Mexico is advancing a national digital identity initiative, with the proposed Cédula Única de Identidad Digital (CUID), a unique digital identity card, being a central component of this effort. The project, which has received funding from a $225 million World Bank loan, aims to create a centralized biometric database containing personal data, including biometric information, for all Mexican citizens and residents. This initiative is part of a broader legislative framework, including the recently approved General Law on Population, Human Mobility and Interculturality, which enables the Ministry of the Interior to establish a national database with personal and biometric data.

The CUID is intended to serve as the official identification document for Mexicans, available in both physical and electronic formats, and will include a unique Population Registration Key (CURP) number. While the law is designed to improve government services and data management, it has raised significant concerns from civil society organizations and digital rights advocates. Critics argue that the mandatory nature of the system, combined with its centralized biometric database, poses serious threats to privacy and human rights, including the risk of authoritarian oversight and security vulnerabilities. They also question the necessity and effectiveness of such a large-scale biometric identification system, noting that biometric data is not the only or most reliable method for legal identification and that the technology is prone to errors.

In addition to the national CUID project, Mexico has established a robust regulatory framework for data protection and digital identity. The Federal Law on the Protection of Personal Data held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and the General Law on the Protection of Personal Data by Public Entities (Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados) form the core of this framework, governing the processing of personal data and establishing the role of the National Institute for Transparency, Access to Information and Data Protection (INAI) as the primary data protection agency. The law differentiates between personal data and sensitive personal data, which includes information like race, health status, and religious beliefs, and mandates specific safeguards for the latter.

Mexico also has specific regulations for digital identity verification in key sectors. For instance, the Anti-Money Laundering Law (AML Law) and the Law to Regulate Financial Technology Institutions (Fintech Law) impose rigorous identity verification requirements on financial institutions and fintech companies, ensuring compliance with Know Your Customer (KYC) regulations. Furthermore, the country has established multiple regimes for digital certificates used in e-signatures, including commercial, tax, public servants, and judiciary sectors, each governed by specific authorities. The Ministry of Economy, for example, authorizes private entities as Certification Service Providers (CSPs) for commercial e-signatures, with around seven companies currently registered. The government has also implemented a digital ID system for the judiciary, known as FIREL, and a tax-specific QES model called "e.Firma" for tax documents.

Despite these developments, Mexico does not yet have a specific law governing digital IDs, and the CUID project remains a draft law under consideration by the Senate. The government's approach to digital identity is evolving, with elements in place that could position Mexico as a leader in AI and digital identity, although the country currently lacks a specific policy or law dedicated to AI systems. The ongoing debate surrounding the CUID highlights the tension between enhancing government efficiency and protecting individual privacy and civil liberties.