Every year, the GSMA, a mobile network and cell phone industry association, publishes a sobering report. It charts the number of countries worldwide that have implemented mandatory prepaid SIM card registration requirements.

Globally, nearly three in four mobile SIM cards in use within cell phones are prepaid. They’re the lifelines that let shift workers know when to come into the workplace and when to stay home, enable mobile banking to take place and help people stay connected with friends and family, even if they’re hundreds or thousands of miles from home.

And every year, the GSMA shows the number of these countries rising. As of early 2021, it was 157 countries. They include Mexico, which in 2021 introduced rules that would help connect SIM card registration data with biometric information to create one massive database, and Kenya, which has lately compelled telecommunication providers to message users with threats to disconnect their devices if they don’t register centrally. They join the likes of China, Myanmar, Belarus, and Venezuela in the unenviable list of countries mandating registration — many of whom can commonly be described as authoritarian regimes.

In most of the world, if you use a mobile phone, you have probably handed a good deal of personal information over to whatever company provides your service — your name, address, date of birth, national ID or social security number and maybe a few other details. 

What happens to that data after you fill out the paperwork for your mobile plan, or buy a new SIM card? In more and more countries around the world, it goes to the government.

The latest adopter of this approach is a big one: the Philippines. In early October, president Ferdinand Marcos Jr. signed a new law requiring all mobile users in the country to register their SIM cards with telecommunications companies, using a government-issued ID. The law also requires Filipinos to use their real names when registering for social media accounts and provide a phone number. 

The situation is particularly acute in the Philippines because of its high cell phone penetration, Mong Palatino, a former legislator and Manila-based activist, explained. “The unique situation in the Philippines is that we have a population of 110 million, but we have about 120 million cellphone users,” he said. “The concern is not just about civil liberties, it’s about disenfranchisement.”

Palatino worries that the laws, as designed, will penalize those who don’t register their SIM cards more harshly than those who misuse phones for the purpose of committing crimes. While the law isn’t yet implemented, it is in process — with an impact on everyday users when it is passed into legislation.

The Philippines joins a long list of countries that now require people to register with the government to gain access to basic communications tools. “I think it’s actually one of the less surprising trends,” Tanya Lokot, associate professor in digital media and society at Dublin City University, said. In many of the authoritarian countries that Lokot studies — including Russia and Belarus — mandatory SIM card registration has been in place for a decade or more.


The reasons why authoritarians impose SIM registration requirements are obvious, Lokot said: “If you can just buy a SIM card, without tying it in any way to your ID, it really frees you up in terms of what you can use that number to do.” 

By making registration mandatory, the theory goes, states discourage people from using their mobile phones to take part in protests, online opposition discussions or signing digital petitions — because those actions can then theoretically be linked back to them. The same argument is used by those who believe real-name policies on social media will help dissuade peddlers of hate speech or racism from spreading their comments online.

Not acting becomes a net negative for those trying to exert control over their population. Giving people the freedom of expression “for the authoritarian regimes is not a good thing, because their whole shtick is kind of trying to deepen the control over what their citizens do, and how they communicate,” Lokot said.

Linking a device to an individual is also helpful for regimes to be able to leverage hardware-based monitoring of citizens. 

“If [states] know that a number is tied to a particular person, it’s much easier to do targeted requests for data or metadata, and then to basically track every step of whatever that person is doing using that phone number,” Lokot said. It’s all about triangulating movements and putting together the disparate pieces of an individual’s online and offline worlds, and official identification documents are one of the easiest ways to connect the two.

“It makes it easier for law enforcement to track and monitor people,” Damar Juniarto, executive director at SAFEnet, an Indonesia-based nonprofit focused on ensuring the safety of expression online and offline, said. “Now people have to give their identification, and in some countries have to register on a single submission platform.” Juniarto is particularly concerned about the impact on vulnerable groups like LGBTQ+ people. “They are coming out as gay or lesbian, and then the government knows these people are using these specific phone numbers, and can be tracked because of that,” he said.


