Age verification in Mexico for games, social media and app stores

Last reviewed: 24 October 2026 · Not legal advice

Age verification in Mexico became a shared duty for games, social media, app stores and other platforms on 14 October 2026. That day the Decreto de entornos digitales seguros para niñas, niños y adolescentes (Decree on safe digital environments for girls, boys and adolescents) was published in the Diario Oficial de la Federación (DOF, Mexico's official gazette) and entered into force.^[1]

The decree says what to achieve, not how. This guide covers the how, by platform type: where the check sits, method and fallback, under-18 defaults and Article 5 evidence. The decree itself is explained in our guide to Mexico's age verification decree, and the report in how to write the 30-day report. English renderings of Spanish quotes are our translations.

Which platforms the decree covers

Article 2 defines a "Plataforma digital" (digital platform) by what it does, then gives examples.^[1]

Article 2Decreto de entornos digitales seguros, DOF 14 October 2026

"Digital service provided by intermediaries over the Internet that allows interaction, communication, generation, dissemination or sharing of content between users [...]; these include social networks, video games, app stores, among others."

Source: DOF, nota 5801237^[1] (our translation of the Spanish text)

The list ends "entre otros" (among others), so the test is the definition: users interact or share content. Asked on 20 October 2026 which platforms are covered, President Claudia Sheinbaum answered "Todas" (all).^[5]

The last four rows are our reading of the definition: confirm with counsel. According to Holland & Knight, the decree "does not establish exemptions based on platform size" and "does not expressly establish the criteria for determining whether foreign platforms fall within its scope".^[18] Minors means everyone under 18, as the Legal Counsel to the Presidency said on 14 October, in line with the Ley General de los Derechos de Niñas, Niños y Adolescentes (LGDNNA, the general law on children's rights).^[3][7]

The duties every platform type shares

Articles 4 and 5 apply to all platforms alike; what changes is where each duty lands.^[1]

The age rule itself is short. Article 4 fraction I asks for "mecanismos confiables y seguros para identificar la edad de las personas usuarias" (reliable and secure mechanisms to identify users' age) and adds that these mechanisms "no deberán limitarse a la autodeclaración de las personas usuarias para la acreditación de la edad" (must not be limited to users' self-declaration to establish their age).^[1] Asked about the CURP (Mexico's population registry key) or biometrics, the President said platforms have mechanisms "en la propia apertura de la cuenta, o también a través de los contenidos que se están generando" (at account opening, or through the content being generated).^[3] The method is the platform's choice.

One age-check architecture, set per platform type

One flow fits most platforms; change the threshold, the moment of the check and the fallback. A birth date is a first step, never the whole mechanism.^[1]

Strict defaults stay on until the check clears the account.

Strict defaults until the check clears 18 is our reading of fractions I and VIII. The UK's Ofcom lists facial age estimation and photo-ID matching among methods capable of being highly effective, and self-declaration among those that are not.^[13]

A CURP lookup against RENAPO (the national population registry) returns data only, with no portrait to face-match: alone, it shows a CURP exists, not that the user holds it.^[22] Users without a CURP, such as many foreign users, need another route.

Age verification in Mexico by platform type

Proposed design choices, not text of the decree.

Social networks

On a social network, any of the seven content categories of Article 3 can surface, from cyberbullying to self-harm.^[1] Check age at sign-up and before contact features: messages from strangers, live video, public profiles. The European Commission's guidelines under the Digital Services Act (DSA) name live chat and anonymous messaging as contact risks that can justify age verification where less intrusive measures fail.^[14]

Existing accounts are the hard part. The age rule speaks of "las personas usuarias de sus servicios" (the users of their services); we read it as covering existing accounts too, so plan a re-check that starts with accounts showing signals of a minor.^[1] Brazil's ECA Digital (Lei 15.211/2025) makes networks suspend an account on well-founded signs that it breaches minimum-age rules, with a fast appeal where a guardian can prove age.^[11]

Video games: in-game chat, user content and purchases

In a game the risk sits in chat with strangers, user-generated content and spending: check at account creation, keep those features behind it, and use an ID document for 18+ titles.

