On October 30, 2025, the Plenary of the Telecommunications Regulatory Commission (the “Comission”) decided to submit to public consultation the draft “Guidelines for the Identification of Mobile Telephone Lines” (the “Guidelines”). The purpose of the Guidelines is to establish the procedures and requirements for linking mobile telephone lines to their holders, in accordance with Articles 103 and 164, Section III, of the Telecommunications and Broadcasting Law (the “Telecommunications Law”).
The Guidelines will be mandatory for Concessionaires operating public telecommunications networks and providing mobile telephone services, as well as for telecommunications service resellers that offer such services (collectively, the “Mobile Service Providers”). The public consultation will remain open for 20 business days, until November 27, 2025, during which Mobile Service Providers and any other interested parties may submit their concerns, proposed modifications, and comments on the feasibility of the Guidelines.
In just a few days, the Guidelines have raised concern among mobile operators and industry experts due to potential risks in personal data protection and the compliance costs associated with the Telecommunications Law.
The user identification obligation recalls the failed National Mobile Telephone Users Registry (in Spanish, “PANAUT”), established in 2021 and later declared unconstitutional by the Supreme Court of Justice of the Nation. At that time, the Court held that PANAUT violated the rights to privacy and personal data protection by requiring the collection of biometric data without a proportional justification or adequate safeguards.
Unlike the 2021 precedent, the current Guidelines no longer contemplate the processing of biometric data. In principle, the Commission will not have direct access to users’ personal data, since the Guidelines designate the Mobile Service Providers as the sole parties responsible for enabling, operating, and managing both the Mobile Line Management Platform and the Mobile Line Consultation Platform (the “Consultation Platform”).
This means that Mobile Service Providers will assume the data protection obligations arising from compliance with Articles 103 and 164, section III, of the Telecommunications Law. Consequently, the processing and protection of users’ personal data will rest directly with the Providers, who must also implement in-person and remote mechanisms allowing users to register or deregister their mobile telephone lines.
This has led to a degree of uncertainty. Although the Guidelines establish that the Consultation Platform must provide secure access through the use of a Unique Population Registry Code (in Spanish, “CURP”), Tax ID (in Spanish, “RFC”), or another official digital authentication mechanism (such as the advanced electronic signature), Article 37 of the Guidelines could be interpreted as allowing any person to query the mobile lines linked to a specific user. This could create a potential risk of telephone fraud and the unauthorized creation of databases associating individuals with their phone numbers. It would also place Mobile Service Providers in a position of increased vulnerability to potential cybersecurity attacks.
Article 37 of the Guidelines does not clearly specify who may access the Consultation Platform or under what conditions such access may occur. It will be essential for the final version of the project to define clear control and security mechanisms, as well as user notification protocols whenever their data are accessed, to prevent any unauthorized or improper use of the information contained in the platform.
According to the Transitory Provisions of the Guidelines, the implementation of the platforms will occur in two phases. The first phase, lasting 30 calendar days from the effective date of the Guidelines, will require Mobile Service Providers to develop the platforms and begin public dissemination of the requirements and procedures for registering and deactivating mobile lines. The second phase will last 120 calendar days, during which Mobile Service Providers must send notifications, at least by SMS, to all active mobile lines once per week until registration is completed.
Although the Guidelines have not yet been published and remain subject to modification following the public consultation, their eventual approval would also affect mobile users, particularly those in areas with limited internet access or those who find it difficult to use technological tools. If, at the end of the 120-day period of the second phase, a user has not completed the registration and linkage of their mobile line, the Provider will be required to deactivate the service for that line, except for emergency calls or communications with the Provider’s customer service system.
It is evident that the new provisions under the Telecommunications Law impose significant personal data protection obligations on Mobile Service Providers, as they must register, for the purposes of service activation and continuity, the name, CURP, and telephone number of individual users, and for legal entities, the corporate name, Tax ID, and advanced electronic signature of the legal representative for validation purposes.
Nevertheless, the public consultation offers Mobile Service Providers an opportunity to anticipate compliance with these new obligations. It is expected that this consultation period will foster dialogue within the sector and lead to the issuance of fair, legally and economically viable Guidelines, with a primary focus on protecting users’ rights.
At Acedo Santamarina, S.C., we remain available to provide legal advice regarding the scope and implications of the Guidelines, as well as to assist those interested in participating in the public consultation process.
