Mexico

Article 199 Octies criminalises, for any person, divulging, sharing, distributing, or publishing images, videos, or audio of intimate sexual content of an adult without their consent, approval, or authorisation, and separately criminalises video-recording, audio-recording, photographing, printing, or producing such content of a person without their consent, approval, or authorisation, each carrying 3 to 6 years' imprisonment and a fine of 500 to 1,000 times the Unidad de Medida y Actualización (UMA).

Article 199 Nonies imposes the same penalties where the intimate sexual images, videos, or audio disseminated, shared, distributed, or published do not actually correspond to the person indicated or identified in them: the article's text requires only that the disseminated content not correspond to the identified person, without regard to how the non-corresponding depiction was produced, so it reaches a manipulated, fabricated, or AI-synthesised depiction of a person's face or voice in intimate sexual content on the same terms as any other non-corresponding depiction.

Article 199 Decies increases the minimum and maximum penalty by up to one half where the offence is committed by a spouse, partner, or person in a relationship of trust with the victim; by a public servant in the exercise of their functions; against a person unable to understand or resist the act; for non-lucrative benefit; for profit; or where the victim, as a consequence of the offence, attempts against their own physical integrity or life.

New Article 305 Bis of the Ley Federal del Trabajo requires a performing artist's labor contract to specifically stipulate the conditions and remuneration for using their image or voice through artificial intelligence systems or any other technology.

Reformed Article 87 of the Ley Federal del Derecho de Autor requires a performing artist's express consent, or that of their representative or rights-holder, before their image, including their voice, may be used or published, and expressly extends that protection to results generated by AI systems or other technology; a performer who received specific remuneration for a use is presumed to have consented only to the agreed purpose and modality, and any different use requires new authorisation and remuneration.

The article exempts use where the performer's image forms a minor part of a group, is captured in a public place, or is used for informational or journalistic purposes, and does not treat parody, satire, or creative imitation as a violation, nor a use that is not a cloning or impersonation intended to mislead the public or to substitute the performer's own professional work in the market through AI or another technology.

New Article 118, fracción VII, of the same law gives a performer a right against the impersonation of their interpretations by AI systems or other technology that generates clones of their interpretations or simulates their voice identifiably, subject to the same parody, satire, and non-replacement exceptions.

Article 121 requires a prior written agreement between the parties for any cloning or impersonation of a performer's voice or image using AI or other technology within an audiovisual work, beyond what a production contract ordinarily authorises. Article 231, fracción II, makes contravening Articles 87 or 118, fracción VII, an infraction, and Article 232 fixes the administrative fine for that infraction between 5,000 and 40,000 days of the general minimum wage.

Article 1 protects personal data in the possession of private parties, excepting only credit-reporting societies and purely personal, non-commercial data collection. Article 5 requires lawfulness, purpose limitation, loyalty, consent, quality, proportionality, information, and accountability in every processing.

Article 7 requires consent, express or tacit, except where Article 9 dispenses with it (a legal provision, publicly available sources, prior dissociation, a legal relationship's requirements, an emergency, medical care, or professional-secret relationships).

Article 8 requires express written consent, by autograph or electronic signature or another authentication mechanism, before creating a database of sensitive personal data (Article 2(VI): race or ethnicity, health status, genetic information, religious, philosophical or moral belief, political opinion, or sexual preference, an illustrative but not exhaustive list that does not name a biometric identifier).

Articles 21 to 26 give the data subject ARCO rights (access, rectification, cancellation, objection), including a right at Article 26(II) to object to a decision based solely on automated processing that produces undesired legal effects on the person or significantly affects their interests, rights, or freedoms, and that is intended to evaluate, without human intervention, their professional performance, economic situation, health, sexual preferences, reliability, or behaviour.

Article 19 requires the controller to inform the data subject immediately of a security breach at any stage of processing that significantly affects their patrimonial or moral rights.

Article 35 conditions a transfer to a third party on communicating the privacy notice and its purposes, and requires the notice to state whether the data subject accepts the transfer; Article 36 lists grounds on which a national or international transfer may proceed without the data subject's consent (a law or treaty, medical necessity, transfer within a corporate group under common control, a contract in the data subject's interest, a public-interest or judicial ground, or defense of a right in a judicial proceeding).