Mexico already had a video game age rule. Article 69 Bis of the LGDNNA tells the Interior Ministry (SEGOB) to classify video games distributed "por cualquier medio" (by any means), and requires sellers of adults-only titles to make buyers "acrediten su mayoría de edad" (prove they are of age).^[7] SEGOB's 2020 guidelines set five classes (A, B, B15, C and D, the last two adults only), bind only sellers of physical copies and label in-game purchases with random items; we found no Mexican rule on minors' in-game spending.^[8]

Abroad, purchases are regulated. Brazil bans loot boxes in games aimed at or likely to be accessed by minors under their age rating, and requires age verification for games that keep them, unless a version without them is offered or the feature is off by default.^[11][12] The EU guidelines ask that minors not be exposed to paid loot boxes.^[14] Australia's under-16 rule excludes services whose sole or primary purpose is online gaming, an exemption that does not carry over to Mexico, where video games are named.^[16][1]

App stores

App stores are named in Article 2, and they sit upstream of every other app.^[1] The decree does not say how stores and apps share age information. Two foreign laws do. Brazil requires stores and operating systems to assess users' age or age range with auditable measures and to pass an "age signal" to apps through an API; its decree makes the signal free and forbids sending the exact date of birth.^[11][12] The Texas App Store Accountability Act (SB 2420, effective 1 January 2026, enforceable while appeals continue after the Supreme Court declined to lift a stay on 6 July 2026) requires stores to verify the age category of each user at account creation and to get parental consent for each download and purchase by a minor.^[17][29]

Brazil still requires apps to run their own mechanisms, applying the more protective result when they disagree with the store.^[11][12] In Mexico the duty also sits on each platform, so document your own check.^[1]

Marketplaces and dating apps

• Marketplaces: check age at the checkout of age-restricted goods, or at sign-up with purchases blocked by default, the two options Brazil's decree gives sellers.^[12] Business sellers can be checked with business verification.
• Dating apps: adults only, so the check comes before any profile is shown. Brazil's decree requires sexual dating services to block minors' accounts and to find and remove them.^[12]

Article 5: the contact point, evidence and the age-check record

Each platform must designate a contact point for prosecution and justice authorities, available "las 24 horas del día y los 365 días del año" (24 hours a day, 365 days a year), with immediate technical capacity to act.^[1] When it removes an account or content, it must preserve "cualquier evidencia digital" (any digital evidence) for at least 90 días hábiles (working days), and alert the authorities immediately about content that threatens minors.^[1]

Simplified: the platform designs the process.

The decree does not say whether the age-check record is evidence; we advise keeping it with the removal record, as it shows what the platform knew about the user's age. Ninety working days are more than four calendar months, so a 90-day retention setting is too short.

Data protection pulls the other way. The Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, the 2025 data protection law) requires express written consent for sensitive data, with an open list: biometrics are not named, but a face image can reveal ethnic origin, so we treat selfies as sensitive as a precaution.^[9] According to La Jornada, the Senate approved on 20 October 2026 a reform requiring parental consent for minors' data; it still needs the Chamber of Deputies.^[19]

How other countries split age duties by platform type

Other laws assign duties by platform type, which helps map existing controls to Mexico.

Brazil, the UK, the EU and Australia all rule out self-declaration alone, and the UK and EU guidance keeps the platform responsible when it relies on a store or a third party.^{[11][13][14][28]} Our ECA Digital guide covers Brazil.

Timeline and what happens after the report

1. 9 October 2026PresentedPresented at the President's press conference.^[4]
2. 14 October 2026In forcePublished in the DOF, in force the same day.^[1]
3. 20 October 2026Senate voteLFPDPPP reform on minors' data approved, per La Jornada.^[19]
4. About 13 November 2026Report due30 calendar days from 14 October.^[1]

No date, recipient or format in the decree: file early.

The 30 days are "días naturales" (calendar days) "contado a partir de su entrada en vigor" (counted from entry into force).^[1] Counting from 15 October gives Friday 13 November 2026; counting 14 October as day one gives Thursday 12 November. The federal administrative procedure law starts periods the day after a notification takes effect (Art. 38), which by analogy points to 13 November, but it may not govern this report, and no official source fixes the date.^[10] Our planning advice: file by 12 November, and confirm with counsel.

The decree sets no penalty. The President called it mandatory but not punitive and said the Agencia de Transformación Digital y Telecomunicaciones (ATDT, the federal digital agency) would follow up on progress.^[2][3][6] She added that if platforms do not comply, a law with sanctions would be worked on in the Mesa de Trabajo (working group) that Transitorio TERCERO tells the Consejería Jurídica del Ejecutivo Federal (Legal Counsel to the Executive) to set up for regulatory proposals.^[3][1]

Checklist before the report deadline

• Map every feature where users interact or share content.^[1]
• Replace any age gate that relies only on a typed birth date.^[1]
• Choose the method, fallback and borderline band for each flow, and write down why.
• Turn on the strictest privacy and safety settings for new accounts until age is known.^[1]
• Plan the re-check of existing accounts, signals of a minor first.
• Connect parental supervision to accounts marked as minors.^[1]
• Name the 24/7 contact point and test it with a mock request.^[1]
• Preserve evidence of removed accounts for at least 90 working days^[1]; we also advise keeping the age-check reference with it.
• Write the age-assurance section of the report with dates, methods and numbers.^[1]

How Didit helps with age verification in Mexico

Didit covers the age check and, where you need it, the identity check, through ID verification and age verification. Moderation, parental tools, the 24/7 contact point and the report stay with you.

