Mexico's LFPDPPP: cookie rules for Mexican visitors
Mexico does not require opt-in consent before ordinary cookies. Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares, in force since 21 March 2025, tacit consent is valid as a rule once a privacy notice has been made available and the person does not object, while financial data needs express consent and sensitive data express written consent. The implementing Regulation requires sites that collect data automatically, as cookies do, to say so when the visitor arrives and explain how to disable them. The Secretaría Anticorrupción y Buen Gobierno replaced the INAI as regulator and can fine up to 320,000 times the UMA, doubled for sensitive data.Quick facts
| Applies to | Private individuals and companies that process personal data in Mexico, except credit information companies and purely personal, non-commercial processing (Article 1) |
| Consent model | Tacit consent is valid by default after the privacy notice is made available (Article 7); express consent for financial or patrimonial data; express written consent for sensitive data (Article 8) |
| Cookie rule | The Regulation (Article 14) requires telling visitors, when they arrive, that automatic collection technologies such as cookies are used and how to disable them; the privacy notice must list options to limit use |
| Authority | Secretaría Anticorrupción y Buen Gobierno (replaced the INAI on 21 March 2025) |
| Maximum penalty | Fines of 100 to 320,000 times the Unidad de Medida y Actualización (UMA), an extra fine of up to 320,000 UMA for repeated violations, and up to double for sensitive data; prison terms for certain data crimes |
| In force since | 21 March 2025 (new law); the previous law dated from 5 July 2010 |
What is Mexico's new data protection law?
On 20 March 2025 the Diario Oficial de la Federación published a decree that issued three laws at once, including a new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP), the law that governs personal data held by private companies. The decree took effect the next day, 21 March 2025, and abrogated the previous LFPDPPP of 5 July 2010. It follows a constitutional reform on "organic simplification" published on 20 December 2024 that dissolved the INAI, the autonomous institute that had supervised data protection since 2010.
The new law keeps most of the 2010 structure: the privacy notice (aviso de privacidad), consent, the ARCO rights (access, rectification, cancellation and opposition), security duties and sanctions. The main change is institutional. Article 2 defines "the Secretaría" as the Secretaría Anticorrupción y Buen Gobierno, a ministry of the federal executive, which now handles complaints, verifications and sanctions. The decree's fourth transitory article says that every mention of the INAI in other laws and regulations is to be read as a reference to the bodies that took over its functions.
Who does the LFPDPPP apply to?
The law applies across Mexico to private individuals and companies that process personal data. Article 1 excludes only credit information companies, which have their own law, and people who collect and store data exclusively for personal use, without disclosure or commercial use. Public bodies fall under a separate general law issued by the same decree.
Personal data is any information about an identified or identifiable person, including a person who can be identified indirectly through any information. Cookie identifiers and IP addresses linked to a browsing profile can therefore be personal data.
What does the law require for cookies?
Mexico has no cookie-specific article in the law itself, but three provisions shape what a website must do.
Consent, usually tacit. Article 7 subjects every processing operation to the person's consent, which can be express or tacit. Consent is tacit when the privacy notice has been made available and the person does not object. As a general rule tacit consent is valid, unless another provision requires express consent. Financial or patrimonial data needs express consent, and Article 8 requires express written consent, through a handwritten or electronic signature or another authentication mechanism, for sensitive data: data that could reveal racial or ethnic origin, present or future health, genetic information, religious, philosophical and moral beliefs, political opinions and sexual preference. Consent can be withdrawn at any time, and the privacy notice must explain how.
The privacy notice. Article 15 lists its minimum content: the controller's identity and address, the data processed (identifying sensitive data), the purposes (separating those that need consent), the options and means offered to limit use or disclosure, how to exercise ARCO rights, and how changes are announced. Under Article 16, when data is collected electronically, a simplified notice with the first four items must be shown, pointing to the full notice.
Automatic collection technologies. The Regulation of the LFPDPPP, published on 21 December 2011, says in Article 14 that a controller using mechanisms in remote or local means of electronic communication that collect personal data automatically and simultaneously when the person makes contact, which is what cookies and web beacons do, must inform the person at that moment of their use, that personal data is obtained through them, and how they can be disabled. That Regulation was issued under the 2010 law; the decree gave the federal executive 90 days to adapt regulations to the new framework, and the new law itself still refers to "the Regulation of this Law". We found no replacement regulation published as of October 2026, so following Article 14 remains the prudent reading.
In practice, a notice or banner on arrival that says the site uses cookies, links to the privacy notice and lets the visitor turn non-essential cookies off meets the Mexican model. Prior opt-in is not required for ordinary cookies, but it is required if a cookie or tracker processes sensitive or financial data.
The right to object. Article 26 lets a person oppose processing for a legitimate reason, or when automated processing without human intervention produces unwanted legal effects or significantly affects them, for example by predicting economic situation, health, sexual preferences or behavior. Profiling for advertising can fall here.
What are the penalties?
Article 58 lists 19 infringements, and Article 59 sets the fines in multiples of the Unidad de Medida y Actualización (UMA), a daily reference value published each year:
| Infringement | Sanction |
|---|---|
| Not answering an ARCO request without good reason | A warning to comply |
| Processing contrary to the principles, omitting elements of the privacy notice, negligence with ARCO requests | 100 to 160,000 UMA |
| Collecting or transferring data without express consent where required, deceptive collection, security breaches, unlawful transfers | 200 to 320,000 UMA |
| Repeated infringements | An additional 100 to 320,000 UMA |
Fines can be increased up to twice these amounts when sensitive data is involved. Articles 62 to 64 also set prison terms of three months to five years for causing security breaches for profit or processing data by deception, doubled for sensitive data. Decisions of the Secretaría can be challenged through amparo before specialized courts.
How Cookiequiet handles Mexico
Mexico is not in Cookiequiet's default list of regulated countries, but geo-targeting, free on every plan, lets you add it to a custom list so that Mexican visitors see a banner that announces cookies, links to your privacy notice and lets them switch categories off. Spanish is one of the 24 banner languages, picked from the visitor's browser and editable. The policy generator writes for the GDPR, LGPD and other laws rather than the LFPDPPP, so adapt the aviso de privacidad to Article 15 yourself. For neighboring rules, see Brazil's LGPD, Colombia and Argentina.