IMAGE SOURCE: "My Phone Bought This" by oliver t is licensed under CC BY-NC-ND 4.0.

Mandatory SIM card registration laws require people to provide personal information, including a valid ID or even their biometrics, as a condition for purchasing or activating a SIM card. Such a requirement allows the state to identify the owner of a SIM card and infer who is most likely making a call or sending a message at any given time.

SIM card registration undermines peoples’ ability to communicate anonymously, organise, and associate with others, and it infringes their rights to privacy and freedom of expression. By making it easier for law enforcement authorities to track and monitor people, these laws threaten vulnerable groups and facilitate generalised surveillance. People who lack ID, or who do not want to or are unable to disclose such personal information, are excluded from important spheres for formulating and sharing ideas: roughly 1 billion people around the world lack a valid form of government ID and could be prevented from purchasing a SIM card as a result, and journalists, human rights defenders, and people from marginalized or minority communities may fear harassment, intimidation, violence, or persecution if they register. Challenging SIM card registration laws is therefore important to preserving our civic spaces and defending democracy.

How widespread are mandatory SIM card registration laws?

SIM card registration laws are proliferating, but there is no uniform approach. By March 2020, 155 governments required some form of proof of identity before a person could purchase a SIM card, but what form of ID and what other information may be required varies. In 2012, the European Commission requested that EU states provide evidence of actual or potential benefits from mandatory SIM card registration measures and, after examining the responses it received, concluded there was no benefit either to assisting criminal investigations or to the common market to having a single EU approach. SOURCE: GSMA (pg. 10).

As of March 2020, the following countries have mandatory SIM card registration laws: Afghanistan, Albania, Algeria, Angola, Antigua and Barbuda, Argentina, Armenia, Australia, Austria, Azerbaijan, Bahrain, Bangladesh, Barbados, Belarus, Belgium, Belize, Benin, Bhutan, Bolivia, Botswana, Brazil, Brunei Darussalam, Bulgaria, Burkina Faso, Burundi, Cambodia, Cameroon, Central African Republic, Chad, China, Congo, Costa Rica, Côte d'Ivoire, Cuba, Democratic Republic of Congo, Dominica, Dominican Republic, Ecuador, Egypt, El Salvador, Equatorial Guinea, Eritrea, Ethiopia, Fiji, France, French Guiana, Gabon, Gambia, Germany, Ghana, Greece, Grenada, Guatemala, Guinea, Guinea-Bissau, Guyana, Haiti, Honduras, Hungary, India, Indonesia, Iran, Iraq, Italy, Japan, Jordan, Kazakhstan, Kenya, Kosovo, Kuwait, Kyrgyzstan, Laos, Lebanon, Lesotho, Liberia, Libya, Luxembourg, Macedonia, Madagascar, Malawi, Malaysia, Maldives, Mali, Mauritania, Mauritius, Monaco, Mongolia, Montenegro, Morocco, Mozambique, Myanmar, Nauru, Nepal, Niger, Nigeria, North Korea, Norway, Oman, Pakistan, Palestine, Panama, Papua New Guinea, Peru, Poland, Qatar, Russia, Rwanda, Samoa, San Marino, Sao Tome and Principe, Saudi Arabia, Senegal, Seychelles, Sierra Leone, Singapore, Somalia, South Africa, South Sudan, South Korea, Slovakia, Spain, Sri Lanka, St. Kitts and Nevis, St. Lucia, St. Vincent and the Grenadines, Sudan, Suriname, Svalbard, Swaziland, Switzerland, Syria, Taiwan, Tajikistan, Tanzania, Thailand, Togo, Trinidad and Tobago, Tunisia, Turkmenistan, Uganda, Ukraine, United Arab Emirates, Uruguay, Uzbekistan, Venezuela, Zambia, Zimbabwe. .

As of March 2020, the following countries have mandatory biometric SIM registration laws: Bahrain, Bangladesh, China, Nigeria, Pakistan, Peru, Saudi Arabia, Tanzania, Uganda, United Arab Emirates, Zambia

As of March 2020, the following countries do not have mandatory SIM card registration laws: Andorra, Bahamas, Bosnia and Herzegovina, Cabo Verde, Canada, Colombia, Comoros, Croatia, Czech Republic, Denmark, Estonia, Finland, Georgia, Hong Kong, Iceland, Ireland, Israel, Kiribati, Latvia, Liechtenstein, Lithuania, Marshall Islands, Mexico, Micronesia, Moldova, New Zealand, Nicaragua, Portugal, Romania, Slovenia, Solomon Islands, Sweden, United Kingdom, United States of America. SOURCE: GSMA (pgs. 22-30).

