Mexico orders platforms to verify ages and restrict harmful content

Mexico’s new online-safety decree requires covered digital platforms to identify users’ ages through methods beyond self-declaration and restrict minors’ access to, exposure to or recommendations of specified harmful content. Published in the Official Gazette and effective Oct. 14, the decree gives platforms 30 calendar days from that date to document and report the actions they have taken to comply.

The measure applies to internet intermediaries that enable users to interact, communicate, create, disseminate or share content. It names social networks, video games and app stores as examples. The decree’s requirements apply to platforms serving users in Mexico; it does not define coverage simply by a service’s name or category.

Age checks, content limits and safety settings

Platforms must use reliable age-identification methods that do not depend only on users stating their own ages. They must also publish criteria for identifying and classifying content by age, as well as their removal and moderation standards.

The decree bars platforms from allowing minors to access, encounter or receive recommendations for content in broad categories including harassment and cyberbullying; sexual abuse, exploitation or violence; hate speech and violent extremism; violence, including violence in schools; illegal conduct; explicit sexual material; suicide; deliberate self-harm; and eating disorders. Accounts or content that generate or promote the listed conduct must be removed immediately.

Other requirements include accessible ways to report content and tools for parental supervision. Platforms must build safety protections into their services, apply the strictest privacy and safety settings available by default to new accounts, and periodically assess risks related to their services and designs. They must also provide competent authorities with statistical reports on patterns in detected content.

The decree adds ongoing duties for dealings with authorities. Platforms must maintain a specialized contact point available 24 hours a day, 365 days a year, and preserve relevant digital evidence for at least 90 business days after removing an account or content. They must immediately alert authorities to accounts or content that threaten minors’ life, dignity, security, integrity or privacy.

Reporting deadline, but no penalties in the decree

The 30-day requirement is to document and report compliance actions; it does not say that every system change must be completed within that period. The deadline was still running on Oct. 17. The decree sets no specific fines or other sanctions for failing to comply.

President Claudia Sheinbaum’s office describes the measure as mandatory but non-punitive. It has said the government could pursue a separate law with sanctions if officials judge compliance inadequate. That would require a later legislative step; the decree itself does not impose those penalties. It directs the Legal Counsel’s Office to convene a working group to develop further regulatory proposals.

The decree also assigns government agencies related work on mental-health support and school-based socio-emotional education. Parents and caregivers are among those the government says should receive support, while the platform rules require services to provide parental-supervision tools.

Age checks and restrictions on content recommendations raise questions about privacy and freedom of expression, issues identified in coverage of the decree. The measure’s effects on users’ privacy, platform moderation, minors’ exposure to harmful material and compliance have not yet been established. Its obligations are in force, but whether a separate sanctions law will be proposed or enacted remains uncertain.