The Global Network Initiative (GNI) is deeply concerned by a sweeping package of legislative reforms passed in Mexico in July 2025 that dramatically expands state surveillance powers, mandates biometric data collection, and erodes regulatory independence.
These new laws — fast-tracked through Congress — include amendments to Mexico’s Telecommunications Act, Intelligence Act, and other key legislation. Together, they establish a centralized surveillance infrastructure that mandates biometric identification for mobile users, enables real-time government access to public and private databases, and compels private sector compliance with surveillance demands without adequate safeguards.
Compulsory Biometric ID: All phone lines must be linked to a biometric ID by May 2026 or be blocked. A centralized database will store iris scans, fingerprints, and other sensitive data.
Real-Time Data Access: Authorities are granted sweeping powers to access real-time geolocation and communication metadata, with no requirement for judicial approval.
Regulatory Overhaul: The autonomous Federal Telecommunications Institute has been dismantled and replaced by executive-controlled bodies, weakening oversight and independence in policy and enforcement.
Private Sector Burden: Telecom providers, banks, healthcare services, and digital platforms are now obligated to collect, store, and hand over sensitive user data, exposing them to legal uncertainty and potential human rights conflicts.
Military Surveillance Powers: The military and National Guard are empowered to conduct intelligence operations without judicial warrants — blurring the lines between law enforcement and military oversight in civilian spaces.
These reforms echo previously rejected efforts like the National Register of Mobile Telephone Users (PANAUT), which Mexico’s Supreme Court ruled unconstitutional in 2022 due to its disproportionate impact on privacy and lack of safeguards. The reintroduction of similar measures without meaningful reform undermines constitutional protections and international human rights obligations.
GNI’s Call to Action
GNI urges the Mexican government, Congress, and judiciary to:
Reassess the legislative package through a human rights lens, ensuring alignment with Mexico’s international commitments.
Restore independent regulatory oversight to safeguard against executive overreach and conflicts of interest.
Require judicial authorization for access to user data, with clear legal limits and accountability mechanisms.
Engage civil society and industry through an inclusive, multi-stakeholder process to evaluate and revise the laws.
Clarify obligations for companies, ensuring they are not forced to act as agents of surveillance without legal protections or due process.
These reforms, if left unchecked, risk undermining democracy, chilling free expression, and endangering the rights of journalists, human rights defenders, and everyday users.
About GNI
GNI is a multi-stakeholder organization that brings together leading tech companies, civil society groups, academics, and investors to promote freedom of expression and privacy in the digital age. GNI provides expert analysis and policy guidance on legislation affecting digital rights worldwide.
To provide the best experience, we use cookies to store device information. Consenting to cookies will allow us to process data such as browsing behavior or tracking. Not consenting may adversely affect website functionality.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles, to track website usage or to track the user on a website or across several websites for similar marketing purposes.