Mexico's age assurance decree gives platforms 30 days to report their child safety measures
On October 14, 2026, Mexican President Claudia Sheinbaum signed the Decreto de entornos digitales seguros para niñas, niños y adolescentes. It was published in the Diario Oficial de la Federación (DOF) and took effect that same day.
The decree sets out what digital platforms must do to protect children and teenagers online, including the use of reliable and secure mechanisms to identify the age of their users. The Agencia de Transformación Digital y Telecomunicaciones (ATDT) will oversee compliance. Platforms have 30 calendar days from the date of the decree to document and report the actions they have implemented in this regard. This decree applies to any digital platform where people interact or share content, including social networks, video games, and app stores.
In this post, I’ll explain what the decree is, who it applies to, what it requires, and how platforms can strengthen minor protection and get ready for what may come next.
What is Mexico's decree on safe digital environments for minors?
The Decreto de entornos digitales seguros para niñas, niños y adolescentes is a presidential decree that sets out what digital platforms must do to protect children and teenagers online in Mexico. Because it is a decree, it did not go through Congress and sets no penalties. Sheinbaum announced the decree at her daily press conferences and met with major platforms herself.
Its goal is to keep minors from accessing, being exposed to, or being recommended harmful content. That includes harassment and cyberbullying, sexual abuse, hate speech and violent extremism, illegal conduct, pornography, and content that promotes suicide, self-harm, or eating disorders. You can read the full text in the official DOF publication, which is in Spanish. Quoted phrases in this post are our translation.
Who does the decree apply to?
The decree applies to any digital platform that lets users interact, communicate, or create and share content. It names social networks, video games, and app stores, and adds "among others."
That definition reaches well beyond the large global social networks to regional and local platforms. Gaming platforms, dating apps, community and creator platforms, streaming services with chat features, and marketplaces where users share content could all fall within it. If people can interact or share content on your service, and minors could be among your users, you should review the decree with your legal team now.
What does the decree require platforms to do?
The decree asks platforms to act in three areas:
1. Age assurance and default settings
Platforms must use reliable and secure mechanisms to identify the age of their users. Self-declaration alone is not enough. New accounts must start with the strictest privacy and safety settings available.
2. Content moderation and safety
Platforms must publish clear criteria for age ratings and content moderation, remove harmful content and accounts immediately, and offer reporting tools that are always available. They must also provide parental supervision tools, build safety into the design of their service, and run regular risk assessments.
3. Cooperation with authorities
Platforms must name a contact point for authorities that is available 24 hours a day, keep evidence of removed content for at least 90 working days, and alert authorities immediately about content that puts minors at risk.
What is age assurance?
Age assurance is the umbrella term for the ways a platform confirms a user's age or age range. It includes age estimation, such as estimating age from a selfie, and age verification, such as checking an ID document. The goal is usually to confirm that someone is old enough for a service, feature, or type of content, without learning exactly who they are. To see how an age check works from the user's side, and what happens to their data, visit the Incode Age Center.
What must platforms do within 30 days, by November 13, 2026?
Platforms must document and report the actions they have implemented under the decree within 30 calendar days after it took effect. Counting from October 14, 2026, that is around November 13, 2026.
For most platforms, the first step is a clear plan: what they already do, what they will change, and which tools they will use. Age assurance is a central part of that plan, because the decree asks platforms to explain how they identify the age of their users.
The deadline matters beyond the report itself. President Sheinbaum has said that if platforms do not comply, she will push for a law with sanctions.
What Mexico's age assurance decree does not specify yet
The decree asks the Consejería Jurídica to set up a working group to prepare more detailed regulation, so specific technical criteria may come later. It also does not say where platforms should file their 30-day reports, or which age assurance methods will count as "reliable and secure."
Building your 30-day response? Your report needs to explain how you identify the age of your users. Our team can walk you through the age assurance options we already run for platforms in the UK, the US, Brazil, Europe, and Australia.
What age assurance methods do platforms use today?
The decree says that self-declaration alone is not enough. However, it does not say which methods count, though future regulation may define them. These are the methods platforms commonly use around the world, each with its own balance of ease and certainty:
Method How it works What to keep in mind
Self-declaration The user types in their birth date or ticks a box Not enough on its own under the decree. Anyone can enter any age.
Platform or app store signals Age is inferred from user behavior or shared by an app store Low effort for users. The platform does not control how the signal is produced, so it is often combined with other methods.
