The Mandatory Consent

Plataforma Única de Identidad · Mexico · 2025 — Mandatory interconnection framework between the private sector and government biometric identification systems.

The Biometric Surveillance Package

On July 16, 2025, the Diario Oficial de la Federación published a decree reforming the Ley General de Población to incorporate biometric data into the CURP: photograph, fingerprints of both hands, iris scan, electronic signature. It was the most visible measure of a legislative package approved on an emergency basis over just a few weeks by Congress, dominated by a large majority of the ruling party MORENA. The other laws touched telecommunications regulations, intelligence, the Guardia Nacional, the federal public administration, and the management of enforced disappearances.

The narrative framing was built around a real crisis: at the time of approval, the National Commission for Search documented 136,516 missing persons. Victims’ families have been waiting for answers for years, in many cases for decades. A centralized biometric identification system would have facilitated searches, rapid alerts, and cross-referencing of information between institutions. No political opponent could vote against without appearing indifferent to the desaparecidos. The package was approved quickly — 438 votes in favor, 38 against on the main reform.

R3D, Mexico’s leading digital rights organization, reconstructed the underlying logic: this was not just about a biometric database. It was about building a system where the biometric CURP becomes the sole recognized source of identity — for any procedure, service, or transaction, public or private — connected in real time to a Plataforma Única de Identidad that aggregates data from all institutions, which are required to connect and respond to queries. All with direct access, without the need for a judicial order, by fiscalías, the Centro Nacional de Inteligencia, and the Gabinete de Seguridad del Ejecutivo Federal. The stated purpose is finding the desaparecidos. The architecture produced is something far broader.

The Same Court, The Same Logic

There is a precedent that makes this story denser than it appears. In 2021, the Mexican government had attempted something similar through a different route: the Padrón Nacional de Usuarios de Telefonía Móvil, known as PANAUT, a mandatory registry that would have required all Mexican SIM card holders to submit biometric data — fingerprints, iris, facial recognition — to keep their phone service active. In 2022, the Suprema Corte de Justicia de la Nación declared it unconstitutional. The reasoning was detailed: the measure was disproportionate, there were no sufficient security guarantees for a massive database of this size, and there was no empirical evidence that mass biometric collection would reduce phone-related crimes.

The system built in July 2025 replicates that same logic — fingerprints, iris, photograph: the same data; centralization: the same structure; access by security authorities: the same principle. The difference is architectural. PANAUT concentrated risk in a single telephone registry, offering an identifiable legal target. The 2025 system distributes collection across thousands of interconnected public and private institutions, each technically responsible only for its own database, each individually subject to sanctions for non-compliance — including criminal liability for obstruction of justice. Mexican courts have already ruled on individual amparo challenges, granting some provisional suspensions, but the system consolidates through technical inertia: each institution integrates separately, each deadline expires separately, each sanction is individual. Legislative fragmentation serves a precise function: making the legal resistance process proportionally more costly than the compliance process.

The Private Node of Biometric Surveillance

The point that transforms the nature of the problem is this: the Mexican architecture of 2025 does not merely build a government database. It builds a topology — a distributed network in which the private sector is neither an external observer nor a technical supplier. It is a mandatory operational node of the surveillance infrastructure. Article 12 Bis of the Ley General en Materia de Desaparición Forzada establishes the list of categories required to connect to the Plataforma Única de Identidad: financial institutions, banks, fintechs, healthcare companies, telecommunications operators, educational institutions, airlines, transportation companies, insurers, religious organizations, logistics and delivery services, and any operator managing employee records or social security data. The list also includes civil organizations, media outlets, and any service provider managing databases of individuals — including ordinary activities such as customer databases. The obligation has no defined perimeter: it covers anyone holding information that may be useful to the search.

Each of these entities must build a dedicated API architecture that maintains a permanent, bidirectional communication channel with the government platform. Not a report upon request. A permanently open endpoint, through which the platform can activate at any moment the three phases of the search protocol: immediate, historical going back twelve years, continuous. Phase 3 — permanent automated monitoring of any new activity associated with a flagged CURP — does not close until the case is resolved. The Global Network Initiative formalized its concern in a public statement: the July 2025 laws transfer surveillance responsibilities to private companies, requiring them to collect, store, and hand over sensitive user data, to interconnect their databases with government systems, and to do so under legal uncertainty, with poorly defined obligations that also expose them to potential criminal liability. Private companies, in this framework, do not choose to cooperate with the authorities: they are conscripted. What results has a property that centralized architectures do not possess: it is self-reinforcing. Every new institution that connects enriches the network with more data, more cross-references, more detection capacity, without any central body having to expand deliberately.

