In May 2000, Mexico amended several statutes, including the Code of Commerce, by introducing Title II on electronic commerce, drawing upon the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

In August 2003, Mexico amended its Commercial Code by reforming and expanding Title II on electronic commerce, including the introduction of a chapter on foreign electronic signatures. These amendments draw on the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

In February 2020, Mexico’s Instituto Federal de Telecomunicaciones (IFT) issued guidelines under Technical Provision IFT-012-2019, which entered into force in February 2021 and has been reported to create a significant barrier to trade for mobile telecommunications products. Reports indicate that the framework may delay time-to-market by requiring in-country testing for Specific Absorption Rate (SAR). It is also reported that the applicable requirements rely on standards considered outdated compared with more recent guidance from the International Electrotechnical Commission (IEC)/Institute of Electrical and Electronics Engineers (IEEE), as well as the International Commission on Non-Ionizing Radiation Protection (ICNIRP). In addition, the rules reportedly entail duplicative testing and may create bottlenecks, as Mexico has only a limited number of accredited facilities capable of performing the required tests.

It is reported that the conformity procedures of the Agreement, under which the Plenary of the Federal Telecommunications Institute issues the Conformity Assessment Procedure for Telecommunications and Broadcasting, contain worrying language requiring the sharing of test reports that may contain in-depth confidential information about ICT products.

Circular 12/2018 imposed quantitative limits on electronic payment fund accounts offered by electronic payment institutions in Mexico. Under Provision 15, individuals holding accounts denominated in foreign currency may withdraw funds and make card payments for a combined maximum of USD 10,000 per calendar month. Card payments from these accounts may be made only to beneficiaries located outside Mexico. The measure, therefore, imposes a direct monthly ceiling relevant to cross-border online payments.
Provision 9 establishes separate limits for accounts denominated in Mexican pesos, depending on the account level. Level 1 accounts may receive up to 750 Investment Units (UDIs, Unidades de Inversión) per month (approx. USD 378) and maintain a maximum balance of 1,000 UDIs (approx. USD 505). Level 2 accounts may receive up to 3,000 UDIs per month (approx. USD 1,514), while Level 3 accounts are not subject to a regulatory funding limit. These ceilings restrict the amount that users may receive or hold in their accounts and may therefore indirectly limit payments made through them.

Mexico does not apply a horizontal de minimis threshold, which is the minimum value of goods below which customs do not charge duties, across all trading partners. Yet, Rule 3.7.35 of the General Foreign Trade Rules for 2025 provides duty relief to specific, origin-based categories. For shipments from the United States and Canada, the de minimis threshold for customs duties is USD 117, while for countries covered by certain trade agreements, including Panama, the Pacific Agreement, and the Trans-Pacific Partnership, the applicable de minimis threshold is USD 1.

Under Mexico’s Value Added Tax Law (LIVA), non-resident suppliers of digital services without an establishment in Mexico are subject to specific compliance obligations. In particular, Art. 18-D(VI) requires such suppliers to appoint a legal representative and provide an address in Mexican territory for notification and compliance-monitoring purposes. Where a non-resident supplier fails to comply with the relevant obligations, Art. 18-H BIS provides for the temporary blocking of access to the supplier’s digital service through Mexican telecommunications network concessionaires until compliance is achieved.
The applicability of these obligations depends on whether the activity qualifies as a “digital service” under Art. 18-B, which enumerates four categories, including (i) digital content, and (ii) digital intermediation between third-party suppliers and customers. In this regard, the SAT’s Criterion 40/IVA/N, published in the Official Gazette on 11 October 2024, broadens the interpretation of “digital intermediation services” by treating platforms as intermediaries where, for consideration, they enable customers to offer goods or services to third parties and allow suppliers and customers to agree via the platform on the transaction terms and price. The criterion further clarifies that this characterisation may apply even where the platform presents itself as merely an “online store,” if it also connects third-party suppliers with customers.

The "Law on the National System of Research and Intelligence in the Field of Public Security" grants the Secretariat for Security and Citizen Protection (SSPC) broad powers to access personal, fiscal, biometric, and geolocation data from public and private sources without prior judicial authorisation, while also establishing a single, centralised database to which federal, state, and municipal authorities may obtain direct access without a warrant. It further establishes a Central Intelligence Platform to integrate and connect public and private databases under the authority of the Digital Transformation Agency and the National Intelligence Centre in Mexico, permitting the use of such information without judicial oversight. The platform will consolidate an extensive range of data, including vehicle and licence plate records, biometric identifiers, telephone information, property and commercial registries, corporate and land records, fiscal data, firearms registries, information from private security service providers, data on detained and sentenced persons, and records relating to financial and banking services, transport, health, telecommunications, maritime activities, and other sectors.

