TL;DR

By June 30, 2026, every Mexican-issued mobile line must be linked to a verified identity through the CURP system, with biometric anchoring; unregistered lines get suspended on July 1. Tourists can't legally register a Mexican line at all, because CURPs are only issued to citizens and to foreigners with formal residency. The legal workaround is built into the law itself: foreign eSIMs roaming on Mexican networks are not "lines contracted in national territory" and are exempt under international treaty obligations Mexico is signatory to. That makes a foreign roaming eSIM the practical option for tourists, digital nomads, business travelers, and Mexicans who want an unregistered second line. nadanada sells anonymous foreign eSIMs that work in Mexico with no account, no email, and no identity — payable in Bitcoin Lightning, Monero, and other cryptocurrency.

On January 9, 2026, Mexico's reform to the General Law of the National Public Security System took effect, requiring every active cellular line in the country to be verifiably linked to the identity of its user. All existing lines must be registered by June 30, 2026. Starting July 1, unregistered lines will be suspended by every Mexican carrier, with no calls, no texts, and no data until registration is completed.

The rule applies to prepaid and postpaid lines. It applies to physical SIM cards and to eSIMs sold by Mexican carriers. It applies to Mexican citizens, foreign residents, businesses, and tourists who have purchased a local Mexican line. The Federal Telecommunications Institute (IFT) is the enforcing authority, and the biometric CURP is the identity record being built behind it.

This post is a factual breakdown of what the law actually requires, who has to register, who is exempt, what changes for tourists and short-term visitors, and where the legal foreign eSIM loophole sits within Mexican telecom regulation. Most coverage so far has been either alarmist or vague. The reality is more specific, and the practical options for staying private are clearer than they look.

What the 2026 Law Actually Requires

The reform amended the General Law of the National Public Security System to require that every active mobile line be tied to verified identity data. The mechanics:

For Mexican citizens. Registration requires the CURP (Clave Única de Registro de Población, the national population registry code) plus a valid government photo ID, typically the INE voter card or a Mexican passport.

For foreign residents. Temporary or permanent residents register using their passport. The system automatically matches the passport details to the resident's CURP, which residents already receive when they obtain residency status.

For tourists and short-term visitors. This is the part most coverage gets wrong. CURPs are only issued to Mexican citizens and to foreigners with formal residency. A tourist on an FMM (Forma Migratoria Múltiple) tourist permit cannot obtain a CURP, which means a tourist cannot legally register a Mexican line under the new system. The practical effect: Mexican carriers will no longer be able to sell active lines to tourists, because the registration record cannot be completed.

Verification process. Online registration requires uploading a photo of the identity document plus a live selfie for biometric matching. In-store registration at a carrier branch is also accepted but produces the same biometric record on the back end.

Penalty for non-registration. Suspension of service on July 1, 2026. Carriers are required to enforce this. Restoring a suspended line requires completing the full registration including biometric verification.

What Is the Biometric CURP

In early 2026, the IFT and Mexico's national identity agency began rolling out the Biometric CURP, an expanded version of the existing alphanumeric CURP that includes:

A facial recognition record
Fingerprints
An iris scan
A QR code for verification
A digital signature

The Biometric CURP is not yet mandatory for SIM registration in 2026, but the technical infrastructure is being built specifically to allow real-time biometric verification of mobile line ownership. Multiple Mexican digital rights organizations, including R3D (Red en Defensa de los Derechos Digitales), have publicly opposed the rollout, citing the same privacy concerns that led the Supreme Court to strike down PANAUT in 2022.

A Brief History: This Is Not Mexico's First Attempt

In 2021, Mexico passed the National Mobile Telephony Users Registry (PANAUT, Padrón Nacional de Usuarios de Telefonía Móvil). PANAUT required the collection of fingerprints and facial recognition data from every Mexican mobile subscriber, to be stored in a central federal database. R3D, civil society organizations, and Mexico's National Human Rights Commission filed constitutional challenges almost immediately.

In April 2022, Mexico's Supreme Court struck down PANAUT as unconstitutional, ruling that the central biometric database violated privacy rights guaranteed under the Mexican Constitution and was disproportionate to the law enforcement objectives cited.

The 2026 reform is structurally different. Instead of a single central biometric database, the new framework distributes the verification responsibility to the carriers themselves and routes the identity check through the Biometric CURP system, which is operated by a different agency. This redesign is what allowed the new version to pass without immediately running into the same constitutional barrier. Whether that holds up under renewed legal challenge is an open question. R3D has already signaled its intention to challenge the Biometric CURP rollout.