Search protocol framework: Phase 1 — immediate search · Phase 2 — historical search up to 12 years · Phase 3 — continuous automated monitoring. Phase 3 does not close.

The Technique of Consent

The Ley General de Población is explicit: “La integración de los datos biométricos se realizará, previo consentimiento de las personas titulares.” Consent is the legal foundation of the entire system. But the legal category of consent presupposes that refusal is a real option — that those who say no can continue to exercise their rights, access essential services, and participate in civic life. Without a biometric CURP you cannot open a bank account. You cannot access IMSS or ISSSTE. You cannot enroll your children in school. You cannot receive a pension, federal welfare benefits, or scholarships. You cannot keep your phone line active past June 30, 2026. The decree establishes sanctions for institutions that refuse to accept the biometric CURP as identification — not for those who refuse to provide it. Every institution is incentivized to demand the document to avoid sanctions, creating a cascading effect that requires no explicit coercion.

Under these conditions, the legal form of consent survives while its substance is hollowed out. What remains is the legal name of a structurally coercive operation. R3D has called it “consentimiento forzado.” Interim director Pepe Flores summarized it in a single sentence: “La alternativa es la exclusión.” This mechanism is not neutral with respect to the history of the country in which it operates. The Pegasus spyware system was used in Mexico against journalists, lawyers, and human rights defenders by at least three consecutive administrations, with 456 documented victims in the two-month period of April–May 2019 alone, operated by a secret military unit called the Centro Militar de Inteligencia. This is not to assert that the current administration will use the system for the same purposes. It is to observe that any government inheriting this architecture will possess a tracking capacity structurally superior to any previous tool — without a judicial warrant, distributed across thousands of obligated private operators, with continuous monitoring of any CURP the system decides to surveil.

The Global Convergence Around Biometric Surveillance

The Mexican case exists within a broader field, where the same logic manifests in different forms but with analogous architectural outcomes. In India, the Aadhaar system — the world’s largest biometric infrastructure, with over one billion enrolled — underwent a significant expansion of its operational scope in October 2025: the National Payments Corporation of India introduced biometric authentication for transactions through the UPI digital payment system. Biometric data originally collected for access to welfare programs was repurposed as an authentication tool for private commercial payments, without new legislation, without a privacy impact review. In October 2025, the European Union launched the deployment of its biometric border control system known as the Entry/Exit System: from April 10, 2026 — today — fingerprints and facial images of all non-EU citizens are systematically archived and consulted for every subsequent crossing through European territory.

In the United States, since December 2025, every foreign national entering or leaving national territory can be photographed and processed through facial recognition systems, with no age exemptions, with no possibility of refusal. What emerges is not a coordinated conspiracy — there is no center distributing instructions. There is a structural logic that reproduces itself because it responds to the real incentives of contemporary political systems: governments want security and tracking capacity, private institutions want to reduce fraud risk and verification costs, digital platforms want reliable authentication. Biometric technology simultaneously addresses all these desires, at a cost that decreases every year. Function creep is the inevitable consequence: a system built to find the desaparecidos also finds those without proper documents; one built for banking security also records politically relevant movements; one designed for the welfare state becomes a commercial authentication tool. The infrastructure does not distinguish between purposes. It distinguishes between what is technically possible and what is not. And what is possible, over time, tends to become normal.

The Categories We Lack

What the Mexican case brings to the surface — and what the European, Indian, and American cases confirm in parallel — is a tension that the available legal categories cannot yet capture with precision. The classical notion of state surveillance presupposes an identifiable subject: an agency, a decree, a nameable political responsibility. It allows for appeal, opposition, the construction of a counterpart. The distributed topology taking shape has no such profile. It has thousands of obligated private nodes, each responsible only for its own portion, none responsible for the overall system. It has centralized government access over a network whose maintenance is entrusted to the private sector. It has formally free consent that functions as a condition of access to civic life.

The categories we have — privacy, consent, state surveillance, personal data protection — were built for systems with different architectures and locatable responsibilities. Applying them to distributed, delegated, and self-reinforcing systems produces not protection, but the impression of protection. It is the most effective way to fail to see what is happening.

Post scriptum

As this article is published, the European Union’s biometric border control system — the Entry/Exit System — reaches full enforcement today, April 10, 2026. From this date, every non-EU citizen crossing a European border is registered biometrically. Americans, British, Canadians, Australians: no one excluded. The architecture Mexico built for internal use, Europe is building for perimeter use. The direction is the same. The scale is continental.

The Mexican case is not the edge case. It is the advanced case. And advanced cases, in the history of surveillance architectures, tend to become normal cases within a decade.

Click here to accept Marketing cookies and load this content

Watch on YouTube