Facial age estimation A selfie is used to estimate the user’s age, with no ID needed Fast and low effort for users. Users close to the age limit may need a second check.
Document verification The user scans an ID document and takes a selfie to confirm it is theirs The highest level of certainty. Requires more effort from users, so it works best as a step-up.
Data-driven age verification or estimation Age is confirmed or estimated using data linked to the user from trusted data sources. Depending on the source, the result can be a confirmed age or an estimate. No camera and little or no extra effort for users, since the check can run in the background. How certain the result is, and whether the method is available, depends on the data source and the market, so it is often combined with other methods.
Many platforms combine methods. They start with the lowest-effort option and only ask for more when the result is unclear or the user wants access to higher-risk features. This keeps the experience smooth for most users and still gives a strong answer when it matters.
Not sure which mix fits your platform? Talk to our team about the right balance of user experience and certainty for your service.
How have other countries handled age assurance?
The decree adds Mexico to a growing list of markets that expect platforms to confirm the age of their users. The details differ, but the direction is the same.
In the United Kingdom, the Online Safety Act requires services that allow pornography or other content harmful to children to use "highly effective" age assurance, and the regulator, Ofcom, has said self-declaration does not qualify. Brazil's Digital ECA (Law No. 15,211/2025), in force since March 2026, also rules out self-declaration and requires the strongest protection settings by default for minors. In Australia, certain social media platforms must take reasonable steps to keep users under 16 from having accounts.
The European Union's Digital Services Act requires platforms that minors can access to ensure a high level of privacy, safety, and security for them, and the European Commission has published guidelines that include age assurance. In the United States, a growing number of states require age checks for adult content, and some now extend them to app stores and social media.
A common pattern has emerged across these markets. Platforms give every user a protected experience by default, then ask for an age check when someone wants to unlock adult features or content. Mexico's decree includes a similar default: new accounts must start with the strictest privacy and safety settings.
How does Incode help platforms with age assurance?
Incode already supports platforms working under age assurance rules in the UK, the US, Brazil, Europe, and Australia. We help platforms in Mexico define and document the age assurance part of their 30-day response. Our age assurance solution combines facial age estimation, data-driven age verification and estimation in markets where trusted data is available, and document verification in a single flow, so each user gets the lightest check that gives a clear answer. Users need a stronger check only when the first result is unclear or the feature carries more risk. Checks take seconds and work on the devices people already use.
Incode designs its age checks around data minimization to protect privacy. The platform receives only the age result it needs, such as "over 18," without collecting more personal data than necessary. Images and data can be deleted after the check, with retention settings each platform controls. Our Age Center explains, in plain language, how each check works and what happens to user data.
Every platform's obligations depend on its service, so we recommend reviewing your full plan with your legal team. We focus on the age assurance part of the plan and do not write or certify the filing itself.
What should your 30-day response cover on age assurance?
Use these questions to shape the age assurance section of your plan:
- How do you identify the age of your users today, and does it go beyond self-declaration?
- Which check do you use at sign-up, and which when a user tries to unlock adult features or content?
- What happens when the result is unclear? Do you have a step-up check?
- Do new accounts start with the strictest privacy and safety settings?
- What data does your age check collect, and how long do you keep it?
These questions cover age assurance only. The decree also asks for content moderation, parental tools, risk assessments, and a contact point for authorities, which need their own plans.
Frequently asked questions
Does Mexico's decree require age verification?
It requires platforms to use "reliable and secure mechanisms to identify the age" of their users, and says self-declaration alone is not enough. It does not name a specific method.
When did Mexico's age assurance decree take effect?
The decree took effect on October 14, 2026, the same day it was published in the Diario Oficial de la Federación.
What is the deadline for platforms under Mexico's decree?
Platforms must document and report the actions they have implemented within 30 calendar days of the decree taking effect, around November 13, 2026.
Are there penalties for not complying with Mexico's decree?
The decree itself does not set penalties. President Sheinbaum has said she will push for a law with sanctions if platforms do not comply.
Which platforms does Mexico's decree cover?
Any digital platform that lets users interact, communicate, or create and share content, including social networks, video games, and app stores.
Is facial age estimation the same as facial recognition?
No. Facial age estimation estimates how old someone is. It does not identify who they are. You can learn more in the Age Center.
Ready to define the age assurance part of your 30-day response with our age assurance solution? Request a demo today.