Mexico age verification decree: what platforms must do (2026)

Last reviewed: 24 October 2026 · Not legal advice

Mexico age verification became an obligation on 14 October 2026, when the DOF published a decree signed by President Claudia Sheinbaum Pardo: digital platforms must keep users under 18 away from seven categories of harmful content, identify users' age with reliable and secure mechanisms, and report within 30 calendar days.^[1][3]

This guide reads the decree article by article from the official text: scope, every obligation, the age-assurance duty, the reporting deadline, open questions, data protection and a comparison with Brazil, the UK, the EU and Australia. It ends with a 30-day plan for product, trust-and-safety and legal teams.

Mexico age verification decree at a glance

What the decree is and where it comes from

The decree is an executive act issued under the President's regulatory power (Article 89, fraction I of the Constitution). Its preamble relies on Articles 101 Bis 2 and 101 Bis 3 of the Ley General de los Derechos de Niñas, Niños y Adolescentes (LGDNNA, General Law on the Rights of Girls, Boys and Adolescents), which give minors a right to safe Internet access and, since December 2024, tell the State to prevent and sanction cyberbullying and online violence.^[1][5] The heads of Defence, Security, Public Education, Health and the Agencia de Transformación Digital y Telecomunicaciones (ATDT, Digital Transformation and Telecommunications Agency) co-signed it.^[1]

The President presented the draft on 9 October 2026.^[4] The Legal Counsel to the Executive, Luisa María Alcalde Luján, said Meta, Microsoft, Apple, TikTok, Google, X and Huawei, among others, attended the prior meetings, and that the 30-day clause was "agreed with the platforms" (our translation).^[3]

1. 9 October 2026PresentedDraft shown at the morning conference.
2. 14 October 2026Signed, in forceDOF evening edition; applies the same day.
3. 20 October 2026Separate billSenate vote on minors' data, reported by La Jornada.
4. 12 to 13 November 2026Report dueEnd of the 30 calendar days.
5. After the reviewPossible lawA law with sanctions if platforms fall short.

The decree's timeline. The report date depends on how the 30 days are counted (see below).^{[1][3][4][17]}

Who is covered: the Article 2 definition

The decree applies to "Plataformas digitales", a defined term that turns on function: users can interact or share content.^[1]

Art. 2Decreto de entornos digitales seguros

"Plataforma digital: servicio digital que prestan intermediarios a través de Internet que permiten la interacción, comunicación, generación, difusión o compartición de contenidos entre personas usuarias [...]; entre las que se encuentran, redes sociales, videojuegos, tiendas de aplicaciones, entre otros."

Our translation: a service by intermediaries over the Internet that lets users interact, communicate or share content, to offer, sell or intermediate goods, services, apps or content, among other purposes, including social networks, video games and app stores. Source: DOF, 14 October 2026^[1]

There is no exemption by size and no test for foreign services. According to Holland & Knight, application to foreign platforms "actively serving Mexican users appears more readily supported" than to services merely reachable from Mexico.^[1][16] Our reading of common service types, not an official list:

"Likely" means the wording fits; confirm with counsel. Sector flows are in our guide on age verification for games, social networks and app stores in Mexico.

What Mexico's age verification decree requires: Articles 3 to 5

Article 3 is the core prohibition. Platforms may not allow girls, boys and adolescents "access to, exposure to or recommendation of" content, especially images and videos, that generates or promotes seven categories:^[1]

• I. Harassment, including cyberbullying.
• II. Sexual abuse, exploitation or violence.
• III. Hate speech, violent extremism or any form of mass violence.
• IV. User-to-user exchange of content that promotes or incites hatred or violence, especially in the school environment.
• V. Unlawful conduct or content that glorifies crime.
• VI. Pornography and any sexually explicit material.
• VII. Suicide, deliberate self-harm and eating disorders.

The word "recomendación" suggests recommender systems are in scope.^[1]

Article 5, fraction II counts in días hábiles (working days).^[1]

The age-assurance duty in depth: Article 4, fraction I

Art. 4 fr. IDecreto de entornos digitales seguros

"Implementar mecanismos confiables y seguros para identificar la edad de las personas usuarias de sus servicios. Dichos mecanismos no deberán limitarse a la autodeclaración de las personas usuarias para la acreditación de la edad;"

Our translation: implement reliable and secure mechanisms to identify the age of the users of their services. These mechanisms must not be limited to users' self-declaration to establish their age. Source: DOF, 14 October 2026^[1]

Three things follow. The duty is to identify the age of users, not who they are. A date-of-birth field or an "I am over 18" box is not enough on its own: the autodeclaración (self-declaration) can stay as a first step, but something must back it. And the decree names no method, sets no accuracy figure and gives no authority power to approve vendors.^[1]

