Summary

  • Mexico’s decree took effect when it was published on 14 October. It requires qualifying platforms to document and report their implementation actions within 30 calendar days.
  • The decree sets extensive duties, but the first accountability question is how the Agencia de Transformación Digital y Telecomunicaciones and other competent authorities will assess those reports and make results verifiable.

The clock began with publication, not with a later rulemaking. Mexico’s Diario Oficial de la Federación published the decree on 14 October, and its second transitory clause made it effective that day. The fourth clause gives platforms no more than 30 calendar days to document and report the actions they have taken. That creates a near-term checkpoint. It does not, by itself, show that any service has completed the work or that authorities have tested the result.

The Presidency’s announcement of the decree describes it as mandatory but non-punitive. It says the Agencia de Transformación Digital y Telecomunicaciones will follow up and reports that named platforms asked for a month to prepare. That is the government’s account of its meetings. The decree itself applies to every service that meets its definition, whether or not that service was named in the announcement.

More than a social-media rule

The decree defines a digital platform broadly: an Internet intermediary that enables people to interact, communicate, create, distribute or share content. Its examples include social networks, video games and app stores. The operative duties therefore reach beyond a familiar feed or messaging product. The relevant question is what service the company operates and whether it fits the decree’s definition.

Article 3 bars platforms from allowing children or adolescents to access, be exposed to, or receive recommendations for specified material. The list covers cyberbullying; sexual abuse and exploitation; hate speech, violent extremism and mass violence; user-to-user content promoting hatred or violence, especially at school; unlawful conduct; explicit sexual material; and suicide, self-harm or eating-disorder content.

Article 4 turns that rule into product and process obligations. Platforms must use reliable age-identification methods that do not rely only on self-declaration; publish criteria for removing accounts and content and for age classification and moderation; remove covered accounts or material immediately; maintain visible and accessible reporting tools; and provide parental supervision features. They must build in safety protections, turn on the strictest available privacy and security settings for new accounts by default, and periodically assess risks arising from design, features, recommender systems and user interaction.

The same article calls for reasonable mitigation and for periodic statistics on detected content patterns to be shared with competent authorities. Article 5 adds a specialised government contact available around the clock, preservation of evidence for at least 90 business days after removal, and immediate alerts about material that threatens a child’s life, dignity, security, integrity or privacy. This is a substantial operational checklist, not merely a statement of principle.

The evidence path remains the test

The 30-day clause says platforms must “document and report” their actions, but it does not set out a common report template or say there that the submissions must be public. The decree separately requires periodic sharing of statistics with competent authorities; that is not the same as a public dashboard or an outside audit. The Presidency names the ATDT for follow-up, while the decree’s third transitory clause instructs the Executive Legal Counsel to convene a table of competent federal departments and entities to coordinate proposals for further regulation. Those are related tasks, but the text assigns them through different clauses.

The difference matters because an implementation report can be a record of work performed without showing whether children encounter less harmful content. A useful assessment would connect a platform’s published rules to its age-assurance method, recommendation controls, removal decisions, complaints and corrections. It would also show how risk reviews change a product. The sources establish the reporting duty and the government’s stated follow-up role; they do not yet report a compliance outcome.

The decree also cites freedom of expression in its preamble, while Article 3 includes broad categories such as hate speech and unlawful conduct and Article 4 requires immediate removal of covered content. That makes published criteria consequential. Consistent rules, evidence of how they are applied and a visible way to correct mistakes would help distinguish child protection from indiscriminate restriction. The decree requires platforms to publish identification, removal, classification and moderation criteria; the reviewed provisions do not spell out a user-appeal procedure.

That observation is limited to this text, not a claim that no remedies exist elsewhere in Mexican law.

A commitment is not a result

The Presidency says it met with Meta, Microsoft, Apple, TikTok, Google, X and Huawei, and that companies recognised the need for the measure while asking for preparation time. Those discussions may inform implementation. They are not evidence that every service within the decree’s broad scope has complied, nor do they replace the legal obligation created by publication.

The next development is therefore measurable: whether the required reports arrive, what information they contain, how the ATDT and other authorities examine them, and whether the separate work table produces a regulatory proposal. A deadline creates pressure. Publicly intelligible evidence creates accountability.