January 12, 2026
General context
On December 9th, 2025, the Guidelines for the Identification of Mobile Telephone Lines were published in the Official Gazette of the Federation (Diario Oficial de la Federación); these are effective as of that same day. Their aim is to combat crimes such as kidnapping, extortion, or any type of criminal activity that may be committed through mobile telephone lines, eliminating user anonymity.
To whom do they apply?
The provisions of the Guidelines are mandatory for:
• concessionaires and marketers that provide mobile telephone services.
The following are excepted:
• telephone numbers associated with a SIM card that do not have the technical capacity to generate voice calls, send SMS messages, or make calls over the Internet.
Obligation to associate telephone lines
As of January 9, 2026, all mobile phone lines must be associated with a user, and the information will be safeguarded by cell phone companies, as they currently do for postpaid service.
Data that may be safeguarded
For the purpose of linking mobile telephone lines, mobile telephone companies that provide services to end users are required to store only the following user data:
a. Name or company name;
b. CURP – Clave Única de Registro de Población or RFC – Registro Federal de Contribuyentes;
c. Associated telephone number;
d. Type of official identification;
e. Result and source used to validate identity; and
f. Unique reference number for the connection and/or disconnection, including date and time.
The foregoing is without prejudice to other records, files, and systems held by mobile telephone service providers.
Important: The storage of biometric data, photos and copy of official identification is prohibited. Biometric data may only be used temporarily; no retention is allowed.
Personal data protection
• The guidelines do not create an autonomous or new personal data protection regime applicable to Mobile Telephone Service Providers.
• The guidelines reinforce and emphasize the preexisting obligations under the Federal Law for the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares).
• The Guidelines point out specifically the data that can be processed, the purposes and under which mechanisms.
New relevant regulatory requirements
Notification of security incidents
• The Guidelines introduce an express and immediate duty for Mobile Telephone Service Providers to notify the regulatory authority, competent authorities, and users of any personal data breach.
Strict limitation of purposes
• Personal data must only be used for the purpose of connecting and disconnecting mobile phone lines.
• Secondary purposes are prohibited, even if compatible.
Technological platforms with data minimization
• The Guidelines impose systems to avoid the retention of sensitive data, in particular biometric data.
Key impact for providers
• No new creation of new substantive obligations, however:
• Greater regulatory precision
• More operational obligations
• Increased regulatory and supervisory risk
• The authority may verify compliance without prior notice.
The new framework does not change the existing legal basis, but raises the compliance standard, requires immediate technical and operational adjustments, and increases exposure to penalties if data is processed outside the strictly permitted purposes. In such cases, if the rights of mobile telecommunications concessionaires and resellers, as well as those of telephone line subscribers, are affected, the corresponding legal remedies may be asserted, including the filing of an amparo action as from the implementation of the act that causes the injury.
Our firm’s information technology and data protection and telecommunications departments at your service.
Sincerely,
Adolfo Athié Cervantes
Renata Denisse Buerón Valenzuela
Erika Itzel Rodríguez Kushelevich