Breach of these duties is enforced administratively by the Secretaría Anticorrupción y Buen Gobierno with fines under Article 59, and Articles 62 to 64 create separate criminal offences for a person authorized to process personal data who, for profit, causes a security breach, and for anyone who processes personal data through deceit for undue profit, with the criminal penalty doubled for sensitive data.

Article 211 bis 1 punishes with 6 months to 2 years' imprisonment and a fine anyone who, without authorisation, modifies, destroys, or causes the loss of information contained in a computer system or equipment protected by a security mechanism, and with 3 months to 1 year's imprisonment anyone who, without authorisation, learns of or copies such protected information.

Articles 211 bis 2 and 211 bis 3 impose heavier penalties, up to 10 years for public-security systems, for the same conduct against a State computer system, distinguishing an outsider acting without authorisation from an insider authorised to access the system who acts improperly within it. Articles 211 bis 4 and 211 bis 5 apply a parallel regime to financial-sector computer systems.

Article 211 bis 7 increases every penalty in the chapter by up to one half where the information obtained is used for the offender's own benefit or a third party's. Each offence turns on defeating a security mechanism protecting the system ("protegidos por algún mecanismo de seguridad") without authorisation; the text does not on its face reach reading a page that carries no such mechanism.

Article 114 Bis lets a copyright or related-right holder implement an effective technological protection measure, defined as any technology, device, or component that, in the normal course of its operation, protects the right or controls access to a work, performance, or phonogram, and lets rights-management information be attached to a work.

Article 232 Bis fines, from 1,000 to 20,000 times the Unidad de Medida y Actualización (UMA), anyone who produces, reproduces, manufactures, distributes, imports, markets, leases, stores, transports, offers, makes available, or otherwise supplies a device, mechanism, product, component, or system that is promoted, marketed, or advertised for the purpose of circumventing an effective technological protection measure; is used predominantly for that purpose; or is designed, produced, or executed for that purpose.

Neither article names crawling, scraping, or a bot as such; the prohibition reaches circumventing an access-control or copy-control mechanism on a copyrighted work regardless of the collection method used afterward.

Article 107 protects a database or other machine-readable material as a compilation where its selection or arrangement of content constitutes an intellectual creation, and the protection does not extend to the underlying data and materials themselves. Article 108 separately protects a non-original database in its exclusive use by whoever compiled it, for 5 years, without requiring the originality Article 107 asks of a compilation.

Article 109 conditions access to, and publication, reproduction, disclosure, public communication, or transmission of, private information about identifiable people contained in such a database on the prior authorisation of the persons concerned, exempting law-enforcement investigations and lawful access to public archives.

Article 110 gives the holder of the patrimonial right over a database the exclusive right to authorise or prohibit its reproduction, translation, adaptation, reordering or other modification, distribution, and public communication, including of the results of a permitted modification. Mexico's regime protects the compilation's selection and arrangement and, separately, a 5-year producer-style exclusive-use right over a non-original database.

Article 69 Bis requires the Secretaría de Gobernación to issue the guidelines classifying video games distributed, marketed, or rented by any means, and to oversee compliance. A video-game distributor must print or affix the applicable classification on the game's cover and in its advertising. A video-game marketer must not advertise, exhibit, sell, or rent a video game whose classification is not visible under the guidelines.

A video-game marketer or renter must require a person seeking to buy or rent a video game classified as exclusively for adults to prove they have reached the age of majority, without which the sale or rental may not proceed. Article 148, fracción VII Bis, makes contravening this duty an infraction, sanctioned under Article 149 with a fine of 3,000 to 30,000 days of the general minimum wage in effect when the conduct occurred, doubled on recidivism. The article itself does not specify a required proof-of-age method.

Article 148's chapeau permits using an already-divulged literary or artistic work, without the rightsholder's authorisation and without remuneration, provided the normal exploitation of the work is not affected, the source is always cited, and the work is not altered, only in the cases the article then lists. Fracción I permits quoting a text, provided the amount taken cannot be considered a simulated and substantial reproduction of the work's content.

Fracción II permits reproducing articles, photographs, illustrations, and commentary on current events, published by the press or broadcast by radio, television, or any other medium, unless the rightsholder has expressly prohibited that use. Fracción II's own permission is opt-out rather than opt-in: a news publisher who has not expressly prohibited the reuse cannot object to a reproduction that otherwise meets Article 148's conditions.