Online safety & content laws in Mexico (2026)

President Sheinbaum published Mexico's sweeping new telecom law in the DOF, dissolving the IFT and replacing it with two bodies—ATDT (policy and digital inclusion) and CRT (technical regulation); the law defines digital platforms as telecom services, imposes content-moderation obligations on intermediaries, and grants the ATDT authority to temporarily block platforms that repeatedly violate applicable regulations. It represents the most far-reaching overhaul of Mexico's internet governance framework since 2014.

The IFT published its first implementation report on the 2021 Net Neutrality Guidelines, finding that most ISPs had published required traffic-management policy codes but identifying persistent gaps in user-facing transparency and disclosure; the report established the enforcement baseline before the IFT's eventual dissolution.

The IFT's net-neutrality rules were published in the DOF (effective 3 September 2021), prohibiting ISPs from blocking, throttling, or engaging in paid prioritisation of internet traffic and requiring transparent public disclosure of traffic-management practices; civil-society groups criticised broad exceptions they said weakened genuine neutrality protection.

The Second Chamber of the Suprema Corte de Justicia de la Nación (SCJN) dismissed an amparo challenge to Article 189 of the LFTR, confirming that telecommunications carriers and ISPs must retain users' communications metadata for 24 months and make it accessible to security authorities on request; privacy advocates said the ruling normalised warrantless mass-surveillance infrastructure.

A constitutional reform to Articles 6, 7, 27, 28, 73, 78, 94, and 105 created the Instituto Federal de Telecomunicaciones (IFT) as a constitutionally autonomous body, recognised access to broadband internet as a fundamental right, and broke up incumbent telecom dominance; it provided the constitutional architecture for the 2014 LFTR.

Mexico's first comprehensive private-sector data-protection statute was published in the DOF, applying OECD fair-information principles to private-party data processors, establishing IFAI (later renamed INAI) as the supervisory authority, and granting individuals ARCO rights (access, rectification, cancellation, objection); it made Mexico among the first Latin American countries to adopt a standalone data-protection law.

Reforms to the Código Penal Federal introduced Articles 211 Bis 1–7, criminalising unauthorised access to computer systems, destruction or alteration of data, and electronic system interference, with custodial penalties up to 12 years; these provisions remain the primary federal criminal framework for online offences in the absence of a dedicated cybercrime statute.