For privacy-conscious Mexicans, the practical concern is not the legal status of the law on paper. It is that, regardless of how the architecture is described, the government now has a verified identity record attached to every Mexican mobile number, queryable in real time, with a biometric anchor.

Who Is Actually Exempt: The Foreign Roaming Distinction

This is the most practically useful section of the law, and the most under-reported.

The 2026 registration requirement applies only to mobile lines issued by Mexican carriers. Foreign-issued lines that are physically used in Mexico under standard international roaming agreements are not subject to the registration requirement. The text of the law is specific: it regulates "líneas de telefonía móvil contratadas en territorio nacional" (mobile lines contracted in national territory), not roaming traffic.

This is consistent with international telecom regulation. International roaming is governed by GSMA bilateral agreements and ITU treaties, and Mexico has signed both. A Mexican domestic registration mandate cannot legally extend to subscribers of foreign carriers temporarily roaming on Mexican infrastructure. Doing so would breach Mexico's obligations under those treaties and would effectively block all tourists, business travelers, and diplomats from using their phones in the country.

The result: a foreign eSIM (or foreign physical SIM) used in Mexico is not subject to the June 30 registration deadline, is not linked to a Biometric CURP, and is not affected by the July 1 suspension. The line continues to operate as a roaming subscriber under the home carrier's identity record, which lives in the home carrier's country, not in Mexico.

This is the same architecture that lets foreign eSIMs work in Russia, in China, and in any other country with restrictive domestic SIM registration laws. The traffic is tunneled at the network layer through the GPRS Roaming Exchange (GRX) back to the home carrier's gateway and exits to the public internet from there.

How Foreign eSIM Roaming Actually Works in Mexico

When a phone with a foreign eSIM connects to a cell tower in Mexico (Telcel, AT&T Mexico, Movistar), the local carrier identifies the SIM as belonging to a foreign roaming subscriber. Under standard roaming protocols, the local carrier is contractually obligated to tunnel that subscriber's data back to the home carrier's network. The path:

Your phone connects to a Mexican cell tower for the radio signal.
The tower identifies your SIM as a foreign roamer.
Your data is tunneled through the GRX back to your home carrier's gateway (for example, the UK, Germany, or wherever the carrier's home network is).
Your data exits to the public internet from that gateway, with an IP address from the home carrier's country.

Because your traffic never exits to the public internet inside Mexico, it is not subject to Mexican identity-linkage requirements. The IP address visible to websites and apps is from the home carrier's country. The subscriber identity in the carrier's records is whatever the home carrier has on file, which for an anonymous eSIM provider like nadanada is no personal data at all, paid for in Bitcoin Lightning, Monero, or other cryptocurrency.

This is fundamentally different from buying a local Mexican SIM. A local SIM is contracted in Mexican territory, registered against a CURP and a biometric record, and subject to the full apparatus of the 2026 law. A foreign eSIM is a roaming service governed by international agreements and is not.

Who This Matters For

The 2026 law will have different practical implications for different categories of users:

Mexican citizens and long-term residents. Registration is effectively unavoidable for your primary number. Whether you are comfortable with that depends on your personal threat model. For most users, the day-to-day impact is small. For journalists, activists, opposition political figures, lawyers handling sensitive cases, victims of organized crime, and anyone with a credible reason to compartmentalize their primary identity from their mobile number, the new law represents a real reduction in privacy that no on-device setting can undo.

Tourists and short-term visitors. Buying a local Mexican SIM is now practically impossible without a CURP. For anyone visiting for less than the 180 days a tourist permit allows, a foreign eSIM is the only realistic option. This is a market the international eSIM industry has already noticed: Airalo, Holafly, and others have all flagged Mexico as a country where their roaming eSIMs are now the path of least resistance, although those providers still require an account and identity verification at signup, which is a separate privacy issue.

Business travelers and digital nomads. A foreign eSIM is the right answer here too. The added benefit, beyond avoiding registration, is that home-routed roaming gives you a stable IP address from a non-Mexican country, which simplifies access to banking, work tools, and home-country services that may flag a Mexican IP. See our digital nomad privacy guide for the broader setup.

Privacy-conscious Mexicans who want a second, unregistered line. A foreign eSIM, paid in cryptocurrency, used as a secondary line on a dual-SIM device, gives you a working mobile data connection in Mexico that is not registered against your CURP. You still need a primary registered Mexican line for SMS verification on Mexican domestic services, but for messaging, browsing, and any application that does not require a Mexican number, the foreign eSIM is a practical workaround. For SMS verification on services that don't require a specifically Mexican number, rental phone numbers sidestep the question of identity at the SIM layer entirely.

