aristegui en Vivo, Solano explained that prior to the new regulation, chips could be purchased “anywhere, from anyone,” even in large quantities, without there being a mechanism to associate them with a holder. You could buy 10, 100, as many as you wanted, and there was no way to identify where the calls came from. According to her statement, CRT figures indicate that there are currently 158 million active telephone lines in Mexico, of which 134 million—equivalent to 85%—are anonymous lines. She mentioned that only 24 million are fully identified, mainly those corresponding to postpaid plans, where the linking of the number to a person was already a contractual requirement. This scenario, said Solano, has been exploited by criminal networks, since, according to the National Victimization and Security Perception Survey, 7.4 million extortions were recorded in 2024, of which around 90% were made by telephone. Today, the authority has no way of knowing who made that call. You may be interested> Telcel announces additional security measures after reporting having exposed user data. In this context, on January 9 of last year, the mandatory registration of telephone lines began, provided for within the legal framework in force in telecommunications and broadcasting, approved in 2025. Registration against extortion The measure requires all mobile lines to be associated with a natural person through their name and CURP. Solano detailed that the regulation contemplates two avenues; the first corresponds to new chips that will be marketed from January 9, which can no longer be sold with an active service. The only way these chips can be activated is if they are associated with a person. The second avenue applies to lines that were already in operation before the measure came into force, including those that were previously distributed and that may still be pre-activated at points of sale and must be linked by no later than June 30, 2026. Starting from July 1, lines that have not been registered will be disabled for calls and regular services, although they will remain active for emergencies, citizen attention, contact with the operator, and reception of alerts, such as the seismic alert system. The service can be reactivated at any time once the registration is completed, the commissioner emphasized. Likewise, she said that the linking process can be carried out in person at the telephone companies' attention centers or remotely, through the operators' digital platforms, and in both cases, the registration only requires name, CURP, and telephone number. In the case of remote registration, a mechanism known as “proof of life” is used, which allows confirming that the person carrying out the procedure is real and coincides with the identification presented. This system, explained Solano, is the same one used by banking institutions and other regulated services. The commissioner stressed that the registration does not include biometric data or sensitive information, and its sole objective is to identify the line holder. Fingerprints, iris scans, or any data of that type are not required. Only the minimal indispensable data. Solano said that there are differences with previous registration attempts, such as RENAUT or PANAUT, by pointing out that the new scheme does not create a centralized national registry. “There is no single database in the government's hands; the information is safeguarded by each telephone company, as has been the case with postpaid lines for more than a decade,” she explained. Did Telcel expose sensitive data? Additionally, Solano addressed the recent case of Telcel, where it was reported that for several hours, information visible on the registration platform generated concern about possible violations of personal data. She indicated that, after reviewing the case with the company, a design error was identified in a test environment used by the platform's developer. It was a bad development practice, but there was no extraction of databases or massive exposure of user information. However, the commissioner confirmed that the Ministry of Anti-Corruption and Good Governance initiated a review procedure to determine if there were administrative responsibilities. The commissioner stressed that CRT maintains permanent coordination with telecommunications companies, the Cybersecurity Police, and digital platforms to detect and deactivate fake pages, alleged sales of pre-registered chips, and disinformation related to registration. In response to criticisms warning about risks of surveillance or espionage, Solano denied the situation and said that the authority can only access after obtaining a written judicial warrant. “The government does not have direct access to this information.”
