Mexico, Brazil and Chile move digital laws

Mexico reached August 2026 without a Federal Cybersecurity Law published in the Official Gazette. The bill introduced on April 30, 2025 by Luis Donaldo Colosio Riojas and Lucía Trasviña Waldenrath remains pending in the Senate. Meanwhile, the 2025 reform to the Federal Law on Protection of Personal Data Held by Private Parties is now the main mandatory framework for companies that process personal data.

What is happening in Mexico with the digital agenda?

Mexico's debate is moving on several fronts at once. In Mexico City, Clara Brugada announced a bill on Digital Rights for Children and Adolescents, along with a Digital Pact package aimed at reducing problematic cellphone use. On September 17, a dialogue process will begin with students, families and teachers to co-design the school regulation and the content of the bill.

The Mexico City proposal focuses on privacy, digital security, personal data protection and information on how algorithms work. Other local reporting says it will also include a digital rights charter, complaint mechanisms for digital violence and manipulative commercial practices, as well as participatory forums in schools and measures such as lockers to store cellphones during the school day, talks on campus, prevention campaigns and digital well-being programs.

At the same time, Zacatecas is reviewing a bill by state lawmaker Ma. Teresa López García to amend the Transparency Law and the Personal Data Protection Law for entities subject to the state's authority. The stated goal is to align them with general laws, replace outdated organizational references and recognize Transparencia para el pueblo de Zacatecas as the legal authority on the matter, bringing its powers into line with a March 2025 federal decree.

How is Brazil moving with the LGPD?

Brazil is considering Bill 3278/26 in the Chamber of Deputies to amend the LGPD and require digital platforms, social networks and other services that process personal data at scale to display a simplified notice with essential information on data use.

The proposal covers commercial purposes, sharing with third parties, use to train artificial intelligence systems, processing of sensitive data, retention periods and a simplified deletion process. Other reporting on the same bill says ANPD will design those notices and will also set rules on the classification of trackers and the difference between resources needed for a service to function and those used for advertising purposes. The text will next undergo final review in the Communication and Constitution, Justice and Citizenship committees.

At the same time, on August 21, 2026, ANPD launched a targeted review of 22 entities, including social networks, public platforms, app stores and generative AI tools such as Copilot, Claude, DeepSeek, Gemini, ChatGPT, Meta AI and Perplexity. The goal is to check governance, transparency, risk management and user protections required under the updated Marco Civil da Internet and the ECA Digital. The entities have 10 business days to respond in two separate administrative proceedings. Other Brazilian reporting adds that platforms accessible to minors must publish transparency reports before September 17, 2026.

What is under discussion in Chile?

Chile has two open debates and one law still waiting to take effect. The Secure Digital Environments bill remains in its first constitutional review in the Future, Science, Technology, Knowledge and Innovation Committee, and the government has said it will introduce amendments to restart the discussion. The bill seeks to protect children and adolescents from risks tied to the use of digital platforms.

The debate includes technical suggestions from the Ministry of Social Development and Family, as well as options such as age-verification systems. It is also linked to student demands for more training and digital education. According to independent reporting, the executive branch is also promoting a National Plan for Secure Digital Environments with legislative urgency for the bill.

On another front, the Chamber of Deputies approved in general a bill on content generated with artificial intelligence and deepfakes, backed by lawmaker Gael Yeomans. The proposal introduces the concept of digital integrity as a right that protects image, body and voice, even after death. It requires AI-generated content to be labeled, demands that reported material be removed within a maximum of 72 hours, obliges platforms to have a legal representative in Chile and includes fines of between 5,000 and 10,000 UTM.

At the same time, the new Personal Data Protection Law, passed by Congress in August 2024, still has not taken effect. The executive branch is in talks with lawmakers to present a bill that would delay implementation by one year, originally scheduled for December 1, 2026. The future Personal Data Protection Agency would begin operating on that same date.

What is happening in Ecuador and Paraguay?

Ecuador continues to enforce its Organic Personal Data Protection Law, and the Superintendency of Personal Data Protection has been adding complementary rules between 2025 and 2026. That agenda includes resolutions on data transfers, large-scale processing, risk management, privacy by design and, in 2026, a specific general rule for the use of AI systems that process personal data, published on March 10.

The Ecuadorian law also requires security incidents affecting personal data to be assessed, documented and reported, and classifies failure to notify as a serious violation. The source reviewed does not mention any amendments to the text under review in 2026.

In Paraguay, the Senate's official site lists laws in force such as 5189/2014 and 5282/2014, but it does not identify a specific new personal data protection or cybersecurity bill under review for 2024 through 2026. Even so, public debate is already citing Law No. 7,593/2025 on Personal Data Protection as a framework for discussing the use of artificial intelligence that can record and analyze conversations, with emphasis on consent and each person's right to control the circulation of their data.

What does this regional map show?

The regional picture shows different speeds. Mexico is still waiting for a federal cybersecurity law, Brazil is pushing changes to the LGPD and tightening oversight of platforms and AI, Chile has a delay under consideration for its new data law and parallel bills on digital environments and deepfakes, while Ecuador is consolidating complementary regulation around its existing law and Paraguay is discussing its new data framework in the public sphere.