In 2025, Mexico's Federal Law on the Protection of Personal Data (LFPDPPP) came into effect and must be considered together with consumer protection legislation to comply with the legal text requirements for e-commerce website pages.
In this article, we review what legal texts you should include on your e-commerce website, what information each one should contain, and why it's important to invest in drafting them correctly. Don't miss it!
What is known as a privacy policy within the European Union is referred to as a privacy notice under Mexican law. A privacy notice is a document that must inform the data subject of, at a minimum, the following:
This should be supplemented by the provisions of Article 76 Bis of the Federal Consumer Protection Law (Ley Federal de Protección al Consumidor – LFPC), which requires that consumers be informed of the following:
Although laws do not define it by this name, they establish the requirement to disclose information about the provider's identity, which must be public and available prior to any transaction. Therefore, it is essential to have a legal notice that provides:
The Federal Law for Consumer Protection (LFPC) in Article 76 bis establishes that you must provide information about the terms, conditions, total costs, additional charges, and payment methods before accepting the transaction.
Additionally, Mexican regulations in its NMX-COE-001-SCFI-2018 also require disclosure of:
Additionally, specific information is required for goods or products:
Specific provisions also exist when it is a service provision. Therefore, the text should include information about:
The regulations require that the entire document be written in Spanish, with characters legible to the naked eye and uniform font size.
It is also important to note that the Privacy Notice must be linked, disclosing the identity of the responsible party, the purposes of processing, and the means to exercise ARCO rights.
Finally, we must not overlook consent and the way it is obtained through the cookie banner. The most important requirement to bear in mind is that the mechanism for obtaining the user's authorization must be available before any personal data are used for tracking or advertising purposes.
The cookie banner must clearly specify the purpose of the tracking, including whether it is carried out for behavioral analytics, marketing purposes, advertising, or profiling. It should also clearly indicate where users can access the cookie policy to obtain complete information about how their data are processed.
Users must also be informed of the means and procedures through which they can withdraw their consent and modify their preferences at any time. Accordingly, it is considered a best practice for the system to allow users to adjust their privacy settings whenever they choose.
The provider must also inform users of the general characteristics of the technical measures (such as encryption) used to ensure the confidentiality of the personal data collected.
In summary, a legally compliant cookie banner in Mexico must function as a mechanism for obtaining prior, explicit consent, clearly inform users about any profiling activities, and provide straightforward options to accept, reject, or configure tracking preferences.
| Legal Text | Required Content |
| Privacy Notice | Identity and address of the responsible party Personal data to be processed and indicate which are sensitive Purposes of Data Processing Measures to Limit the Use or Disclosure of Data Mechanisms and Procedures for Exercising ARCO Rights Procedure for Reporting Changes to the Notice Provision Regarding the Sharing of Data with Domestic or Foreign Third Parties Profile creation or behavioral analysis for marketing purposes Additional (Art. 76 bis LFPC): Confidential Treatment of Information Characteristics of Technical Elements for Security and Confidentiality Option to Opt Out of Commercial Notifications or Advertising |
| Legal Notice (Provider Identification) | Supplier information: trade name, brand name, legal name, and RFC Physical address, phone numbers Ways to file complaints or request clarifications Liability for lack of availability, accessibility, or interruptions Applicable regulations and policies in the event of a dispute Age restrictions for access |
| Terms and Conditions of Purchase | General Information: - Supplier/intermediary identification (name, brand, RFC, address, phone number, email, external websites) - Procedure for purchasing the good/product/service - Terms, conditions, total costs, additional charges, payment methods - Mechanisms for notifying and communicating with the consumer - Return, exchange, and refund policies - Complaint resolution procedures (hours and timeframes) - Requirements for registration and access to the system - System security measures - Link to the Privacy Notice Right of Withdrawal: Right to revoke consent without liability within 5 business days following delivery or signature - Exceptions: goods that are non-returnable by nature and custom-made items For Products/Goods: - Specifications (dimensions, features, materials, color, new/used) - Availability and inventory - Total amount due in local currency (including additional charges) Warranties of at least 60 days (scope, procedures, repair shop addresses) - Delivery method (costs, delivery times, shipping options) - Liability of courier service providers - Country of origin for imported goods - Repair location and instructions for use - Right to replacement or refund of the amount paid - Right to a credit if the product does not match what was offered For Services: - Description of the service - Date, location, time of service, and duration - Who will be involved (include subcontractor information) - Guarantees for a minimum of 60 days (scope and mechanisms) - Service restrictions - Service term - Total amount payable in local currency (including fees) - Procedure for renewal, modification, termination, or cancellation - Option to consent to additional services Format: - Written in Spanish - Characters legible at a glance - Uniform font size |
| Cookie Policy and Consent | Key Requirements: - Mechanism for obtaining express and prior consent BEFORE using personal data - Must be available before tracking or advertising Elements to Specify: - Purpose of tracking (behavioral analysis, marketing purposes, advertising, profiling) - Clear reference to where the full cookie policy can be found - Means and procedures for withdrawing consent at any time - General characteristics of technical elements (e.g., encryption) to ensure confidentiality Required Options: - Option to accept tracking - Option to reject tracking - Option to configure privacy settings - Allow preferences to be reconfigured at any time Best Practices: - A system that allows users to configure their privacy level at any time - A clear banner regarding user profiling |
At Lawwwing, we understand that complying with all applicable regulations for your e-commerce legal texts can be complex. That's why we've created a solution that makes it easy and automates the entire process.
With Lawwwing, you can not only automatically generate the legal texts for your website, but you'll also keep them always updated whenever there are regulatory changes. This way, you can focus on growing your business with the peace of mind of always being up to date on legal matters.
Don't put it off until tomorrow: automate your e-commerce legal compliance with Lawwwing.