Countries that do not appear on these two lists were either considering possible SIM card registration or it was not possible to determine the state of the law. For updates on any of the above countries, or countries that were not included, please email research@privacyinternational.org.

Timeline

2002

South Africa makes SIM card registration mandatory

Under the 2002 Regulation of Interception of Communication Act (RICA), all SIM cards, whether used in a mobile phone or for data, must be registered with the state via the person's service provider. A South African citizen must provide his or her name, address and identity number. For non-citizens, a name, address and passport number are required.

2003

Switzerland makes SIM card registration mandatory

Switzerland mandates user registration for prepaid SIM cards. SOURCE: GSMA (pg. 7).

Brazil introduces SIM card registration

In 2003, Brazil made SIM card registration mandatory and required all subscribers to present a proof of identity, such as their Cedula de Identidade (official national identity card), driver’s license, or taxpayer number. Telecommunications providers are required to store their customer information in a secure database. SOURCES: National Telecommunications Agency (Brazil); GSMA (pg. 41).

2004

Argentina makes SIM card registration mandatory

Law 25/891 on Mobile Communications Services makes registration of SIM cards mandatory for all mobile phone users.

2005

India makes SIM card registration mandatory

In 2005, India introduced mandatory SIM card registration. SOURCE: GSMA (pg. 33).

2006

Senegal and Mauritius adopt mandatory SIM card registration policies

Both Senegal and Mauritius mandate SIM card registration, in an effort to combat fraud and crime. SOURCE: DIW (pg. 2).

2007

Brazil expands SIM card registration requirements

Under Article 42 and 58 of the Regulation 477/07 of Anatel, users must provide a minimum set of personal data to be able to subscribe to a mobile telephone service. This information includes name, identity card number, and taxpayer number. Specific regulation exists for foreigners who wish to buy a Brazilian SIM card and requires that they present their passport.

2008

Botswana, Burkina Faso, and Sudan mandate SIM card registration

Botswana, Burkina Faso, and Sudan introduce policies to require SIM card registration. Botswana gave people until December 31, 2009, to register their SIM cards or any unregistered cards would be disconnected. Beginning January 1, 2010, SIM cards will only be activated once a person has registered the card. SOURCES: DIW (pg. 2); Telegeography.

2009

Mexico makes SIM card registration mandatory

Mandatory SIM registration is introduced under the National Mobile Telephone User Registry (Registro Nacional de Usuarios de Telefonía Móvil, 'RENAUT') scheme. The scheme requires new subscribers to be fingerprinted upon purchasing a handset or phone contract. SOURCE: Telegraph.

Greece makes prepaid SIM card registration mandatory

Greece adopted legislation to identify people who used mobile phone equipment and services, which included mandatory registration of prepaid SIM cards. Greece planned to block all unregistered SIM cards after July 2010. SOURCE: Mitek Systems.

2011

Colombia starts developing IMEI registration system

SIM card registration is not currently mandatory in Colombia but since 2011 the Colombian government has been developing a cell phone registry system that aims to avoid and deter cell phone theft. The system has two main parts: IMEI databases (a 'positive' database and a 'negative' one) and a verification scheme. Mobile carriers should block any IMEI listed on this negative database to bar them from working on their networks. Also, a verification procedure was devised to keep both databases operational and effective. Based on communications metadata, the activity of each cell phone in Colombian networks is monitored to detect counterfeit or duplicated IMEI, along with devices that lack a certificate of conformity.

Zambia makes SIM card registration mandatory

Zambia mandated SIM card registration. A form of ID and a proof of address are required to register. Zambian nationals can use a passport, national registration card, driver’s license, or voter card, while foreigners can use a passport or work permit ID card. Refugees and asylum seekers may face challenges in registering. SOURCES: ZICTA; GSMA (pg. 45); UNHCR (pg. 22).

Nigeria makes biometric SIM card registration mandatory

In November 2011, Nigeria passed the Communications Commission (Registration of Telephone Subscribers) Regulations (2011), which require mobile phone subscribers to allow their finger prints and a biometric map of their faces to be collected and registered to their SIM card, which are then stored in a central government database.

2012

Mexico repeals mandatory SIM card registration

In Mexico, mandatory SIM card registration is repealed. The Federal Institute for Access to Information and Data Protection (IFAI) is required to destroy all personal data of Mexicans contained in the registry. SOURCE: Informador.

