In July 2026, Mexico’s Secretariat for Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno) fined the Mexican Football Federation (FMF) MXN 42,849,095 (approximately €2,178,030). This penalty is one of the most significant cases in Mexico involving non-compliance with personal data protection legislation.
What exactly happened? What violations were committed? And, most importantly, what can we learn from this case?
FAN ID was designed as a digital and personal identification system to increase security and streamline entry to football events in Mexico—a unique, personal code intended to enhance security at sports venues.
To obtain a Fan ID, users access their club’s official website and create an account by providing their email address, phone number, and personal information. They then upload a photo of their identity document and a verification selfie with liveness detection. Based on this image, the system’s biometric engine generates a three-dimensional facial map to verify the user’s identity. Once the verification process is complete, a unique and non-transferable personal QR code is generated and stored on the user’s phone.
Once registered, when arriving at the sports venue, fans must present their Fan ID QR code along with their physical ID and match ticket.
However, the way the FMF processed the biometric data of millions of fans generated controversy. The authority concluded that the Federation did not properly inform users that the photographs used to create the FAN ID constituted sensitive personal data, nor did it obtain express written consent to process them.
The Secretariat for Anti-Corruption and Good Governance determined that the FMF committed two specific violations of data protection legislation:
The FMF collected photographs of fans to generate the FAN ID, but did not state in its privacy notice that this data was considered sensitive. This omission prevented data subjects from understanding the full scope of the processing of their personal information and from making an informed decision about its use.
This was a fundamental issue because biometric data such as facial photographs is considered sensitive personal data under Mexican law and requires a higher level of protection and transparency. The FMF failed to meet this obligation, which led the Secretariat to impose the fine.
The authority also determined that using a checkbox on a website was insufficient because the law requires a signature validating the data subject’s consent.
Therefore, not all forms of consent are equivalent. In this case, Mexico’s federal personal data protection law requires consent to be express and in writing when sensitive data is involved. For this reason, the mechanism was deemed insufficient by the authority because it lacked a handwritten signature, electronic signature, or any other authentication method capable of proving the user’s consent.
If you work for a company or institution that collects personal data, particularly sensitive data, you should consider the following:
1. Understand what constitutes sensitive data
2. Implement clear and specific privacy notices.
Your privacy notice should:
3. Obtain appropriate consent
The amount of the penalty was determined based on the severity of the violation and the organization’s financial capacity, using its 2024 tax reports as a basis.
This reflects a proportional approach: a small business is not penalized in the same way as a large organization. However, the MXN 42.8 million fine reflects the seriousness of processing the biometric data of millions of people without adequate safeguards.
The FMF fine highlights a common problem: incomplete or ambiguous privacy notices that fail to comply with the law. If your company does not yet have up-to-date legal documentation regarding data protection, or if you want to ensure that you meet all legal requirements, now is the time to act.
Automate your legal documentation with Lawwwing
With Lawwwing, you can quickly and automatically generate all the legal documentation you need: privacy notices, terms of use, and purchase terms and conditions. Everything is kept up to date with current legislation.
Avoid fines and ensure regulatory compliance starting today.