• Age estimation from a selfie, run inside the liveness check, which flags presentation attacks.^[20]
• Borderline estimates move to ID document verification, with the document portrait matched to the age selfie.^[20]
• Docs report a mean absolute error of 1.0 year for 13 to 17-year-olds and 1.8 years for 18 to 20-year-olds; estimates near the threshold can fall either side, hence the step-up.^[20]
• Document capture for Mexican ID cards, passports, driver's licences and residence permits.^[21] Separate database checks: CURP against RENAPO, and INE voter credential validity against the INE registry.^[22][23]
• Age-only results without identity attributes; retention from 1 month to 10 years once you set it (unlimited by default), deletion on demand, EU processing by default.^[25][24]
• Face search to flag possible duplicate accounts^[26], and the verification flow in Spanish.^[30]
• iBeta Level 1 presentation attack detection, ISO/IEC 27001 and SOC 2 Type 2.^[27]

No Mexican authority approves age-check vendors, and the report is yours. Didit helps you document reliable, secure age checks that go beyond self-declaration, which maps to Art. 4 fr. I. See pricing and the Mexico page.

Frequently asked questions

Sources

1. Decreto de entornos digitales seguros para niñas, niños y adolescentes, Diario Oficial de la Federación, Edición Vespertina, 14 October 2026.
2. Presidenta Claudia Sheinbaum firma decreto de entornos digitales seguros para niñas, niños y adolescentes, Presidencia de la República, 14 October 2026.
3. Versión estenográfica, conferencia de prensa del 14 de octubre de 2026, Presidencia de la República.
4. Versión estenográfica, conferencia de prensa del 9 de octubre de 2026, Presidencia de la República.
5. Versión estenográfica, conferencia de prensa del 20 de octubre de 2026, Presidencia de la República.
6. Decreto de entornos digitales seguros para niñas, niños y adolescentes, Consejería Jurídica del Ejecutivo Federal, 14 October 2026.
7. Ley General de los Derechos de Niñas, Niños y Adolescentes, Cámara de Diputados, Arts. 5, 69 Bis, 101 Bis 2 and 101 Bis 3.
8. Lineamientos Generales del Sistema Mexicano de Equivalencias de Clasificación de Contenidos de Videojuegos, SEGOB, Diario Oficial de la Federación, 2020.
9. Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Cámara de Diputados, DOF 20 March 2025.
10. Ley Federal de Procedimiento Administrativo, Cámara de Diputados, Arts. 28, 29 and 38.
11. Lei nº 15.211, de 17 de setembro de 2025 (ECA Digital), Planalto, Arts. 9, 12, 14, 20, 21, 24 and 35.
12. Decreto nº 12.880, de 18 de março de 2026, Planalto, Arts. 15, 18, 23 and 25.
13. Age assurance duties under the Online Safety Act, Ofcom, updated 2 September 2026.
14. Guidelines on measures to ensure a high level of privacy, safety and security for minors online, C/2025/5519, European Commission, Official Journal.
15. Social media age restrictions, eSafety Commissioner, Australia.
16. Online Safety (Age-Restricted Social Media Platforms) Rules 2025, Federal Register of Legislation, Australia, s 5.
17. S.B. No. 2420, App Store Accountability Act, Texas Legislature, 89th Regular Session.
18. Mexico Introduces New Child Safety Obligations for Digital Platforms, Holland & Knight, 16 October 2026.
19. Senado aprueba por unanimidad reforma para proteger a menores en entornos digitales, La Jornada, 20 October 2026.
20. Age estimation overview, Didit documentation.
21. Supported documents for ID verification, Didit documentation.
22. Mexico CURP database validation, Didit documentation.
23. Mexico INE credential validation, Didit documentation.
24. Data retention, Didit documentation.
25. Changelog, August 2026, Didit documentation.
26. Face search overview, Didit documentation.
27. Certifications, Didit documentation.
28. New regulatory guidance released to support social media industry ahead of minimum age law, eSafety Commissioner, 16 September 2025.
29. Order list of 6 July 2026, SEAT v. Paxton (25A1389), Supreme Court of the United States.
30. Supported languages, Didit documentation.

Read the decree guide, and see ID verification and age verification for the checks behind each flow.