Mexico's new LFPDPPP and marketing tracking: what changes for your store

Mexico has a new personal data protection law. What does it change for the pixels, cookies and conversion APIs my store uses for advertising?

On March 20, 2025, Mexico published a new Federal Law on the Protection of Personal Data Held by Private Parties, known by its Spanish initials as the LFPDPPP. It took effect the next day and repealed the 2010 law it replaces. Most of what a store does with data works the same under the new text, but a few changes touch exactly the tools marketing depends on: pixels, cookies, conversion APIs and the privacy notice that has to describe them. This article summarises those changes from the official text published by the Chamber of Deputies. It is general information, not legal advice, and the checklist at the end is what to take to your lawyer.

What changed, in short

• A new authority. The law is supervised and sanctioned by the Secretaría Anticorrupción y Buen Gobierno (Article 2, section XV, and Articles 39 and 59), which took over the functions INAI used to have.
• A broader test of who is identifiable. Personal data is any information about an identified or identifiable person, and the law spells out that a person is identifiable when their identity can be determined directly or indirectly through any information (Article 2, section V).
• Consent must be free, specific and informed (Article 2, section IV). Tacit consent is still valid as a general rule: it exists when the privacy notice was made available and the person did not object (Article 7).
• The privacy notice must list the personal data processed, identifying the sensitive ones, and must distinguish the purposes that require consent (Article 15, sections II and III).
• A new purpose needs new consent. Processing is limited to the purposes in the notice, and using data for a different one requires obtaining consent again (Article 11).

The comparison with the 2010 law follows Basham's analysis of the new law; the article numbers are from the official text.

What it means for pixels and cookies

A pixel or a cookie on its own records an identifier, not a name. But a store links those identifiers to people all the time: the visitor who logs in, subscribes or buys leaves an email, and from then on the identifier and the person are connected. Under a test that counts identification directly or indirectly "through any information", it is prudent to treat tracking identifiers that can be linked to a customer as personal data, and to describe them in the privacy notice. Whether a given identifier qualifies in your setup is a question for your lawyer.

The regulation issued in 2011 under the old law asked for something specific here: when a site uses technologies that collect personal data automatically as the visitor arrives, it must tell them at that moment that it uses those technologies, that they collect personal data and how to disable them (Article 14 of the Reglamento). The new law does not say in so many words whether that regulation still applies, and at the time of writing the Chamber of Deputies still lists it as current text. Either way the practical step is the same: a visible notice when people arrive, with a link to the full privacy notice and a way to disable the tracking.

What it means for conversion APIs and ad platforms

Sending purchases to Meta or Google from your server, with hashed emails and phone numbers so the platform can match them to its users, is processing personal data, and a transmission of it to another company. Hashing protects the value in transit; it does not make the data anonymous to a platform whose whole purpose in receiving it is to match it to a person.

Three questions decide what your notice has to say about it:

• Is advertising measurement one of the purposes in your notice? If the notice says you process data to fulfil orders and says nothing about measuring or optimizing advertising, sending purchases to ad platforms is a purpose the notice does not cover (Article 11).
• Is the platform your processor or a third party? The law distinguishes a "persona encargada", which processes data on your behalf (Article 2, section XII), from a transfer to a third party (Article 2, section XX). For a transfer you must pass the privacy notice on to the recipient, and the notice must include a clause saying whether the person accepts the transfer of their data (Article 35). How a given ad platform fits is a legal question with real consequences for your notice.
• Could your events reveal sensitive data? Sensitive data, such as a person's health or religious beliefs, requires express written consent (Article 8). If what you sell can reveal a health condition, review which product details your events send to ad platforms.

Financial data is a separate case: it needs express consent (Article 7). Nothing in advertising measurement needs payment data, so the simplest rule is never to send it.

A checklist to review with your lawyer

• List every tag, pixel and server-side connection that receives visitor or customer data, and what each one receives.
• Update the privacy notice: who you are and your address, the personal data you process, every purpose (advertising measurement included) with the ones that require consent marked, how people can limit use or disclosure, how they exercise their ARCO rights and how you will announce changes (Article 15).
• Where you collect data online, show the simplified notice, with at least the first four of those elements and a link to the full one (Article 16).
• Tell visitors about tracking technologies when they arrive, and how to disable them.
• Make an opt-out reach the server too: a person who objects to the advertising use of their data should not be sent to ad platforms from your back end either.
• Keep a process for ARCO requests: a person or department in charge, a reply within 20 business days and 15 more to carry it out (Articles 29 and 31).
• Review your security measures and your process to tell people immediately about a breach that significantly affects them (Articles 18 and 19).

What non-compliance costs

Fines run from 100 to 160,000 times the Unidad de Medida y Actualización for infringements such as omitting required elements of the privacy notice, and from 200 to 320,000 times for others, such as collecting data without express consent where it is required. When sensitive data is involved, they can be up to twice those amounts (Articles 58 and 59).

How Adray handles it

For the shopper data it collects on a store's behalf, Adray generally acts as the store's processor, as its privacy notice explains; the store remains responsible for its own notice. Adray's pixel reads the Global Privacy Control signal, and Adray's server does not forward to Meta or Google the conversions of a visitor whose browser sends it. For how first-party data flows through a store, see first-party cookies, and for the AI side of the same question, is it safe to give your marketing data to ChatGPT or Claude?