Blog · October 24, 2026

Mexico's 30-day decree report: age assurance methods and template

How to write the age assurance part of the report Mexico's decree requires by about 13 November 2026: methods compared, a step-up flow, existing accounts, data rules, a fill-in template and a checklist.

By DiditOctober 24, 2026Updated Oct 24, 2026

In short

Mexico's decree on safe digital environments for minors gives digital platforms 30 calendar days from 14 October 2026 to document and report what they have done to comply.^[1] For age assurance, the report has to show reliable and secure mechanisms to identify users' age that are not limited to self-declaration (Art. 4 fr. I).^[1]

Deadline: 30 calendar days from 14 October 2026, about 13 November 2026, or 12 November if the day of publication counts as day one.^[1]^[7]^[8]
The decree names no method, no recipient and no format, and sets no vendor approval.^[1]
A defensible design is layered: date of birth, facial age estimation, and an ID check in a buffer zone around 18.

Last reviewed: 24 October 2026 · Not legal advice

The Decreto de entornos digitales seguros para niñas, niños y adolescentes (Decree on safe digital environments for girls, boys and adolescents) was published in the Diario Oficial de la Federación (DOF, Mexico's official gazette) on 14 October 2026 and entered into force the same day.^[1] Its Transitorio CUARTO says platforms "deben documentar e informar las acciones implementadas" (must document and report the actions implemented) within 30 días naturales (calendar days).^[1] Our guide to Mexico's age verification decree covers every obligation. This post covers the age assurance section of that report and how to pick age verification methods you can defend.

If you need a check before you file

If you need an age check running before you file, Didit's age estimation with an ID document fallback is set up from the console. Start free, or talk to us about your users in Mexico.

The 30-day report at a glance

Question	Short answer
Instrument	Presidential decree, DOF of 14 October 2026^[1]
Deadline	30 calendar days from 14 Oct 2026, about 13 Nov 2026 (Transitorio CUARTO)^[1]
Self-declaration	Self-declaration alone: not enough (Art. 4 fr. I)^[1]
Who receives the report	Not stated. The President said the government will follow up with the Agencia de Transformación Digital y Telecomunicaciones (ATDT, the federal digital agency)^[2]^[3]
Penalties	None in the decree, described as "obligatorio pero no punitivo" (mandatory but not punitive); a law with sanctions would follow if platforms do not comply^[2]^[3]
Age line	Under 18, per the head of the Consejería Jurídica del Ejecutivo Federal (the Federal Executive's Legal Counsel)^[3]^[5]

The dates that frame the report

9 October 2026PresentedThe President presents the decree at her morning press conference.^[4]
14 October 2026In forcePublished in the DOF evening edition, in force the same day.^[1]
12 or 13 November 2026Report dueDay 30, depending on how day one is counted.^[1]^[7]^[8]
After the reportReviewFollow-up of progress; a law with sanctions if platforms do not comply.^[3]

The decree fixes the period, not a calendar date.

The period is "treinta días naturales, contado a partir de su entrada en vigor" (thirty calendar days, counted from its entry into force).^[1]

Reading	Day 1	Day 30	Basis
The first day counts whole	14 Oct 2026	Thursday 12 Nov 2026	Federal Civil Code, Art. 1179, by analogy^[8]
Counting starts the next day	15 Oct 2026	Friday 13 Nov 2026	Federal Administrative Procedure Law, Art. 38 (written for notified acts)^[7]

According to Holland & Knight, 13 November 2026 is "the initial reporting deadline".^[18] File by 12 November to be safe, and confirm the date with counsel.

What the age-assurance part of the report has to show

Art. 4 fr. IDecreto de entornos digitales seguros

"Implementar mecanismos confiables y seguros para identificar la edad de las personas usuarias de sus servicios. Dichos mecanismos no deberán limitarse a la autodeclaración de las personas usuarias para la acreditación de la edad;"

Source: DOF, 14 October 2026^[1]

In English: implement reliable and secure mechanisms to identify the age of users; these mechanisms must not be limited to users' self-declaration.^[1] The report should answer three questions:

