Mexican Senate logs cybercrime reform bill

Mexico’s Senate legislative information system has logged a bill to amend the Federal Penal Code on cybersecurity and cybercrime. The proposal would add a new chapter to punish conduct carried out through digital channels that undermines the free exercise of personality, including the generation, sharing or storage of intimate or pornographic content without consent. The item remains under legislative review, so the process is still open.

What does the federal bill propose?

The bill seeks to add a new chapter to the Federal Penal Code to penalize conduct committed through digital means that affects the free exercise of personality. The legislative text cited by the Senate’s information system explicitly includes the generation, dissemination or storage of intimate or pornographic content without consent as one of the covered offenses.

The document is part of a vertical legislative activities report from the Senate, which also lists initiatives related to digital violence and new offenses committed through information and communications technologies. In that same context, reporting by El Heraldo de México said committees are discussing how to close legal gaps around digital violence against women when content is generated by artificial intelligence, with specific reference to sexual deepfakes.

What is the status of the process?

The reform is still being processed and does not appear as completed in the Senate’s own vertical legislative report. That means that, as of the document dated August 24, 2026, review of the bill was still open.

The discussion is unfolding alongside other regulatory changes in Mexico City and the State of Mexico on personal data, transparency and digital fraud. In the capital, Greenberg Traurig México described a new local regulatory framework that defines and penalizes phishing and digital fraud, while El Universal reported that the head of government enacted new data protection and transparency laws, with the dissolution of Info CDMX and the creation of 11 oversight bodies.

How is the rest of the regulatory map moving?

Mexico City and the State of Mexico have moved ahead with reforms that combine data protection, transparency and new criminal offenses tied to digital fraud. In the capital, Article 231 Bis of the local penal code sets penalties of three to six years in prison and fines of 23,462 to 70,386 pesos for phishing-related conduct, with increases of up to half if the victim is a person with a disability, an older adult or a minor, according to Greenberg Traurig México.

At the same time, Diario Portal reported that the State of Mexico Congress approved a new Personal Data Protection Law for Obligated Subjects, along with a new Transparency and Access to Information Law, amid opposition from the PRI, PAN and MC. The law applies to authorities, bodies across the three branches of government, autonomous institutions and state and municipal public trusts and funds, and sets out rules for personal data processing and the exercise of ARCO rights.

The timing of these measures points to a broader reset of criminal and administrative rules on digital violence, data protection and cyber fraud across different levels of government.