Cold Email Laws in Mexico: Your Email Has to Name the Regulator

September 21, 2026. Every guide to cold email in Mexico points at the same statute, the Ley Federal de Proteccion de Datos Personales en Posesion de los Particulares, and then explains consent. Read the law and the advice falls apart. The current LFPDPPP does not contain the word marketing, the word advertising, or the words electronic mail. The rule that actually governs a marketing email to somebody in Mexico lives in a different statute, enforced by a different regulator, and it requires something no other market we have covered requires: your email has to print the regulator's own contact details.

Mexico's cold email rule is not in the privacy law

We read the consolidated LFPDPPP published by the Camara de Diputados, last reformed in the Diario Oficial de la Federacion on 14 November 2025. The terms mercadotecnia, publicidad, publicitaria, prospeccion comercial and correo electronico appear zero times in it. As a control, datos personales appears 128 times in the same document, so the search is reading the text, not failing on it.

What the privacy law does give a Mexican recipient is Article 26, a right to object. It is not the unconditional marketing opt out that GDPR Article 21(2) grants. Article 26 requires a legitimate cause and that the person's specific situation requires it, and the person has to justify that the processing, while lawful, must nonetheless cease so that its continuation does not cause them damage or harm. A second limb covers automated decisions that produce unwanted legal effects. The article then closes the door further: the right to object does not apply where the processing is necessary to comply with a legal obligation imposed on the controller.

Article 17: your email must name PROFECO

The instrument that names it is the Ley Federal de Proteccion al Consumidor, last reformed 12 December 2025. Article 17 of the LFPC sets out what advertising sent to consumers must carry. Three parties have to be identified, not one:

1. The name, address and telephone number of the provider, and failing that its electronic address.
2. The same details for the company that sends the advertising on the provider's behalf, where one is used.
3. The details of the Procuraduria Federal del Consumidor, PROFECO, itself.

Read the second line again if you run an agency. Mexican law expects the sending agency to be named in the message, alongside the client it sends for. The third line has no analogue in CAN-SPAM or PECR: Mexico requires a commercial message to tell the recipient how to reach the regulator that polices it.

The second paragraph of Article 17 is the opt out, and it is channel explicit in a way most statutes are not. A consumer may demand, directly of specific providers and of companies that use consumer information for marketing purposes, not to be bothered at their home, at their workplace, at their electronic address, or by any other means, and that no advertising be sent to them. They may also demand at any time that information about them not be ceded or transmitted to third parties, unless a judicial authority orders it.

B2B is not a defence in Mexico

The usual escape from a consumer statute is to say the recipient is a business, not a consumer. Mexico closes it in the definition. Article 2, fraction I of the LFPC defines a consumer as the natural or legal person who acquires, uses or enjoys goods, products or services as final recipient. A company buying software for its own use is a final recipient. A narrower carve out further down the article limits which legal actions a company can bring when it buys goods to resell, but it does not remove legal persons from the definition.

Article 16 supplies the matching definition of purpose: marketing or advertising purposes means the offering and promotion of goods, products or services to consumers. A cold email pitching a service to a company is an offering of services to a final recipient. There is no B2B exemption to fall back on.

Article 16 also carries an access right that sits beside the privacy law's ARCO rights and runs on its own clock. Any person may ask, free of charge, whether you hold information about them. If you do, you must make it available, tell them what you shared with third parties, identify those third parties, and answer within thirty days.

The registry PROFECO may or may not keep

Article 18 creates Mexico's do not contact registry, and its verb is the interesting part. The Procuraduria may keep, where appropriate, a public registry of consumers who do not wish their information to be used for marketing or advertising purposes. Not shall keep. Consumers apply in writing or by email, and registration is free.

Article 18 BIS is the prohibition that hangs off it. Providers, and companies that use consumer information for marketing purposes, and their clients, are barred from using that information for anything other than marketing purposes, and barred from sending advertising to consumers who have expressly said they do not want it or who are listed on the Article 18 registry. Note the two triggers. Registration is one route onto your suppression list. A plain refusal sent to you directly is the other, and it needs no registry at all.

Your client is on the hook for what you send

The last sentence of Article 18 BIS is the one that should reach your contracts. Providers who are the subject of the advertising are jointly responsible for the handling of consumer information when that advertising is sent through third parties. In plain terms, hiring an agency does not move the exposure. It adds a second party to it.

That cuts both ways. If you are the agency, your client's indemnity clause is not the end of the argument, because the statute assigns them responsibility directly. If you are the brand, the suppression list your vendor keeps is your suppression list, and the sending infrastructure they run is effectively yours too.

The regulator is now a government ministry

One structural change matters more than any single article. Mexico's new LFPDPPP was published in the DOF on 20 March 2025 and took effect the next day, replacing the 2010 law. It abolished INAI, the autonomous transparency and data protection institute, and Article 3, fraction XV of the current text defines the competent authority simply as the Secretaria Anticorrupcion y Buen Gobierno. Law firm analyses from Greenberg Traurig and EY Mexico record the same transfer of INAI's functions and resources.

The practical consequence for a foreign sender is that the body assessing your lawful basis now sits inside the federal executive rather than outside it, and it is not a collegiate body issuing published plenary resolutions the way INAI did. There is less precedent to plan against.

What it means for operators

Mexico rewards a sender who treats the footer as a legal instrument rather than a design element. Four changes cover most of the exposure.

1. Put a real Mexican footer on Mexico sends. Provider name, postal address and phone, the sending agency's own details where an agency sends, and PROFECO's contact details. This is the cheapest item on the list and the one nobody does.
2. Treat a refusal as final on receipt, not on registry lookup. Article 18 BIS triggers on an express statement to you, so a reply saying stop is legally identical to a registry entry.
3. Stop relying on a B2B carve out. Legal persons are consumers as final recipients, so scope your Mexican suppression list to every address, not just the ones that look personal.
4. Fix the contracts before the campaign. Joint responsibility under Article 18 BIS means both the agency and the advertised brand need the same suppression file and the same thirty day process for answering an Article 16 request.

If Mexico is a real market for you rather than a row in a list, the work is in the plumbing more than the copy: a suppression list that survives a list swap, authenticated domains, and an audit trail that can answer an Article 16 request inside thirty days. That is the same discipline our cold email and lead generation builds already assume, applied to a market where the regulator's phone number belongs in your template.

What we could not verify today

Two things stayed out rather than being guessed at. PROFECO's REPEP site timed out on every attempt today, so this article makes no claim about which contact channels the registry accepts. And the LFPC's sanctions chapter sat beyond the portion of the official text we could retrieve, so we quote no fine range for an Article 18 BIS breach. What we did read in full is Article 25, which lets PROFECO apply coercive measures including a fine from 380.44 to 38,044.47 pesos, administrative arrest of up to 36 hours, and further daily fines of up to 15,217.79 pesos for up to 180 days where an infringement persists. Those punish disobeying the Procuraduria, not the spam itself.

This is general information about published law, not legal advice, and a Mexican campaign of any size should be reviewed by Mexican counsel.