Illinois Targets Biometric Lawsuits While Mexico Makes Biometrics Mandatory for 130 Million Phone Users

One hundred and thirty million phone lines. That's how many mobile connections Mexico's government plans to lock behind a biometric scan — your face, your fingerprints, your irises — by July of next year. Miss the deadline, and your phone stops working.

Meanwhile, about two thousand miles north, in

Meanwhile, about two thousand miles north, in Illinois, a single piece of legislation is doing the exact opposite. It's making biometric collection so legally expensive that companies and police departments have to think twice before scanning anyone's face at all. If you've ever unlocked your phone with your face, or tapped your fingerprint on a screen, this story is about you. Your biometric data — the stuff that is literally your body — is being treated as mandatory government infrastructure in one country and as a lawsuit trigger in another. Mexico is building a system called CURP Biométrica. It captures face, fingerprint, and iris scans, bundles them with a Q.R. code and a digital signature, and ties them to the national population registry. Every carrier in Mexico must verify a subscriber's identity against that biometric database before activating a S.I.M. card. In Illinois, House Bill fifty-five twenty-one goes the other direction — it gives individuals the right to sue for damages and demand deletion of their biometric data. So which model wins? And what happens when a case crosses both borders?

Start with Mexico, because the timeline is tight. The mandate took effect on 01-09-2026. Carriers now have until July twenty-six to bring every single mobile line into compliance. And this isn't Mexico's first attempt. Four years ago, Mexico's Supreme Court struck down a similar biometric collection program as unconstitutional. The government didn't abandon the idea. It repackaged it under a new name and tried again. That pattern matters — a court says no, and the state iterates until it finds a version that sticks. For anyone who uses a phone in Mexico, the choice is now binary. Hand over your face, your fingerprints, and your iris scan, or lose your connection to the world.

Now shift to Illinois. The state's Biometric Information Privacy Act — B.I.P.A. — has been on the books since two thousand eight. It created something rare in American law: a private right of action. That means you, as an individual, can sue a company that collects your biometric data without your consent. You don't need a prosecutor to act on your behalf. The results have been enormous. Facebook paid six hundred and fifty million dollars in twenty twenty-one to settle claims over its photo-tagging facial recognition system. That single case reshaped how major tech companies handle face data nationwide. B.I.P.A. doesn't ban the technology outright. It makes the liability so sharp that using facial recognition without airtight consent becomes an economic gamble.

House Bill fifty-five twenty-one would push that

House Bill fifty-five twenty-one would push that even further. It would let individuals sue for violations, authorize the Attorney General to enforce the rules, and require companies to delete biometric data on demand. But the opposition has been fierce. According to Reclaim The Net, police and their allies filed two hundred and twenty-seven formal witness slips against the bill. The number of slips in favor? One. Two hundred and twenty-seven to one. That ratio tells you how much law enforcement feels is at stake.

And they have a case to point to. A Loyola University freshman was murdered, and facial identification technology helped solve it. That case was introduced to legislators just hours before the sponsor pressed forward with the ban bill. Dozens of violent crimes — murders, robberies, sex offenses — have been solved with facial recognition assistance, particularly in transit cases where offenders are anonymous and cameras are everywhere. That's real. But so is this: facial recognition technology is demonstrably inaccurate in documented cases. People have been held for hours based on system errors. The technology performs worse against communities of color. The question was never whether facial recognition can solve crimes. It can. The question is whether the legal structure should force the people using it to prove they're using it accurately and with oversight.

And this isn't just a two-country story. South Africa's Revenue Service just unveiled what it calls Modernisation three-point-oh. It's a digital overhaul that assigns every taxpayer a unique digital identity secured by biometric and two-factor authentication. That makes South Africa one of the first major tax administrations in the world to require biometric I.D. as the primary way taxpayers interact with the government. Want to file your taxes? Scan your face. Three countries, three systems, three completely different assumptions about who owns your body's data.