Reliable (confiables): how often the method gets the age right near 18, and how you know.
Secure (seguros): how it resists an adult's photo, a screen replay or a borrowed ID, and how the data is protected.
Beyond self-declaration: which evidence checks the date of birth a user types. The wording lets a date-of-birth field stay as a first step, never the only one.^[1]

Provision	What it requires	What to document
Art. 4 fr. I	Reliable, secure age mechanisms, not only self-declaration	Methods, where they run, error near 18
Art. 4 fr. III	Age-rating and moderation criteria by age	How the age result switches content and features
Art. 4 fr. VI	Parental supervision of minors' accounts	How an under-18 account links to a parent or guardian
Art. 4 fr. VIII	Strictest settings by default on new accounts	Settings for unverified and under-18 accounts
Art. 4 fr. IX	Periodic risk assessments	When you review the age check, with which metrics
Art. 5 fr. II	Preserve evidence for at least 90 días hábiles (working days) after a removal	Age-check records kept for removed accounts^[1]

The decree sets no age threshold; the Ley General de los Derechos de Niñas, Niños y Adolescentes (LGDNNA, the children's rights law) defines adolescents as 12 to under 18, and the Legal Counsel said the decree applies to "menores de 18 años" (under-18s).^[3]^[5]

Age assurance methods compared for Mexico's decree

The decree names no approved methods and sets no vendor approval.^[1] The UK regulator Ofcom judges age assurance on technical accuracy, performance in real use, reliability and fairness, and counts photo-ID matching and facial age estimation among the kinds that can be highly effective.^[13] Measures asking users to self-declare their age "without other methods" are not age assurance in Ofcom's guidance.^[13]

Method	What it establishes	Strengths	Limits	Role in a Mexico flow
Self-declaration	What the user says	No friction	Not enough alone under Art. 4 fr. I^[1]	First step only
Facial age estimation	An age estimate from a selfie	Fast, no document, no identification	Needs a buffer around 18^[19]	Main check for most users
ID document plus selfie	The document's date of birth, bound to the person by face match	Exact date of birth	More friction; some teenagers have no document	Buffer zone and disputes
CURP check against RENAPO	That a CURP exists, with its date of birth and status^[21]	Registry data	Children have a CURP; it does not prove who is typing^[9]	Supporting evidence, matched to a verified document and selfie
INE credential validity check	That a credencial para votar is valid^[22]	Registry check of a common adult ID	Some 17-year-olds can get the card early^[11]	Supporting evidence for adults

The Clave Única de Registro de Población (CURP, the national population code) has 18 characters, six of them the holder's date of birth, and the Registro Nacional de Población (RENAPO) assigns the last two.^[9] It comes from the birth certificate, so children have one: a CURP tells you an age, not whose age.^[9] The INE credencial para votar (voter ID card) is normally issued from 18, but people who turn 18 between 1 September 2026 and 6 June 2027 may apply in advance, so read the date of birth, not the card type.^[10]^[11] Minors can also hold a Mexican passport, issued with the consent of whoever holds parental authority.^[12]

A step-up flow that goes beyond self-declaration

1Ask for the date of birth at sign-up

The first layer; an adult claim is never accepted on it alone.

The declared age is 18 or over

Provisional minor settings

Age unverified: protective settings until a check, at latest before any adult feature.

Yes

2Facial age estimation with liveness

One selfie; liveness must pass. No face: retake. No age detected: document check.

Where the estimate falls against the buffer

Above the buffer

Adult account

Record the result and the method.

In the buffer

ID document plus selfie

The date of birth decides.

Below the buffer

Minor experience

Disputes: a document check, or a manual review for users without one.

3Store the result, not the image

Over or under 18, method, date, session reference.

The buffer is the part to explain in the report. Ofcom calls it a challenge age: a user estimated under it must pass a second check, and it should be set "according to the limits of the technical accuracy" of the method.^[13] Set yours from the vendor's published error near 18.

Example

Illustrative policy for an 18+ service, using the buffer of Didit's documented example (estimated 16 to 20): above 20 passes, 16 to 20 goes to a document check, below 16 gets the minor experience.^[20] Didit's docs give a mean absolute error of 1.8 years for 18 to 20-year-olds and 1.0 year for 13 to 17-year-olds, on 51,655 selfies of people aged 13 and over, with ages taken from identity documents.^[19]

Prepare the age-assurance part of your report with Didit

Didit runs facial age estimation with liveness, sends the buffer zone to an ID check with a face match, and records each decision. See age estimation, or talk to us about your flow.