The Federal Copyright Act provides a safe harbour regime for intermediaries concerning copyright infringements. According to the 2020 amendments to Arts. 114 Septies and 114 Octies of the Mexican Federal Copyright Law, Internet Service Providers (ISPs) are not liable for copyright infringements if they:
- 'Promptly and readily' remove any copyrighted works that infringe copyright, regardless of whether they are notified of the infringement or discover it themselves.
- Do not initiate the transmission of the works, performances, or productions, do not select them, and do not receive financial compensation for their transmission, making available, or reproduction.
These safe harbour provisions limit ISP liability, ensuring they are not directly liable for damages when they adhere to appropriate compliance measures. However, it is reported that these provisions lack the detail and clarity found in other similar regulations.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Mexico's law and jurisprudence.

Under Art. 183.II of the Telecommunications and Broadcasting Act, telecommunications licensees and, where applicable, authorised entities must maintain records and controls of all communications made from any type of line, including SIM cards, to ensure the identification of the subscriber's name, designation or business name, address, and other relevant details.

It is reported that exporters and businesses have long faced insufficient prior notice of procedural changes, inconsistent interpretations of import requirements across border posts, and uneven enforcement of Mexican standards and labelling rules. Earlier reports also identified burdensome procedures for express shipments and inconsistent application of requirements across ports of entry. More recent reports indicate that new customs or tax requirements may be notified shortly before taking effect, leaving businesses little time to adjust their systems and comply. Certain goods may also be imported only through designated ports of entry, complicating transportation and logistics arrangements, particularly for e-commerce purchases from SME exporters.

It is reported that Mexico’s telecommunications and broadcasting conformity assessment procedure, published in the Official Gazette (DOF) on 25/02/2020, created administrative frictions for the importation and certification of second-hand, rebuilt, or refurbished ICT products. Reported frictions relate, in particular, to the “Family/Model” approach (Art. 26) and to the non-transferability of conformity documents (Art. 7), which may require the re-issuance of conformity documentation where different economic operators, such as the manufacturer, importer, or distributor, must rely on it.
While the original 2020 procedure effectively excluded non-new products from the main certification schemes, an amendment published in the DOF on 27/12/2021 introduced a pathway to certify “non-new products” under a specific scheme. However, restrictions reportedly remain, as non-new products continue to be confined to that route and are not generally eligible under the broader certification schemes.

Pursuant to Art. 21 of Mexico’s Foreign Trade Act, the Secretariat of Economy (SE) may subject the importation and exportation of goods to prior permit requirements. Arts. 14–20 of the Regulation to the Act further set out the procedure for applying for these permits.
Under the Agreement establishing dual-use goods, software and technologies whose export is subject to regulation by the Ministry of Economy, exporters must obtain a prior permit for listed dual-use goods, software and technologies. The relevant ICT categories include specified high-performance or specially designed portable computers (HS 847130) and other computers or processing units (HS 847141, 847149 and 847150) under Category 4, as well as telecommunications base stations (HS 851761), data-transmission, routing and network equipment (HS 851762), other telecommunications apparatus (HS 851769) and related parts (HS 851770) under Category 5. Certain information-security and cryptographic products classified under these and other ICT headings are also covered.
The requirement applies only where the products meet the prescribed technical thresholds and therefore generally does not cover ordinary mass-market computers, mobile phones, routers, or other consumer ICT equipment. Controlled software and technology transmitted electronically are also treated as exports subject to prior authorisation. Permit applications are assessed by reference to the destination, end user and intended end use. The control annexes were updated in August and November 2022.

Until 2020, product certification in Mexico could be conducted only by certification bodies accredited by the Entidad Mexicana de Acreditación (EMA). For IT equipment and consumer electronics, the Mexican agency issuing certificates is the Underwriters Laboratories of Mexico.
The Law of Quality Infrastructure, which repealed the Federal Law on Metrology and Standardisation, allows for self-declaration of conformity if the standard bodies confirm that the Conformity Assessment Procedure includes the obligation by the goods producers (or services suppliers) to be accountable or if it does not affect the public interest (Arts. 60 and 69).