Regulatory challenges in Mexico posed by technology and the digital economy
Rocio Olea
Greenberg Traurig, SC, Mexico City
Victor Manuel Frías
Greenberg Traurig, SC, Mexico City
Ana Ramirez
Greenberg Traurig, SC, Mexico City
The growth of technology and the digital economy have transformed markets, business models and the relationship between consumers and service providers, while introducing new potential risks for product users and the consumers of technology. Countries around the world face ongoing regulatory challenges related to the need to keep up with this rapidly evolving digital landscape. In this context, Mexico is working hard to adapt and update its legal framework to address the gaps related to digital platforms, including data protection, cybersecurity and artificial intelligence (AI).
The approach being taken elsewhere
In contrast to other regions, the European Union has adopted a preventive and structural approach. The General Data Protection Regulation (GDPR) imposes obligations on businesses involved in personal data processing and grants rights to data subjects, such as access rights, data portability and limitations to such processing.[1] Likewise, the EU’s Digital Markets Act (DMA) introduced rules for gatekeepers and imposes special obligations on businesses to prevent anti-competitive practices before they occur.[2] The EU’s AI Act takes a risk-based approach to regulating AI, prohibiting certain uses and establishing requirements for high-risk systems.[3] In November 2025, the European Commission presented the Digital Omnibus package to support emerging technologies. This initiative’s stated aim is to simplify regulatory compliance and reduce administrative burdens, while maintaining user protection, signalling a shift towards clearer and more functional regulations,[4] aligned with technological advances and evolving market needs.
The US has maintained a more fragmented model, based on law enforcement by agencies such as the Federal Trade Commission (FTC) and the Department of Justice (DOJ). In recent years, these agencies have initiated proceedings against tech companies for alleged anti-competitive practices and privacy violations, which highlights an increase in the supervision of the digital sector.[5][6]
Regarding most countries in Latin America, the first signs of the development of a legal framework applicable to new technologies are just beginning to emerge. Brazil, for example, has adopted a vision based on anticipation and prevention as part of the discussions on a new law to regulate AI.[7]
The situation in Mexico
Progress in regulating digital markets, consumer protection, competition and privacy in Mexico has been gradual compared to other regions. While many Latin American countries are actively addressing the risks associated with emerging technologies and AI, Mexico is still in the process of defining its approach. Recent institutional changes, such as the transition from agencies like the Federal Data Protection and Privacy Agency, the Federal Competition Commission and the Federal Telecommunications Institute into new bodies like the Digital Transformation Agency and the National Antitrust Commission, highlight that the review of the country’s regulatory priorities is ongoing. For example, the former antitrust authority conducted investigations into competition conditions within digital markets and in regard to the provision of services, and it remains to be seen how this expertise will inform the work of the new agency.
Mexico’s regulatory framework presents opportunities to strengthen its approach to digital markets by considering the use of preventive obligations for specific actors, which could help reduce uncertainty and streamline processes within fast-moving digital environments. There is also room to address emerging practices, such as dark patterns and algorithm-driven personalised advertising, which are aligned with international discussions on structural remedies involving data markets. The enactment of a new privacy framework in 2025[8] marked an important step forwards, and future efforts could focus on enhancing clarity around automated decision-making, international data transfers and the use of data by AI systems, areas where innovative measures would add significant value.
Recent institutional changes, including the restructuring of autonomous agencies and the creation of new regulatory authorities, could strengthen coordination and enhance regulatory capacity in sectors where alignment and convergence are essential. While Mexico does not yet have a dedicated law on AI, various legislative initiatives and existing regulations touch on its use in areas such as privacy, consumer protection, competition and intellectual property. Advancing these initiatives could help provide greater clarity and consistency on the matter. Similarly, the regulation of digital commercial practices has room for development. For instance, the Official Mexican Standard for Electronic Commerce and regulations concerning economic competition and personal data protection are still in the process of being fully implemented, creating space for further progress.
Advances in AI have prompted numerous legislative proposals and reforms between 2024 and 2025, creating a foundation for future developments. While these initiatives have primarily outlined the guiding principles, there is an opportunity to add technical details and ensure greater cohesion. Establishing a clear framework for classifying AI system risks, coordinating regulatory agencies and balancing innovation with the protection of fundamental rights could strengthen Mexico’s approach to AI. At the state level, ongoing efforts could be aligned under a national strategy to avoid fragmentation and promote consistency across jurisdictions.
Mexico’s legal framework also presents an opportunity to strengthen the tools that enable authorities to act efficiently and proactively in the face of rapid technological change. The country is at a pivotal moment in regard to its ability to modernise its digital regulatory environment, foster innovation and growth, protect individuals, promote broader access and reduce barriers to entry. The development of a preventive regime for digital markets, the enhancement of consumer and privacy protections and the bolstering of institutional stability would help position Mexico competitively. Adopting a tailored model on access to emerging technologies, informed by international best practices from the EU and the US, could help support effective competition, rights protection and sustainable technological development in Mexico. A key first step would be to conduct a comprehensive analysis of the consumer protection and competition challenges arising from technological advances.
Conclusion
The regulation of technology remains an area of focus for lawmakers, who are seeking to strike the right balance between protecting individuals and fostering innovation, while addressing any lag between the applicable legal frameworks and technological realities. In Mexico, legislative proposals to regulate digital markets and AI are being developed, creating an opportunity to define a clear and comprehensive approach to these challenges areas of law. Recent regulatory changes and the establishment of new regulatory authorities provide an opportunity to clarify the respective roles and responsibilities of the various entities involved, which is a pertinent part of the country’s broader digital transformation.
[1] Consolidated text: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance).
[2] Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (Text with EEA relevance).
[3] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (Text with EEA relevance).
[4] Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus).
[5] DOJ, ‘Department of Justice Wins Significant Remedies Against Google’ https://www.justice.gov/opa/pr/department-justice-wins-significant-remedies-against-google last accessed on 6 March 2026.
[6] DOJ, ‘United States Attorney Implements Groundbreaking Settlement With Meta Platforms, Inc., Formerly Known As Facebook, To Address Discrimination In The Delivery Of Housing Ads’ https://www.justice.gov/usao-sdny/pr/united-states-attorney-implements-groundbreaking-settlement-meta-platforms-inc-formerly last accessed on 6 March 2026.
[7] Brazil AI Act, https://artificialintelligenceact.com/brazil-ai-act/ last accessed on 6 March 2026.
[8] Ley Federal De Protección De Datos Personales En Posesión De Los Particulares, Ley Federal de Protección de Datos Personales en Posesión de los Particulares last accessed on 6 March 2026.