Website Cookie Policy Mexico (Política de Cookies)

A Website Cookie Policy Mexico (Política de Cookies) is a legal disclosure document published on a website operated in Mexico that informs users about the cookies and similar tracking technologies (tecnologías de seguimiento) used by the site operator, the categories of data collected through those technologies, the purposes for which such data is processed, and the mechanisms available to users to manage or withdraw their consent. In Mexico, cookie policies are primarily governed by the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, published in the Diario Oficial de la Federación on 5 July 2010) and its Reglamento (published in the DOF on 21 December 2011), with oversight responsibility assigned to the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI).

The LFPDPPP Article 8 establishes the foundational consent requirement for personal data processing in Mexico — data subjects (titulares) must provide freely given, informed, and specific consent before a responsible party (responsable) may process their personal data. Article 15 of the LFPDPPP complements this by requiring that the aviso de privacidad (privacy notice) describe the purposes of data processing and the mechanisms available to data subjects to exercise their ARCO rights (acceso, rectificación, cancelación, and oposición). When a website uses cookies that collect personal data — such as IP addresses, device identifiers, browsing history, geolocation data, or behavioural profiles — the site operator becomes a responsable under the LFPDPPP and must comply with the full regulatory framework.

The Reglamento de la LFPDPPP Article 41 specifically addresses the use of remote tracking technologies (tecnologías de seguimiento a distancia) and requires that responsible parties disclose in their privacy notice the use of such technologies, the data collected, the purposes of collection, and the mechanisms to disable them. The Lineamientos del Aviso de Privacidad published by the INAI (DOF 17 January 2013) further specify that website operators must provide a simplified, short-form privacy notice at the point of initial data collection — which for cookie-based data collection means at or before the first page load.

Mexican data protection law distinguishes between cookies that process personal data (datos personales) and those that do not. Session cookies that merely facilitate technical website functionality without collecting identifiable user data may not require specific consent under the LFPDPPP — however, analytical cookies that create user profiles, advertising cookies that track browsing behaviour across sites, third-party cookies from social media platforms such as Meta (Facebook), Google, or TikTok, and persistent cookies that link browsing sessions to identified or identifiable users all involve personal data processing requiring informed consent under Articles 8 and 15 LFPDPPP.

The INAI has published specific guidance on digital privacy notices and cookie consent through its Guía para el Aviso de Privacidad en Línea and various recomendaciones, emphasising that consent mechanisms on Mexican websites must be genuine — pre-ticked boxes, cookie walls (conditioning site access entirely on cookie acceptance), and deceptive cookie banners (patrones oscuros or dark patterns) do not satisfy the LFPDPPP's informed consent standard. The INAI may initiate verification procedures (procedimientos de verificación) and impose sanctions under Articles 63 through 66 LFPDPPP for non-compliant cookie practices, with fines ranging from 100 to 320,000 días de salario mínimo general vigente en el Distrito Federal — which at 2025 minimum wage rates represents sanctions from approximately $1,060 to $3,396,800 MXN.

For websites that serve users in both Mexico and the European Union, the European General Data Protection Regulation (GDPR) and Mexico's LFPDPPP impose comparable but distinct requirements — the GDPR's ePrivacy Directive cookie consent standard (opt-in for non-essential cookies) aligns closely with INAI guidance on genuine informed consent, but the LFPDPPP operates through its own national enforcement framework administered by the INAI rather than EU supervisory authorities.

A Website Cookie Policy Mexico is required whenever a Mexican business, organisation, or individual operates a website that uses cookies, web beacons, pixels, local storage, or similar tracking technologies that collect personal data (datos personales) of users who are located in Mexico. The LFPDPPP's territorial scope covers responsible parties (responsables) established in Mexico and applies to personal data processing activities carried out in Mexican territory, regardless of where the data is physically stored.

The cookie policy is specifically required when the website uses Google Analytics, Google Ads, Meta Pixel (Facebook Pixel), Google Tag Manager, LinkedIn Insight Tag, TikTok Pixel, or similar third-party tracking technologies — each of these tools collects personal data including IP addresses, device identifiers, and behavioural data, triggering the LFPDPPP consent and disclosure requirements under Articles 8 and 15.

An e-commerce website (tienda en línea) in Mexico must publish a cookie policy covering the shopping cart session cookies, payment processor integration cookies from providers such as Conekta, BBVA Bancomer API, or Mercado Pago, customer account authentication cookies, and any remarketing pixels used for advertising — all categories involve personal data processing under the LFPDPPP.