Uganda makes SIM card registration mandatory

In March 2012, registration of SIM cards became mandatory in Uganda. The Uganda Communications Commission stated that SIM registration information would be stored confidentially by telecommunications operators in a secure database. People could present any official ID document, including a driver’s license or passport. SOURCES: TechJaJa; GSMA (pg. 38).

Democratic Republic of Congo makes SIM card registration mandatory

The Democratic Republic of Congo (DRC) made SIM card registration mandatory. People from the DRC are permitted to use a passport, driver’s license, voter card, student card, or service card to register. Refugees can use a Refugee ID card issued by the United Nations High Commissioner for Refugees (UNHCR), passport, national ID card, or voter ID card from their country of origin to register for a SIM card. SOURCES: Leganet; GSMA (pg. 44).

2013

Kenya makes SIM card registration mandatory

The Kenya Information and Communications Act 2013 makes it a criminal offence to fail to register one's SIM card. Not complying can result in a fine up to KES 100,000 (USD 1,150/ GBP 760,00) and/or imprisonment (up to six months).

Zimbabwe makes SIM card registration mandatory

Under the Postal and Telecommunications Act, the government requires all SIM cards to be registered to an identified individual. In order to purchase a SIM card from a telecommunications provider in Zimbabwe, an individual must produce his or her national identity card or passport and provide personal information, such as full name, permanent residential address, nationality, gender, and subscriber identity number. Under the regulations, the provider must send this information to POTRAZ (Postal and Telecommunication Regulatory Authority of Zimbabwe) where it is added to a database, controlled by POTRAZ, known as the Central Subscriber Information Database. POTRAZ retains the information in the database until five years after the customer’s contract expires. SOURCE: PI.

2014

Egypt makes SIM card registration mandatory

Egypt finalized a policy of compulsory SIM card registration. Operators must require their clients to provide them with personal data including ID card copies and numbers. Operators are required to review the personal data they hold in order to correct, update and complete the data of their customers; thus, operators have access to at least parts of the civic registry database of their clients. Bulk access to the database, however, is not permitted under Article 13 of the civic registry law 143/1994. SOURCE: PI.

Lebanon ends International Mobile Equipment Identity (IMEI) registration policy

Telecommunications minister Boutros Harb ends the policy of registering peoples' IMEIs, which identifies a physical phone or handset. The policy been introduced the year before. According to the government, the policy was ineffective and costly. SOURCE: Business News.

Central African Republic introduces mandatory SIM card registration policy

The Central African Republic (CAR) made SIM card registration mandatory. People without a form of ID are permitted to register provided they come to register with someone who does have an official form of ID. SOURCE: Telegeography.

Morocco enforces a ban on anonymous SIM cards

In April 2014, ANRT, the telecom regulator, started enforcing a ban on anonymous SIM cards. Mobile operators have been compelled to identify their subscribers, including prepaid SIM cardholders. ANRT justified the measure by its efforts to comply with Act 09-08 on the protection of individuals with regard to the processing of personal data. The measure provoked criticism from privacy activists and journalists who pointed that anonymous phone cards were important for protecting journalistic sources. SOURCE: ANRT.

Tunisia tightens rules for SIM card registration

Mobile phone customers in Tunisia are required to present documentary evidence to prove their identity upon purchase of a SIM card. Telecom operators keep records of customers’ data, including identities, dates of birth, postal addresses, and national identity numbers (CIN). In March, the government tightens the rules required for allocating SIM cards in an apparent effort to fight terrorism. Pursuant to that effort, in July, the telecom regulator INT threatened operators who failed to comply with the regulations with sanctions. SOURCE: INTT.

Thailand makes SIM card registration mandatory

Since June 2014, a request from the National Broadcasting and Telecommunications Commission (NBTC) makes it mandatory for operators to register SIM cards on their networks. SIM vendors use an application downloaded on their own smartphone to register the SIMs. In order to register a SIM card, the vendor takes a picture of the code on the SIM card and a picture of the buyer's ID card with the application, which then sends the information to the NBTC server. Once the information is approved, the NBTC sends back a message to the vendor allowing them to activate the SIM card. In an attempt to address privacy concerns, the NBTC has explained that the application automatically deletes the pictures from the vendor's phone. Foreigners who do not have a Thai ID card may use their passport. SOURCE: Nation Multimedia.