Existing accounts and unverified users

Fraction I speaks of "las personas usuarias de sus servicios" (the users of their services), so its text is not limited to new accounts; fraction VIII, on default settings, is written for accounts being created ("al crear nuevas cuentas").^[1] Describe a dated plan to re-check them.

1Map accounts with users in Mexico

By declared age and by the features they use.

2Rank by risk

Direct messages, live chat, uploads, recommendations and purchases first.

3Ask for the check at the next login or risky action

The same step-up flow as new sign-ups.

The user completes the check

Yes

Apply the result

Adult or minor settings, recorded.

Treat as under 18

Strictest defaults until checked.

Treating unverified users as minors is a design choice, not a rule in the decree, but it shows how the strictest settings of fraction VIII protect people you could not yet check.^[1]

Data minimisation, retention and evidence

Mexico's 2025 Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, the private-sector data protection law) shapes the design. Article 12 requires processing that is "necesario, adecuado y relevante" (necessary, adequate and relevant) to the purposes in the privacy notice, and, for sensitive data, reasonable efforts to limit the processing period to the indispensable minimum.^[6] Article 10 requires deletion once data is no longer needed, after its retention period and any blocking, and Article 18 security measures.^[6]

The law's list of sensitive data does not name biometric data, but it is open and a face image can reveal racial or ethnic origin.^[6] As a precaution, treat selfies as sensitive data: under Article 8 that means express written consent.^[6] According to La Jornada, on 20 October 2026 the Senate approved an LFPDPPP reform on minors' data that includes age verification mechanisms; it still needs the Chamber of Deputies.^[17]

Keep as evidence	Delete on a short schedule
The result: over or under 18, or your age band	The selfie and any face crop
Method, and whether the buffer sent the user to a document	Document images, once the date of birth is checked
Date, session reference, decision status	The full date of birth, where a band is enough

Settle one tension with counsel: minimisation pushes you to delete, while Art. 5 fr. II asks you to preserve evidence of removed accounts or content for at least 90 working days.^[1]^[6] A workable reading: keep the small record above, and preserve more only after a removal.

Accuracy, bias and the audit trail

Ofcom asks for testing against appropriate metrics, training data that reflects the diversity of the target population, and evidence of no significant bias.^[13] The European Commission's guidelines under the Digital Services Act (DSA) recommend age assurance that is accurate, reliable, non-intrusive and non-discriminatory.^[14] Ask your provider, and put the answers in the report:

Test set size, and how ages were confirmed.
Mean absolute error by age band, at least 13 to 17 and 18 to 20, and how often under-18s pass at your threshold.
Error by skin tone and gender, or a statement that it is not published.
Independent presentation attack testing of the liveness check.

User Your platform Age check provider

1Signs up, declares age

2Creates a check session

3Takes a selfie

Estimate, liveness, buffer rule

4Over or under 18, status

5Adult or minor settings

Log result, method, date

Fill-in template: the age-assurance section of your report

The decree sets no format.^[1] Copy it, replace the middle column with your answers, and mark each row done or planned, with an owner.

Section	What to write	Evidence to attach	Basis
1. Age line	Under 18, plus any finer bands	Policy text	Art. 4 fr. III; LGDNNA Art. 5
2. Mechanisms	Each method and where it runs	Flow diagram, launch dates	Art. 4 fr. I
3. Beyond self-declaration	Which evidence checks the declared date of birth	Flow screens	Art. 4 fr. I
4. Reliable	Error near 18, the buffer and why	Provider test results, pilot numbers	Art. 4 fr. I
5. Secure	Liveness, document checks, face match, security measures	Certifications, security policy	Art. 4 fr. I; LFPDPPP Art. 18
6. Existing accounts	Re-check plan by risk, with dates	Progress figures	Art. 4 fr. I
7. Defaults	Settings for new, unverified and under-18 accounts	Settings matrix	Art. 4 fr. VIII
8. Parents	How an under-18 account links to a parent or guardian	Feature description	Art. 4 fr. VI
9. Personal data	Consent for selfies, retention periods	Privacy notice	LFPDPPP Arts. 8, 10, 12
10. Evidence	Records per check and for removed accounts	Record schema	Art. 5 fr. II
11. Review	Metrics and next review date	Risk assessment calendar	Art. 4 fr. IX
12. Open items	What is not done yet, and when	Dated roadmap	Transitorio CUARTO

