Liga MX Fan ID Explained: Privacy Concerns, Stadium Entry and the FMF Fine

How to create and use Fan ID before a Liga MX match

Create Fan ID before you leave for the stadium, then save the QR where you can open it without depending on a busy mobile network. The adult registration takes place through the official Fanliga route into Incode ID Wallet. You need your own contact details, a current identity document and a clean facial photograph; the resulting QR accompanies your ticket at the gate.

Adults need a phone, email, valid ID and a clear selfie

The current Estadio Banorte instructions describe the process for supporters over 18. Prepare a mobile number, an email address and a valid official ID. That venue lists an INE voter credential, passport or driver's license. A visiting supporter should still read the home club's match notice because accepted foreign documents and procedures can be stated differently by venue.

1. 1. Start officially. Enter through Fanliga and open Incode ID Wallet in the recommended mobile browser.
2. 2. Verify contact. Register your number and enter the one-time code sent to it.
3. 3. Capture the ID. Photograph the front and back, then correct any empty or inaccurate extracted fields.
4. 4. Complete the face check. Take the selfie, review the terms and privacy notice, then activate the wallet.

Use the actual current document, not a printed copy or an image displayed on another screen. Fanliga's camera advice is equally practical: remove glasses, a cap and a mask, face the camera and work in good light. A blurry image or hidden facial features can turn a quick registration into a matchday problem.

Each adult should create their own profile. Do not register a group under one person's details, and do not confuse a ticket purchaser with every person attending. The identity credential belongs to the person whose document and face were verified.

Save the QR before traveling to the stadium

Once the wallet is active, save the QR to the phone and make sure it opens. The official instructions say registration is completed once for future games, while the code is presented with the match ticket at entry. Keeping a local copy avoids hunting through browser tabs or repeating sign-in steps in a crowd.

Complete this check at home on a stable connection. Charge the phone, raise the screen brightness before reaching the scanner and keep the ticket ready as a separate item. Arriving early leaves time for a slower queue or a venue check without sacrificing kickoff.

Confirm the date and venue first on the Liga MX schedule for this week, then use the home club's entry guidance as the final match-specific instruction.

Why the biometric-data process raised privacy concerns

The privacy concern begins before the QR ever reaches a turnstile. Fan ID registration combines a facial photograph with an official-ID image and personal details to verify a supporter. That can help stadium security, but it also creates a higher duty to explain what is being collected, who is responsible, why it is used and how the fan's consent is obtained.

A face photograph can be sensitive personal data

A selfie may feel routine because phones request one for many services. In Fan ID, however, the photograph is used in an identity-verification process. Mexico's July 2026 decision said the photographs collected to generate Fan ID involved sensitive biometric data. That status matters because a face is not a password that can simply be changed after misuse.

The current FMF privacy notice lists the information associated with an adult profile: full name, email, phone, date of birth, selfie, an image of official identification and an identification code supplied by a technically capable third party. It describes Incode as the service provider handling the technical safeguards and says personal information is transferred to FMF for Fan ID management.

Those roles can sound abstract, so think of them in football terms. The service provider runs the verification machinery; the organization responsible for deciding why and how information is used remains accountable for that treatment. Sending the camera and identity checks through a contractor does not make the supporter’s privacy question disappear.

Safety purpose does not remove the need for informed consent

A safer stadium is a legitimate objective. The government finding did not say that protecting supporters was unimportant. It said the process used for sensitive information failed to tell fans clearly enough about its character and failed to secure consent in the required form. The point is procedural and practical: a person cannot make an informed decision if the most sensitive part of the transaction is not described accurately.

The currently published notice now gives fans much more to read. It describes primary uses such as identification, access management, security-rule enforcement and certain transfers to competent public authorities. It also lists stated retention periods and explains access, correction, cancellation and opposition rights, known by the Spanish acronym ARCO.

That current text should not be confused automatically with the version or conduct examined in the sanction. Privacy notices can change, and the authority's decision addressed the process it investigated. For a supporter, the useful habit is to read the notice presented during the registration session rather than assume that a summary from an earlier season still governs.

Fans can therefore hold two ideas at once: identifying violent offenders may make grounds safer, and an identity system must still handle personal information lawfully and transparently. Asking how the face image is processed is not opposition to stadium security. It is part of deciding whether the security tool treats ordinary matchgoers with the care it demands from them.

What the 42.8 million-peso FMF fine actually found

The July 2026 penalty was about how FMF disclosed and documented the handling of sensitive information in Fan ID. Mexico's Secretariat of Anti-Corruption and Good Government announced a fine of exactly 42,849,095 pesos. Its decision identified two central failures and additional breaches of lawfulness and accountability.

The government identified two core violations

The distinction matters. The decision did not rest on whether a fan remembered clicking a box. It asked whether the mechanism proved, beyond doubt, that the data subject gave the specific form of consent required. The authority said there was no autograph, electronic signature or equivalent authentication that established who had consented.

The Secretariat also found that FMF had not taken the measures necessary to satisfy principles of lawfulness and accountability. Hiring Incode to operate technical parts of the system did not transfer the responsibility that the decision attributed to FMF as the organization determining the access use.

The size of the fine was not presented as a round publicity number. The government said it considered the seriousness of the violations, the sensitive nature of the biometric information and FMF's economic capacity, using the federation's 2024 annual tax declaration.

The decision can be challenged and did not itself cancel Fan ID

A fine announcement is not necessarily the last procedural step. Reporting after the decision said FMF could use available legal remedies and that the Secretariat would defend the legality of its determination if challenged. At the time of El Economista's report, FMF had not publicly confirmed whether it would contest the sanction.

Fans should also avoid reading “fine” as “Fan ID has ended.” The official announcement described a monetary sanction and privacy violations; it did not announce that the entry system was abolished. The Fanliga registration page remained available when this guide was checked on September 7, 2026.

That leaves a practical split between the legal case and matchday reality. The decision can affect how consent and notices must be handled, while a club may still instruct adult supporters to present Fan ID at an upcoming fixture. Follow the current stadium instruction unless an official update changes it, and treat social posts declaring the whole system “canceled” with caution.