Mexico's new LFPDPPP for WordPress sites: what changed and how to comply

On March 20, 2025, Mexico published a completely new Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) in its official gazette, the Diario Oficial de la Federación. It took effect the next day and repealed the 2010 law. If your WordPress site collects data from people in Mexico, through a contact form, a WooCommerce store, a newsletter or Google Analytics, this law applies to you, and a privacy notice written before 2025 is probably out of date.

This guide summarizes what changed, citing the article of the law for each point, and turns it into concrete tasks for a WordPress site.

What changed, in five points

1. The regulator is no longer INAI

INAI was dissolved. The authority that supervises, audits and fines private companies is now the Secretaría Anticorrupción y Buen Gobierno (Ministry of Anti-Corruption and Good Government, Article 2, section XV). If your privacy notice still names INAI as the place people can turn to, update it.

2. Implied consent is still the general rule

Consent must be free, specific and informed (Article 2, section IV). It is implied when you made the privacy notice available and the person did not object, and implied consent is valid as a general rule (Article 7). Two important exceptions:

• Financial or property data: requires express consent (Article 7).
• Sensitive data (health, ethnic origin, beliefs, sexual orientation, among others): requires express, written consent, through a handwritten signature, an electronic signature or an authentication mechanism (Article 8).

People can withdraw consent at any time, and your notice must explain how (Article 7).

3. No more "compatible" purposes

If you want to use data for something your privacy notice does not list, you have to ask for consent again (Article 11). The classic case: you collected emails to answer quote requests and now want to send promotions. That is a new purpose.

4. The privacy notice has a new minimum content

The full notice (aviso de privacidad integral) must include at least (Article 15):

1. Your identity and address as the data controller.
2. The personal data you process, flagging which items are sensitive.
3. The purposes of processing, separating those that require consent.
4. The options and means people have to limit the use or disclosure of their data.
5. The mechanisms and procedures to exercise ARCO rights.
6. How you will communicate changes to the notice.

When data is collected electronically, which covers every web form, you must provide the short-form notice (aviso simplificado): points 1 to 4 plus a link to the full notice (Article 16, section II).

5. Fines are calculated in UMA

Penalties range from a formal warning to fines of 100 to 160,000 UMA for violations such as leaving required items out of the privacy notice, and 200 to 320,000 UMA for violations such as processing data without express consent where it is required or breaching confidentiality. Repeated violations carry an additional fine, and amounts can be doubled when sensitive data is involved (Articles 58 and 59). With the 2026 UMA value (MX$117.31 per day, in force since February 1), the 320,000 UMA ceiling is about MX$37.5 million, roughly US$2 million.

What about cookies?

Unlike the EU, Mexico has no cookie-specific rule. But many cookies do process personal data: unique identifiers, IP addresses or the behavior of an identifiable person. When they do, the general rules apply:

• Inform first. Implied consent only works if the notice was available before the processing (Article 7). A cookie notice visible from the first visit, linking to your privacy notice, does that job.
• Offer a choice. The notice must give people a way to limit the use of their data (Article 15, section IV), and they can withdraw consent at any time (Article 7). In practice: a reject button and a way to change the decision later.
• Actually block. A banner that shows "Reject" but still loads Google Analytics or the Meta Pixel offers no real choice.

If you also get visitors from the European Union, GDPR applies to them and does require prior, explicit opt-in for non-essential cookies. The clean way to serve both audiences is to apply the law of each visitor's country.

A checklist for your WordPress site

1. Inventory what you collect and where. Forms (Contact Form 7, Gravity Forms, Elementor), WooCommerce, newsletters, chat widgets, comments, and every third-party script: Analytics, Meta, Hotjar, Clarity. Each one is a line in your notice.
2. Rewrite your full notice in Spanish with the six items in Article 15, flagging sensitive data and separating the purposes that need consent. Replace any mention of INAI with the Secretaría Anticorrupción y Buen Gobierno.
3. Add a short-form notice next to every form: who you are, what you ask for, why, how to limit its use, and the link to the full notice (Article 16).
4. Review forms that ask for sensitive data such as medical appointments or health intake forms. A ticked checkbox may not be enough: the law asks for express written consent through a signature or authentication (Article 8).
5. Don't reuse data for a new purpose without asking again (Article 11). If you want to send promotions, add a separate, unticked checkbox.
6. Open an ARCO channel (access, rectification, cancellation and objection) and name a person or team to handle it (Article 29). You have 20 business days to respond and 15 more business days to carry it out; each deadline can be extended once (Article 31).
7. Install a cookie notice that blocks trackers until the visitor decides, with a reject button and a way to change the decision later.
8. Delete what you no longer need. Data that no longer serves the purposes in your notice must be deleted (Article 10). Review old form entries and old orders.
9. Have a breach plan. If a security breach significantly affects people's rights, you must inform them immediately (Article 19).

How to handle it inside WordPress

Cookie Rocket Pro covers the website side in one plugin:

• Generates your LFPDPPP privacy notice in Spanish, in both full and short form, naming the Secretaría Anticorrupción y Buen Gobierno as the authority.
• Opens an ARCO request channel hosted on your own site, with no third party, and a screen to manage requests.
• Blocks trackers until the visitor decides, and logs every decision as evidence.
• Applies each visitor's law: LFPDPPP in Mexico, GDPR in Europe, LGPD in Brazil and CCPA in the United States.

The cookie notice on this page is Cookie Rocket Pro at work.

Sources

• Ley Federal de Protección de Datos Personales en Posesión de los Particulares, current text published by Mexico's Chamber of Deputies (DOF March 20, 2025, last amended DOF November 14, 2025).
• 2026 Unidad de Medida y Actualización value, published by INEGI in the DOF on January 9, 2026.