Foreign residents in Mexico. You will need to register your Mexican line using your passport, which is then tied to your CURP. This is a real privacy reduction from the pre-2026 status quo. A foreign eSIM in addition to (not instead of) the registered Mexican line gives you a parallel connection that is not in the registry.

Practical Setup Recommendations

If you are visiting or living in Mexico and want to retain a private mobile data connection, the practical setup is:

For tourists. Foreign eSIM as the primary line. Pay in cryptocurrency for the eSIM if you want the line to be unconnected to your card details as well. No Mexican local line needed.

For digital nomads with a stay over 30 days. Foreign eSIM as the primary data line. If you also want a Mexican phone number for local services (banking, ride-share, deliveries), an anonymous rental phone number covers SMS verification needs for many services, although Mexican domestic apps that specifically require a Mexican-prefix line will still need a Mexican-issued number.

For privacy-conscious residents. Two-line setup. Registered Mexican primary line for the things that legally must be on a Mexican line (banking, government services, anything that SMS-verifies against a +52 number). Foreign eSIM as a second line for messaging, browsing, VPN tunneling, and anything that does not require Mexican-prefix verification.

For journalists and activists. Beyond the eSIM setup above, consider the broader operational security stack: a pay-per-use VPN to add an additional layer of IP separation, anonymous AI chat for research that should not be tied to a verified account, and the practice of never using your real phone number for online accounts regardless of which country you are in. The 2026 Mexican law is one specific case of a global trend, and the same playbook applies in every jurisdiction with mandatory SIM registration.

What About VPNs

The 2026 law does not regulate VPNs. Mexico does not block VPN services, does not perform the kind of deep packet inspection that Russia's TSPU performs, and does not require VPN providers to log or share data with Mexican authorities.

VPNs are useful in Mexico for the same reasons they are useful elsewhere: encrypting traffic on untrusted networks, accessing geo-restricted content, and adding an additional layer of IP separation between your device and the services you use. They are not a workaround for the SIM registration law specifically, because the law operates at the carrier subscription layer, not the network traffic layer. A VPN does not change what is in the carrier's identity record. A foreign eSIM does.

The strongest setup for someone who wants both is a foreign eSIM (handles the SIM-layer identity question) plus a VPN (handles the network-layer encryption and IP question). Together, they cover the full stack.

The Honest Caveats

A few items worth being clear about:

This law could be tightened. The 2026 reform is the second attempt at Mexican mobile registration in five years. The first was struck down. The second is operating under a different legal architecture that has so far avoided the constitutional challenge that killed PANAUT. There is no guarantee the law will not be amended further, and there is no guarantee Mexico will not eventually attempt to extend registration requirements to roaming subscribers, although that would breach international treaty obligations and is unlikely in the short term.

Foreign eSIM providers vary. Not every eSIM provider is anonymous. Most of the major international eSIM brands require a credit card, an email account, and a verified user profile at signup. The roaming line itself is not registered in Mexico, but the provider has a record of you. If you want both layers (no Mexican registration AND no provider account), you need an eSIM provider that explicitly does not collect identity data and accepts cryptocurrency. That category is small.

Coverage in Mexico is good, but check before you travel. Foreign eSIMs in Mexico typically roam on Telcel (the largest network) or AT&T Mexico, both of which have extensive 4G/5G coverage in cities and most towns. Rural and mountainous coverage drops off, and some specific regions (parts of Oaxaca, Chiapas, Baja California Sur) have known coverage gaps regardless of carrier.

This is not legal advice. Using a foreign eSIM in Mexico is a standard, legal use of international roaming infrastructure under treaties Mexico is signatory to. Operating outside or against Mexican domestic law is not what this article is about, and is not what we recommend or facilitate. The 2026 registration law applies to Mexican-issued lines. A foreign-issued line is not a Mexican-issued line. That is the entire point.

Timeline: How Mexico Got Here

April 2021. Mexico's Congress passes PANAUT, requiring biometric registration of every mobile line in a central federal database.

April 2022. Mexico's Supreme Court strikes down PANAUT as unconstitutional, citing privacy violations and disproportionality.

Late 2024. Federal government begins quiet drafting of a redesigned mobile registration framework structured to avoid the constitutional issues that ended PANAUT.

Mid 2025. Reform to the General Law of the National Public Security System begins moving through Congress, packaged as an organized-crime and security measure.

Late 2025. Reform passes both chambers and is signed into law.

January 9, 2026. Reform takes effect. Mexican carriers begin offering registration mechanisms for new and existing lines. IFT confirms enforcement framework.