A corporate website (sitio web corporativo) that uses a contact form, newsletter subscription, or live chat widget must disclose in its cookie policy the data collected by form analytics, chat session tracking, and email marketing platform cookies from providers such as Mailchimp, HubSpot, or ActiveCampaign.

Media companies, news portals, and content platforms operating in Mexico that monetise through advertising must disclose their use of programmatic advertising cookies, demand-side platform (DSP) pixels, and audience segmentation technologies — these involve sensitive behavioural profiling that the INAI considers high-risk processing requiring explicit consent under the LFPDPPP.

Under LFPDPPP arts. 8 and 15 and Reglamento art. 41, any website that uses cookies collecting personal data must maintain a publicly accessible, clearly worded Política de Cookies — failure to do so exposes the site operator to INAI verification procedures, corrective measures, and administrative sanctions. Any website operator unsure of which cookie categories apply should conduct a cookie audit before publishing the policy.

The Política de Cookies must also be updated whenever the website integrates new third-party tools — such as switching from Universal Analytics to Google Analytics 4, adding a Meta Conversions API, or deploying a new customer relationship management (CRM) platform that sets persistent tracking cookies. Each new integration triggers fresh disclosure and consent obligations under LFPDPPP Article 15 and Reglamento Article 41, making ongoing cookie audits an essential compliance practice for all Mexican websites.

A compliant Website Cookie Policy Mexico under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and INAI guidelines must include the following essential elements:

Identification of the Responsible Party: Full legal name, RFC, and contact details of the responsable — the legal entity or individual that operates the website and determines the purposes and means of cookie-based data processing. This enables data subjects to exercise their ARCO rights (acceso, rectificación, cancelación, and oposición) under Articles 22 through 32 LFPDPPP.

Definition and Explanation of Cookies: A clear, user-accessible explanation of what cookies are — small text files stored on the user's device by the web browser at the instruction of the website server — and the distinction between first-party cookies (set directly by the website operator) and third-party cookies (set by external service providers).

Cookie Categories and Purposes: Itemised disclosure of each category of cookie used, as required by Reglamento Article 41. Standard categories include: (1) strictly necessary cookies (cookies estrictamente necesarias) — required for basic website functionality such as session management and shopping cart operation; (2) analytical cookies (cookies analíticas) — tools such as Google Analytics 4 (GA4) that measure website traffic and user behaviour; (3) functional cookies (cookies funcionales) — preferences such as language selection and font size; (4) advertising and targeting cookies (cookies publicitarias y de seguimiento) — Meta Pixel, Google Ads, and programmatic advertising technologies; and (5) social media cookies — embedded share buttons and social login widgets from platforms such as Meta, X (Twitter), and LinkedIn.

Third-Party Processors Disclosure: Identification of each third-party provider whose cookies are used on the website — including the provider's name, country of establishment, and link to their own privacy policy. Where third-party providers are established outside Mexico, the LFPDPPP Article 37 international data transfer provisions apply — requiring either consent or a legal basis for the cross-border transfer.

Consent Mechanism: Description of the consent banner or cookie management tool (gestor de cookies) implemented on the website, confirming that consent is obtained before non-essential cookies are activated. The consent mechanism must comply with LFPDPPP Article 8's requirements for freely given, informed, specific, and unambiguous consent — pre-ticked boxes do not satisfy this standard under INAI guidance.

Cookie Duration and Persistence: A table or list specifying the name, provider, purpose, type (session or persistent), and expiry period of each cookie used — session cookies expire when the browser is closed; persistent cookies survive for a defined period ranging from days to years.

User Rights and Opt-Out Mechanisms: Instructions for users to exercise ARCO rights, manage cookie preferences through the cookie consent manager, configure browser settings to block or delete cookies, and opt out of specific third-party tracking (e.g., Google Analytics opt-out browser add-on, Meta off-Facebook Activity tool).

Policy Updates and Version Control: Statement that the cookie policy will be updated when new cookies are introduced or when legal requirements change, with the date of last revision. Under LFPDPPP Article 17, changes to processing purposes must be notified to data subjects.

Forms-legal.com provides this Website Cookie Policy Mexico template as a practical compliance starting point. Website operators processing personal data at significant scale, operating in regulated sectors such as financial services or healthcare, or targeting users across multiple jurisdictions should obtain advice from a Licenciado en Derecho or data protection specialist certified by the INAI before publishing their final cookie policy.