Asked on 14 October whether age would be checked with the CURP (Mexico's population registry code) or biometrics, the President said platforms "have mechanisms", safeguarding personal data, at account opening "or also through the content being generated" (our translation).^[3] The Legal Counsel confirmed the decree covers "under-18s" (our translation), matching the LGDNNA, where children are under 12 and adolescents 12 to under 18.^[3][5]

One implementation combines fraction I with protected defaults (VIII), age-based content controls (III) and parental tools (VI); the decree does not prescribe this flow.^[1]

As a benchmark, the UK regulator Ofcom counts facial age estimation and photo-ID matching as capable of being "highly effective", and self-declaration as not; the European Commission's Digital Services Act (DSA) guidelines ask for accurate, reliable, non-discriminatory age assurance.^[11][14] Our guide on writing the age-assurance part of the 30-day report goes method by method.

An age-assurance flow that maps to Art. 4 fr. I and fr. VIII. Thresholds and the borderline band are your choice.

The 30-day report: Transitorio CUARTO

Transitorio CUARTODecreto de entornos digitales seguros

"Las Plataformas digitales deben documentar e informar las acciones implementadas para dar cumplimiento a las disposiciones del presente decreto, dentro de un plazo máximo de treinta días naturales, contado a partir de su entrada en vigor."

Our translation: digital platforms must document and report the actions implemented to comply with this decree within a maximum of thirty calendar days, counted from its entry into force. Source: DOF, 14 October 2026^[1]

The period is in días naturales (calendar days), so weekends count, from entry into force on 14 October 2026.^[1] Whether 14 October is day one is not stated, and Mexican rules point both ways:

Two readings of the same clause. Holland & Knight reads it as 13 November.^[16]

A deadline on a non-working day moves to the next working day, but neither date is a weekend or a listed holiday; whether that procedure law governs this report at all is itself a legal question.^[7] Holland & Knight treats 13 November 2026 as "the initial reporting deadline".^[16] Our reading: within 30 calendar days of 14 October 2026, that is by about 13 November 2026. File by 12 November to be safe, and confirm with counsel.

The decree does not say to whom, how or in what format the report is filed.^[1][16] The press release says platforms must document their measures "before the authority" (our translation) without naming it, and the President and the Legal Counsel said the ATDT will follow up on platforms' progress.^[2][3] Watch the DOF and gob.mx for a filing channel, and prepare a dated, signed document that answers every duty in Articles 4 and 5, statistical reporting included:

A report that follows the decree's numbering.

What is still undefined, and what the government has said

Open questions: the report's recipient and format, which methods count as reliable, a supervisor, and penalties.^[1] Transitorio TERCERO tells the Consejería Jurídica del Ejecutivo Federal (the Federal Executive's Legal Counsel) to set up a Mesa de Trabajo (working group) to prepare "propuestas de regulación" (regulatory proposals).^[1]

The 14 October release calls the instrument "obligatorio pero no punitivo" (mandatory but not punitive). The President said that if platforms do not comply, "pasamos al siguiente paso, que ya no solo es un Decreto Presidencial, sino una ley. Y si hay una ley, entonces ya vendrían sanciones" (we move to the next step, a law, and with a law, sanctions; our translation).^[2][3]

She added there will be "a review period" (our translation).^[3] The official sources say the ATDT will "dar seguimiento" (follow up); they do not make it the report's recipient or an approver of methods.^[2][3]

The data-protection side: Mexico's 2025 privacy law

Mexico's new Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, Federal Law on the Protection of Personal Data Held by Private Parties), was published in the DOF on 20 March 2025; the authority it names is the Secretaría Anticorrupción y Buen Gobierno (Anti-Corruption and Good Governance Ministry), which took over the former data-protection institute's files.^[6]

Article 2, fraction VI lists sensitive data "de manera enunciativa más no limitativa" (illustrative, not exhaustive), including racial or ethnic origin and health; biometric data is not named.^[6] Because the list is open and a face image can reveal ethnic origin, treat age-check selfies as sensitive as a precaution. For sensitive data, Article 8 requires express written consent, and fines can double.^[6]

According to La Jornada and Forbes México, on 20 October 2026 the Senate approved an LFPDPPP reform on minors' data: parental written consent, "mecanismos que permitan la verificación de edad" (mechanisms that allow age verification), data minimisation and no profiling for advertising aimed at minors. It is with the Chamber of Deputies and not law yet.^[17][18]

• Keep age results in your systems; set vendor retention and deletion separately.
• Get express consent before processing a selfie, and update your privacy notice.
• Keep age-check data short-lived and apart from advertising.