2015

Bangladesh introduces biometric SIM card registration

Bangladesh added a requirement to its mandatory SIM card registration policy that operators validate customers’ identities using their fingerprints, which will be matched against fingerprint data stored through the national identification system. SOURCES: Advox; GSMA (pg. 42).

Uganda connects SIM card information with ID information

The Ministry of Security ordered the Uganda Communications Commission to verify information provided by telephone users in the SIM card registration system by matching it with data collected during the National Identity card registration exercise. To bring its mandatory SIM card registration policy in line with the Registration of Persons Act 2015, Uganda required that people register their SIM card exclusively with their national ID card, as no other form of ID will be accepted going forward. SOURCE: TechJaJa.

Zimbabwe disconnects one million of unregistered SIM cards

In November 2015, Zimbabwe’s largest mobile service provider disconnected at least one million SIM cards because they were unregistered. SOURCE: PI.

2016

Polish government introduces counterterrorism law that includes mandatory prepaid SIM card registration

In June 2016, the Polish government passed a package of counterterrorism legislation that included a prohibition against people being able to purchase anonymous, prepaid SIM cards. The Polish government claimed that this legislation was necessary to provide security for two upcoming international events that Poland was set to host in July 2016: the North Atlantic Treaty Organization (NATO) summit and World Youth Day. Pre-existing had until February 2017 to register their SIM cards, or the cards would be blocked. SOURCES: HRW; EDRI; Telegeography.

Pakistan requires mobile phone users to verify their identities through fingerprints in national database

Since July 2016, SIM cards must be registered to their user, and SIM cards must also be biometrically verified against the National Database and Registration Authority's (NADRA) national database, often by fingerprint. The government plans to have all SIM cards biometrically verified. As of March 2015, 68.7 million SIMs had been biometrically verified out of 103 million SIMs in use at that time. Failure to biometrically register a SIM card will result in it being deactivated. SOURCES: Pakistan Today; The Guardian; The Express Tribune.

Malawi makes SIM card registration mandatory

In October 2016, Malawi passed the Communications Act of 2016 to make SIM card registration mandatory. People are required to provide their full name, identity card number or other ID, residential and business addresses, and any other information the telecommunications provider deems necessary.

Argentina announces the creation of the Mobile Communications Service Users’ Identification Registry

In November 2016, the Ministry of Communications and Ministry of Security announced the creation of the Mobile Communications Service Users’ Identification Registry. It requires Argentina's National Communications Agency El Ente Nacional de Comunicaciones (ENACOM)) to create a registry with the identity of all mobile communication users. Each phone number is linked to the identity of its owner. SOURCE: ADC Digital.

Belgium makes registration of prepaid SIM cards mandatory

In December 2016, it became mandatory in Belgium for all new prepaid SIM cards to be registered. For users who had purchased prepaid SIM cards before the new legislation came into effect, there is a six-month grace period for them to register their SIM cards that ends June 7, 2017. This legislation is part of a package of anti-terrorism legislation, which was passed following terror attacks in Belgium. SOURCE: Decroo.

2017

Ireland debates mandatory SIM card registration

In March 2017, Ireland debated a mandatory SIM card registration policy, proposed by Senator Aidan Davitt; however, the Minister for Communications, Climate Action and Environment, Deputy Denis Naughten, was opposed to such a policy. He noted that easy access to Ireland’s telecommunications services was a societal benefit, and with prepaid SIM cards there was no need to collect additional information to ensure future payments. Additionally, Ireland’s three main telecommunications providers already offered voluntary registration. SOURCE: Houses of the Oireachtas.

In Chile the attempt to increase data retention obligations of telecom companies is declared unconstitutional

The Chilean Government tried to increase data retention obligations of telecom companies through administrative Decree No866, in a manner incompatible with the right to privacy and the legal and constitutional provisions in force. The Decree was declared unconstitutional. SOURCE: PI.

All unregistered SIM cards to deactivated in Belgium

As of midnight on June 7, 2017, all unregistered prepaid SIM cards in Belgium were to be de-activated, following a six month grace period from when mandatory SIM card registration legislation came into effect. By June 7, 2017, roughly 85% of SIM card subscribers had been registered. SOURCE: Decroo.

India adds biometrics to SIM registration scheme

On June 15, 2017,, the Department of Telecommunications in India announced it will begin requiring biometric SIM card registration for new subscribers, and that it will also use biometrics to re-verify existing subscribers. New subscribers are required to biometrically register to allow for comparison with their Aadhaar credentials in a government database. Aadhaar is India’s national personal identification scheme.