None of this is theoretical: In Russia, which has some of the strictest monitoring of opposition because of the perilous state in which President Vladimir Putin rules, the government has been using mobile phone data to go after opposition activists and protesters. The Russian state has gained access to phone metadata from key protesters, investigating who they’ve been in contact with and using that to build linkages that identify networks of opposition who can then be silenced through targeted arrests and harassment, Lokot explained. It is very easy to follow the digital breadcrumbs into the physical world in a country where mandatory SIM registration with a government ID is required. 

“Usually, with the phone number, you have a passport. And with the passport, you have an address, or at least a place where that person is registered,” Lokot said. “It’s really like a trail towards identifying —  and sometimes physically tracking down — a particular individual.”

That’s the particular concern of those who are opposed to the dragnet-style collection of data that comes alongside mandatory SIM card registration: that what could, in theory, be excused as a legitimate reason to collect information is used to tamp down dissent, and worse, shared among law enforcement agencies to enable the harassment of individuals who the state sees as a threat. Mandatory SIM card registration, and the associated data that stems from that — from passport numbers to call logs to home addresses — can then be used to build giant databases. “When you have all these things together, it results in there being huge troves of data that aren’t necessarily well-guarded,” Lokot said. Russia has a thriving black market for accessing data from government databases. (Every cloud has a silver lining: Russia’s porous data economy allows open-source investigation teams like Bellingcat to identify individuals accused of war crimes in Ukraine.)

While they are sometimes used to identify people accused of wrongdoing, these databases are also being deployed by common criminals to commit mortgage or identity fraud. “There’s all sorts of concerns about the fact that the state is accumulating so much data,” Lokot said. “The key concern is that [the state is] using it to persecute people, but the other concern is that it’s also not very good at keeping that data safe, and therefore it also is dangerous for ordinary citizens. If they don’t get in trouble for posting protest calls online, their data can still be misused.”


That’s in large part what worries those in the Philippines about the imminent arrival of their mandatory SIM card registration law. “The stakes are related to the high level of distrust in the government,” Palatino said. “We’re in a situation where law enforcement aggressively wage a brutal war with drugs, but are also accused of committing human rights violations with no regard for privacy and civil liberties. They’ll have a new tool with this law to get our personal information. Naturally there’s concern about it.”

Palatino also worries that the SIM card requirements “will open the way for other draconian legislation.” Days before we spoke, he read about a law proposed by a Filipino senator that would outlaw “fake news” — by which the legislator meant information with which they did not agree. “They want to criminalize anonymity on the internet,” he said. “It’s a reflection of our policymakers being divorced from what’s being experienced by ordinary users.”

The other issue at hand here is that if a country’s laws require retailers to check your ID before they’ll give you access to a cell phone SIM card, and you don’t have one, you can’t get a mobile phone at all. It’s disenfranchisement on a mass scale. Data from GSMA shows that around 14% of people in low and middle income countries don’t have a national identification card. They are primarily women, the unemployed, people with disabilities and those with little formal education.

Of course, with mandatory registration in more than 150 countries and counting, it is easy to assume that the genie is not going back into the bottle. Mandatory SIM card registration is probably here to stay.

Juniarto is less defeatist. “I think it’s not too late,” he said. There are ways to lobby governments, if they’re beholden to requiring registration, to impose methods that help maintain people’s cybersecurity without impinging on their rights or disenfranchising them. He pointed to Estonia as an example of a country that has been a major innovator in digital governance, while not overreaching when it comes to linking government IDs with phone SIM cards.

Of course, authoritarian regimes looking to crack down on dissenting voices won’t adopt this kind of approach willingly. “We need regulatory bodies in the U.N., like the ITU [International Telecommunication Union], to introduce a new digital identity process that’s safer for everyone,” Juniarto said. “We need to import this model from Estonia, so everyone knows we have to protect the privacy of people.” It’s vital, Juniarto said, for a simple reason: “Protecting privacy means you’re protecting democracy itself.”