How Mexico compares with Brazil, the UK, the EU and Australia

Brazil's law requires "mecanismos confiáveis de verificação de idade" with self-declaration prohibited, and tells app stores to check age ranges (Art. 12); see our guide to Brazil's Digital ECA.^[9] Ofcom set no numerical accuracy threshold; see our UK age verification guide.^[11] The EU guidelines recommend private-by-default accounts for minors, like Mexico's fraction VIII.^[14] Unlike all four, Mexico's decree carries no penalty today.^[1]

An action plan before the deadline

Starting on 24 October 2026 and filing by 12 November:

Phase 1: scope and gaps (by 31 October)

• Confirm with counsel that your service meets Art. 2, and record why.
• List every fraction of Arts. 4 and 5 with an owner and the current state.
• Find where self-declaration is the only age check.

Phase 2: the age check (by 7 November)

• Choose a method beyond self-declaration, with a borderline step-up.
• Plan checks for new and existing users, including inconclusive results.
• Set the age threshold to 18 and decide how wide the borderline band is.

Phase 3: content, parents and authorities (by 11 November)

• Publish the removal criteria and the age-rating and moderation criteria (fr. II and III).
• Make reporting visible on every account and post (fr. V).
• Name the 24/7 contact point for justice authorities and test it (Art. 5 fr. I).
• Set evidence preservation to at least 90 working days after removals (Art. 5 fr. II).

Phase 4: the report (by 12 November)

• Write the report fraction by fraction: live, planned, dates.
• Attach evidence: policies, configuration screenshots, test results.
• Get legal and privacy sign-off, then file.

How Didit helps with the age check

Didit covers one part of the decree: the age check, and the ID verification behind it when needed. The report, risk assessment, moderation, parental tools and the contact point stay with you. See our age verification solution.

In hosted flows, age estimation runs inside the liveness step from one selfie, with a threshold of 18 by default. Adaptive age verification sends borderline results to an ID document check whose portrait is face-matched to the same selfie; you set the borderline band.^[19] Didit's docs publish a mean absolute error of 1.5 years for the under-18 range and 3.5 years across all ages.^[19] Liveness passed iBeta Level 1 testing, and Didit holds SOC 2 Type 1 and Type 2 and ISO/IEC 27001:2022.^[23]

For Mexico, the docs list a CURP check against RENAPO (National Population Registry) and an INE (National Electoral Institute) credential validity check through database validation.^[20][21] The flow runs in Spanish, by hosted link or SDKs for Web, iOS, Android, React Native and Flutter.^[24][26] Retention runs from 1 month to 10 years or unlimited (default), with deletion on demand; data is processed in the EU by default.^[22][25] See also electronic ID verification. Costs are on the pricing page.

Frequently asked questions

Sources

1. Decreto de entornos digitales seguros para niñas, niños y adolescentes, Diario Oficial de la Federación, Edición Vespertina, 14 October 2026.
2. Presidenta Claudia Sheinbaum firma decreto de entornos digitales seguros para niñas, niños y adolescentes, Presidencia de la República, press release, 14 October 2026.
3. Versión estenográfica, conferencia de prensa del 14 de octubre de 2026, Presidencia de la República.
4. Presidenta presenta decreto para garantizar que plataformas digitales sean espacios seguros para niñas, niños y adolescentes, Presidencia de la República, 9 October 2026.
5. Ley General de los Derechos de Niñas, Niños y Adolescentes, Cámara de Diputados, current text (last reform DOF 15 January 2026).
6. Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Cámara de Diputados, new law DOF 20 March 2025, current text.
7. Ley Federal de Procedimiento Administrativo, Cámara de Diputados, current text.
8. Código Civil Federal, Cámara de Diputados, current text.
9. Lei nº 15.211, de 17 de setembro de 2025 (ECA Digital), Presidência da República, Planalto.
10. Online Safety Act 2023, section 12, legislation.gov.uk.
11. Age checks to protect children online, Ofcom, 16 January 2025.
12. Guidance on highly effective age assurance (Part 3 services), Ofcom.
13. Regulation (EU) 2022/2065 (Digital Services Act), EUR-Lex.
14. Commission publishes guidelines on the protection of minors, European Commission, 14 July 2025.
15. Social media age restrictions, eSafety Commissioner, Australia.
16. Mexico Introduces New Child Safety Obligations for Digital Platforms, Holland & Knight, 16 October 2026.
17. Senado aprueba por unanimidad reforma para proteger a menores en entornos digitales, La Jornada, 20 October 2026.
18. Senado aprueba reformas para proteger a menores en plataformas digitales, Forbes México, 20 October 2026.
19. Age estimation overview, Didit documentation.
20. Mexico, CURP verification, Didit documentation.
21. Mexico, INE credential validity verification, Didit documentation.
22. Data retention, Didit documentation.
23. Certifications, Didit documentation.
24. SDKs, Didit documentation.
25. Security and compliance, Didit documentation.
26. Supported languages, Didit documentation.

See how the age check and the document step-up work together on the ID verification page, read our page on identity verification in Mexico, or start from the age verification solution.