Germany strengthens SIM card registration requirements

From July 2017, all SIM cards in Germany must be registered under peoples’ full names and an address that matches their national ID. SOURCE: Fandom.

Indonesia makes SIM card registration mandatory

As of 2017, to obtain a SIM card, Indonesians are required to provide their mandatory ID card, known as Kartu Tanda Penduduk (KTP), and foreigners are required to provide their passport. SOURCE: GSMA (pg. 34).

Bangladesh bans sale of SIM cards to Rohingya refugees

In September 2017, the Bangladeshi government banned telecommunications providers from selling SIM cards or phone plans to Rohingya refugees, citing security concerns. SOURCES: Yahoo; CBS News.

Lebanon plans to introduce biometric SIM card registration

In December 2017, it was reported that the Cabinet planned to introduce biometric SIM card registration, which would force Lebanese citizens and residents to provide a thumbprint to purchase a SIM card. Similarly, the Lebanese government reintroduced a proposal for IMEI registration, mandating that everyone who purchased a phone to have their identity attached to the IMEI number of the device. SOURCES: Al-Jadeed TV; PI.

The president of Paraguay vetoes a bill to collect biometric data from mobile subscribers

In 2017, Congress had approved a bill "that regulates the activation of mobile phone service" that would have forced everyone using a cell phone to provide a fingerprint to activate their cell phone lines, but the president of Paraguay vetoed the legislation. SOURCE: PI.

2018

Jordan announces the development of fingerprint registration for SIM cards

In January 2018, the Telecommunication Regulatory Commission announced that it would develop new regulations that would require new owners of SIM cards to submit their fingerprints to authenticate their numbers. Foreigners are required to show their passports. SOURCES: Royal News; Fandom.

Malawi announces that any unregistered SIM cards will be deactivated

In January 2018, Malawi announced that all mobile service providers had to ensure that their subscribers’ SIM cards were registered by September 30, 2018, and that all unregistered SIM cards were to be deactivated the following day. The government announced that deactivated SIM cards could only be reactivated if people provided documents that included their national identity card, driver’s license, passport, refugee identity card, asylum seeker identity card, or voter registration card. SOURCE: MACRA.

Indonesia announces that any prepaid SIM cards that are not registered will be blocked

In March 2018, the government announced that any prepaid SIM cards that were not registered would gradually be blocked from functioning. SOURCE: GSMA (pg. 34).

Uganda plans to use biometric readers for SIM card registration

In April 2018, the Uganda government ordered the Uganda Communications Commission to add 50 biometric readers to 50 SIM card registration centres to speed up the SIM card registration process. SOURCE: Observer.

India Supreme Court rules that Aadhaar (national identification) details cannot be required to obtain a mobile SIM card

The India Supreme Court ruled that people should not be required to have their Aadhaar (national identification scheme) details cross-referenced with a government database to be able to obtain a mobile SIM card. Instead, mobile phone providers can capture and store subscriber information without referencing it to the government’s national identification scheme. SOURCE: PI.

2019

Austria makes SIM card registration mandatory for prepaid SIM cards

Legislation came into effect on January 1, 2019, to require registration of prepaid SIM cards. All previous prepaid SIM cards need to be registered before September 1, 2019, or they will be blocked. SOURCES: MCA; Fandom.

Myanmar proposes mandatory biometric SIM registration

The Government of Myanmar proposes a biometric SIM registration system in absence of data protection laws and security safeguards. PI wrote to Myanmar's Post and Telecommunications Department (PTD) to demand that they reveal the rationale behind the scheme and how they expect to mitigate the associated threats.

PI also wrote to the four telecommunications operators outlining our concerns. Read more here.

2020

Romania declares mandatory SIM regsitration unconstitutional

On 18 February 2020, the Romanian Constitutional Court unanimously declared unconstitutional a new legislative act adopted in September 2019 introducing mandatory SIM card registration. The legislative act in question was an emergency ordinance issued by the Government which wanted to introduce this obligation as a measure “to improve the operation of the 112 emergency service number”. This is the second time the court issues an unconstitutionality decision on mandatory SIM card registration proposals. SOURCE: ApTI

Uganda to pilot blockchain for SIM registration

On 23 July 2020, the Uganda Communications Commission (UCC) reportedly signed a partnership with FSD Uganda (FSDU) and CryptoSavannah for the deployment of blockchain technology to "enhance" Uganda’s SIM card registration and verification process. SOURCE: BitcoinKE