Mexico makes biometric identifier mandatory for all citizens

Mexico has officially introduced a digital identification system by signing a law that turned the previously optional biometric-based citizen code into a mandatory document for all citizens.

Last month, legislators approved amendments to a law related to the 18-character personal identifier, known as Unique Population Registry Code (Clave Única de Registro de Población – CURP), with the change formalized on Wednesday through a decree.

The mandatory CURP will contain personal and biometric information, including a photograph and a QR code containing biometric fingerprint and iris data. The identifier is expected to be introduced gradually to all Mexicans by February 2026.

The government has also allowed the consolidation of the citizen codes into a single identity platform that will be connected to other state databases and administrative records. According to the decree, the Ministry of the Interior and the Digital Transformation Agency must create a Unified Identity Platform within 90 days, while public and private institutions will be required to update their system to recognize the identifier.

The country also plans to kick-start a national program to collect biometric data from children and adolescents within 120 days, according to news outlet Mexico Business.

CURP raises surveillance suspicions

The first CURP was issued in 1996, allowing both citizens and residents to use it in tax filings, company records, schools, passport applications and other government services. The biometric version of the code began rollout at the beginning of 2025.

Privacy advocates, however, have viewed the introduction of the mandatory biometric ID with suspicion, raising concerns that the CURP will lead to surveillance and data security issues.

The new law, for instance, does not require authorities to inform citizens when their data is viewed or accessed.

“This puts us in a massive surveillance ecosystem with no provisions to identify wrong use of data, data breaches, identity theft, or acts of corruption,” José Flores, director of digital rights group R3D, told Context News.

CUPR could also allow Mexico to establish data-sharing agreements with other countries, including a deportation deal with U.S. law enforcement agencies.

Rights groups such as Article 19 believe that the ID will give intelligence services access to data without restrictions or transparency. Mexico’s national security agencies, such as the National Intelligence Centre and the National Guard, are among the government bodies that will gain access to the biometric data.

The government says that the misuse of sensitive data, including biometrics, is regulated by existing data privacy laws.

“A wiretap can only be approved by a judge, according to the Constitution and the law,” Mexican President Claudia Sheinbaum said at the beginning of July.

The Unified Identity Platform will be able to connect to the National Registry of Missing and Unlocated Persons and the National Forensic Data Bank, allowing the country to combat the alarming trend of disappearances, according to the government.