Checklist before you file

Fix your filing date: 12 November 2026 to be safe, and confirm with counsel.^[1]^[7]^[8]
Document every point where age is checked, with launch dates.
Show the step after self-declaration for adult claims, and when declared minors get a check.^[1]
Write down the buffer around 18 and why you chose it.^[13]
Attach accuracy figures by age band and the share of under-18s who pass at your threshold.
Record the defaults for unverified and under-18 accounts.^[1]
Describe the re-check plan for existing accounts.
Check that the privacy notice covers selfies and documents.^[6]
Keep age-check records of removed accounts for at least 90 working days.^[1]

How the decree compares on self-declaration

Law	Self-declaration	In force
Mexico, decree of 14 Oct 2026	Not enough on its own (Art. 4 fr. I)^[1]	14 Oct 2026^[1]
Brazil, ECA Digital (Lei 15.211/2025)	"vedada a autodeclaração" (prohibited) for the content Art. 9 covers^[15]	17 Mar 2026^[15]
UK, Online Safety Act	Not age assurance; highly effective verification or estimation to keep children from primary priority harmful content^[13]^[16]	Pornography services by July 2025^[26]

More in Brazil's ECA Digital, age estimation laws worldwide and age verification in Mexico for games, social media and app stores.

How Didit helps with the age check

Didit helps you run and document the age and identity check part of your report: facial age estimation and ID verification in one workflow. It helps you document reliable, secure age checks that go beyond self-declaration and map to Art. 4 fr. I. It does not file the report, moderate content, run parental tools or staff your 24/7 contact point.^[1]

Adaptive Age Verification: a selfie first; users in the buffer you set go to ID verification, with the document portrait face matched to the selfie.^[19]^[20]
Mexican documents and registries: Mexican ID cards (voter cards included), passports, driver's licences and residence permits, plus optional CURP checks against RENAPO and INE credential validity checks.^[21]^[22]^[23]
Data handling: retention is unlimited by default and can be set from 1 month to 10 years, deletion on demand, Didit as processor, processing in the EU by default.^[24] Restricting the fields an API returns does not delete stored images: set a retention period.
Security: iBeta Level 1 presentation attack testing, ISO/IEC 27001:2022, SOC 2 Type 1 and Type 2.^[25]
Integration: Web, iOS, Android, React Native and Flutter SDKs, webhooks, the flow in Spanish. See Didit in Mexico and pricing.

Facial age estimation estimates age; it does not identify the person.^[19] Didit's eID verification covers European eIDs such as MitID, not Mexican ones.

Didit provides

Facial age estimation with liveness
ID document checks with face match for the buffer zone
Optional CURP and INE registry checks
A dated record of each age decision

Stays with you

The report and its filing
The buffer, thresholds and default settings
Moderation, parental tools, the 24/7 contact point
The risk assessment and the privacy notice

Put a step-up age check in your flow

Set up age estimation with an ID document fallback in one workflow, and test it before you file.

Start free Talk to us

Key takeaways

Platforms must report their actions within 30 calendar days of 14 October 2026, by about 13 November 2026.
Art. 4 fr. I requires reliable and secure age mechanisms not limited to self-declaration.

Frequently asked questions

What does the age-assurance part of Mexico's 30-day report need to show?

The reliable and secure mechanisms you use to identify users' age, and that they are not limited to self-declaration, as Art. 4 fr. I requires.^[1] Describe each method, where it runs, its error near 18, how it resists spoofing, existing accounts and the data you keep.

What is the deadline to report under Mexico's decree?

Within 30 calendar days of the decree's entry into force on 14 October 2026, that is by about 13 November 2026.^[1] If the day of publication counts as day one, day 30 is 12 November, so file by then and confirm with counsel.^[7]^[8]

Is self-declaration enough under Mexico's decree?