Early 2026. Biometric CURP rollout accelerates. R3D and other digital rights organizations file initial constitutional challenges to the biometric component.

June 30, 2026. Deadline for all existing Mexican mobile lines to be registered.

July 1, 2026. Unregistered Mexican lines suspended. Service restoration requires completion of the full registration including biometric verification.

FAQ

Do I have to register my phone if I am visiting Mexico as a tourist? No, if you are using a foreign-issued line that is roaming on a Mexican carrier. The 2026 law applies only to Mexican-issued mobile lines. Roaming subscribers are governed by international agreements that Mexico is signatory to.

Can I buy a local Mexican SIM card as a tourist after January 9, 2026? Practically, no. Carriers must register every line against a CURP, and CURPs are only issued to Mexican citizens and to foreigners with residency status. A tourist on an FMM permit cannot obtain a CURP, so the registration cannot be completed. Some carriers may still sell prepaid SIMs to tourists during the transition period, but the line will be suspended on July 1, 2026 if registration is not completed.

Does the law apply to eSIMs? The law applies to eSIMs sold and provisioned by Mexican carriers. It does not apply to foreign eSIMs from international providers, because those eSIMs are roaming services, not Mexican-issued lines.

What is the difference between an eSIM from a Mexican carrier and an eSIM from an international provider? A Mexican-carrier eSIM is contracted in Mexican territory, billed under Mexican rules, and is treated identically to a Mexican physical SIM under the 2026 law. An international eSIM (such as one from an anonymous eSIM provider) is issued by a non-Mexican carrier and operates as a roaming line on Mexican networks. The latter is not subject to the registration requirement.

Will Mexico start blocking foreign eSIMs the way Russia did? Russia imposed a 24-hour data block on foreign SIMs in late 2025. Mexico has shown no signs of doing the same, and the regulatory and diplomatic context is different: Mexico has a much higher dependence on inbound tourism (over 40 million visitors per year) and on cross-border telecom integration with the United States. A unilateral disruption of foreign roaming would have economic and diplomatic consequences Mexico has no current incentive to absorb. That said, this is a watch-this-space item.

What is the Biometric CURP and is it mandatory for SIM registration? The Biometric CURP is an expanded version of the existing alphanumeric CURP that includes facial recognition, fingerprints, iris data, a QR code, and a digital signature. As of April 2026, the standard CURP plus a passport or INE photo ID is sufficient for SIM registration. The Biometric CURP is being rolled out in parallel and is expected to become the default verification mechanism over time.

Is a foreign eSIM legal in Mexico? Yes. International roaming is a standard telecommunications service governed by treaties Mexico is signatory to. Using a foreign eSIM in Mexico is no different in legal status from using a foreign physical SIM in Mexico, which has been standard practice for tourists, business travelers, and diplomats for decades.

How is this different from PANAUT? PANAUT (2021) required a central federal database of biometric data tied to every mobile line. The Supreme Court struck it down for proportionality and privacy reasons. The 2026 reform restructures the same objective: instead of a central database, identity verification is performed by carriers against the CURP system, with biometric anchoring through the Biometric CURP. The legal architecture is different. The practical privacy implication for users is similar.

What happens to my Mexican line if I do not register it by June 30, 2026? On July 1, 2026, your line will be suspended by your carrier. Calls, SMS, and data will stop working. To restore service, you must complete the full registration process, including biometric verification.

I am a foreign resident in Mexico. Do I have to register my Mexican line? Yes. Foreign residents (temporary or permanent) must register Mexican-issued lines against their passport, which the system matches to their CURP. If you do not have a CURP yet, you will need to obtain one before you can register your line.

Can I keep my registered Mexican line and add a foreign eSIM as a second line? Yes, on any dual-SIM phone. This is a common setup for privacy-conscious residents and digital nomads. The registered Mexican line handles things that require a +52 number (banking, government services, ride-share, deliveries). The foreign eSIM handles messaging, browsing, and anything that does not require a Mexican-prefix verification.

Will using a foreign eSIM in Mexico raise any flags? No. Foreign eSIMs and foreign physical SIMs are used by every tourist and business traveler in Mexico. Mexican carriers process millions of foreign roaming connections per year. There is nothing unusual about a non-Mexican line connecting to a Mexican network.

nadanada provides anonymous eSIM data plans in 200+ countries including Mexico, pay-per-use WireGuard VPN, disposable and rental phone numbers, and free anonymous AI chat. All services payable with Bitcoin Lightning, Monero, Ethereum, Solana, USDT, USDC, and more. No accounts, no KYC, no CURP. Visit nadanada.me.