Scenario: a logistics firm puts SIMs in 10,000 truck trackers; a smart factory connects thousands of sensors via mobile networks. When machine “subscribers” outnumber human ones, must machine SIMs register real identity like phone SIMs?
IoT/M2M subscriptions are still telecom subscriptions
Under telecom law, IoT (Internet of Things) or M2M (machine-to-machine) subscriptions use mobile numbers for device-to-device — not human-to-human — communication. In principle, subscriber registration rules in Decree 163/2024/ND-CP (effective 24 December 2024) cover IoT subscriptions too: records must be accurate and tied to a responsible organization or individual. The difference: the registrant is usually the enterprise deploying the IoT solution (bulk-registering thousands of SIMs), not individuals.
Numbering resources for IoT: a separate pool
Regulators reserve distinct number ranges and codes for IoT/M2M services in the national telecom numbering plan — separate from person-to-person ranges for proper management and charging. Deploying enterprises work with carriers on IoT number allocation, bulk activation and SIM lifecycle management (activate, suspend, reclaim).
The 2G sunset’s impact on IoT devices
The shock for many IoT deployers: millions of IoT devices run on 2G (cheap trackers, industrial sensors). Under the 2G phase-out: from 16 September 2024 no service for GSM-only terminals (except M2M and the Truong Sa/Hoang Sa/DK areas); the 2G system runs until 15 September 2026. 2G-only IoT devices must migrate to 4G (LTE-M, NB-IoT) before then — replacing thousands of units is a serious financial exercise needing early planning.
Duties of IoT-deploying enterprises
- Register IoT subscriber information fully and accurately under Decree 163/2024; answer for managed SIMs.
- Secure IoT devices and data — hijacked devices can become attack tools.
- Comply with storage and protection rules for device-collected data (especially location and personal data) under Decree 356/2025/ND-CP (from 1 January 2026).
- Coordinate with carriers on managing and reclaiming disused IoT SIMs.
Frequently asked questions
1. Must IoT device SIMs register real identity?
Yes. IoT/M2M subscriptions follow subscriber registration under Decree 163/2024/ND-CP; the registrant is typically the deploying enterprise, registering in bulk.
2. What happens to 2G IoT devices after 15 September 2026?
The 2G system shuts down from 16 September 2026 (except special areas). 2G-only IoT devices must migrate to 4G (LTE-M, NB-IoT) beforehand or lose connectivity.
3. How do enterprises register thousands of IoT SIMs efficiently?
Work with carriers on bulk registration, activation and lifecycle management; the responsible organization’s information must be complete and accurate.
4. Must IoT-collected data be protected?
Yes — especially location and personal data — under personal-data protection (Decree 356/2025 from 1 January 2026) and network information security rules.
5. Who is liable if IoT devices are hacked?
Deploying enterprises must secure their devices and systems. Owners/managers of compromised IoT devices causing harm to others bear liability under the law.
This article has been quality-reviewed by the FLAW AI Legal Council.