No. Art. 4 fr. I says age mechanisms "no deberán limitarse a la autodeclaración" (must not be limited to self-declaration).^[1] A date-of-birth field can stay as a first step if another check confirms it.

Which age verification method does the decree require?

None. The decree names no method and sets no vendor approval.^[1] Platforms choose, and the report explains why their methods are reliable and secure.

Who receives the 30-day report?

The decree does not say.^[1] The President said the government will follow up on platforms' progress with the Agencia de Transformación Digital y Telecomunicaciones (ATDT).^[2]^[3]

Are there penalties for not reporting?

The decree sets no penalty, and the government called it mandatory but not punitive.^[1]^[2] The President said that if platforms do not comply, a law with sanctions would follow.^[3]

Is facial age estimation allowed in Mexico?

The decree neither names nor rules it out; it only rules out relying on self-declaration alone.^[1] As a precaution, treat selfies as sensitive data, get express written consent, and delete images on a documented schedule that respects any retention or preservation duty.^[6]

Can a CURP or an INE card prove a user is over 18?

Not on its own. Children have a CURP too, and a CURP does not prove who is typing it.^[9] Some 17-year-olds can get an INE voter card early, so read the date of birth and bind the document to the user with a selfie.^[11]

Do existing accounts need an age check?

The text of Art. 4 fr. I refers to the users of the platform's services, not only to new accounts.^[1] A dated plan that re-checks accounts by risk, with strictest defaults until checked, is a defensible answer.

Does the decree apply to video games and app stores?

Yes. Art. 2 defines a digital platform as an internet service that lets users interact or share content, and names social networks, video games and app stores among them.^[1]

Sources

Decreto de entornos digitales seguros para niñas, niños y adolescentes, Diario Oficial de la Federación, Edición Vespertina, 14 October 2026.
Presidenta Claudia Sheinbaum firma decreto de entornos digitales seguros para niñas, niños y adolescentes, Presidencia de la República, 14 October 2026.
Versión estenográfica, conferencia de prensa de la presidenta Claudia Sheinbaum Pardo del 14 de octubre de 2026, Presidencia de la República.
Presidenta presenta decreto para garantizar que plataformas digitales sean espacios seguros para niñas, niños y adolescentes, Presidencia de la República, 9 October 2026.
Ley General de los Derechos de Niñas, Niños y Adolescentes, Cámara de Diputados, current text.
Ley Federal de Protección de Datos Personales en Posesión de los Particulares, DOF 20 March 2025, Cámara de Diputados, current text.
Ley Federal de Procedimiento Administrativo, Cámara de Diputados, current text.
Código Civil Federal, Cámara de Diputados, current text.
Clave Única de Registro de Población: CURP, Secretaría de Gobernación.
Preguntas frecuentes sobre la Credencial para Votar, Instituto Nacional Electoral.
Jóvenes podrán adelantar su trámite para obtener Credencial para Votar, INE Central Electoral, 1 September 2026.
Pasaporte Mexicano, Secretaría de Relaciones Exteriores.
Guidance on highly effective age assurance (Part 3), Ofcom.
Commission publishes guidelines on the protection of minors, European Commission, 14 July 2025.
Lei nº 15.211, de 17 de setembro de 2025 (ECA Digital), Presidência da República, Brazil.
Online Safety Act 2023, section 12, legislation.gov.uk.
Senado aprueba por unanimidad reforma para proteger a menores en entornos digitales, La Jornada, 20 October 2026 (secondary).
Mexico Introduces New Child Safety Obligations for Digital Platforms, Holland & Knight, 16 October 2026 (secondary).
Age Estimation overview, Didit documentation.
Workflows: Adaptive Age Verification, Didit documentation.
Mexico, CURP verification, Didit documentation.
Mexico, INE credential validity verification, Didit documentation.
Supported ID documents, Didit documentation.
Data retention, Didit documentation.
Certifications and attestations, Didit documentation.
Age checks to protect children online, Ofcom, 16 January 2025.

Start with the age check, then write the report around it: Didit's age estimation with an ID verification fallback gives you the method, the buffer and the record. Read the full decree guide for the rest of your obligations.

Be ready before the deadline

Run your first age checks today and keep the record for your report.