Data protection in Mexico and AI agents on WhatsApp: what the 2025 law requires

In March 2025 Mexico replaced its private-sector personal data law. The new Federal Law on the Protection of Personal Data Held by Private Parties was published in the Official Gazette (DOF) on March 20, 2025, took effect the next day and repealed the 2010 law. If your business answers on WhatsApp with an AI agent, the law applies just as if a person were replying: processing includes automated procedures (article 2, section XIX).

Who is who?

The law calls the private party processing the data the controller (responsable) and anyone processing it on the controller’s behalf the processor (persona encargada, article 2, section XII). If your company uses a platform to run its agent, your company is the controller. Sharing data with the processor is not a transfer (article 2, section XX); sharing it with other third parties is, and requires giving them your notice and its purposes (article 35).

What does the law require in a conversation?

Duty	Article	In a chat with an agent
Privacy notice from the moment you collect data	2(I) and 16	The short notice and a link to the full one, up front
Consent	7	Implied as a general rule, once the notice is available
Financial or property data	7	Express consent, except under arts. 9 and 36
Sensitive data	8	Express and written, with a signature or authentication mechanism
Withdrawing consent	7	The notice explains how
Data protection person or department	29	Someone who handles the requests
ARCO rights	27 to 34	Answer within 20 business days and effect within 15, each extendable once
Security	18	Administrative, technical and physical measures

What changes when an AI agent is the one answering?

Two articles weigh more than the rest:

1. Objection to automated processing. Article 26, section II, lets people object when automated processing produces unwanted legal effects or significantly affects their interests, assessing personal aspects without human involvement. It is the person’s right, not a duty to review everything, but if your agent decides something with consequences for someone, such as turning down a credit application, it is wise for that decision to go through a person.
2. Financial data. Financial or property data require express consent, except under articles 9 and 36, such as data needed for a legal relationship with the person. The better design is not to ask for a card in the chat: let the payment happen in the payment gateway.

How Meteor does it

• You tell the Met how to greet. The Met’s prompt is content in your workspace: that is where you instruct it to share the short notice and the link to your full privacy notice.
• The record, on the contact. The Met can leave a note or a tag on the contact in the CRM with what they were told and when. Do not rely on the history alone: Meteor’s Terms keep conversation records while the account has an active plan and for up to 30 days after, unless you configure another retention.
• Handing over to a person is a Met tool: an ARCO request or a decision with consequences goes to your team. The WhatsApp agent page explains how that happens without losing context.
• Payment outside the chat. With Mercado Pago, the Met shares the Checkout Pro link and confirms payment through a signed webhook: the chat never receives card data.

The Mexico page (in Spanish) shows the connections available in the country. What Meteor does not do for you: write your privacy notice or appoint your data protection lead.

What this is not

This is not legal advice. The law is cited by article from its current text as published by Mexico’s Chamber of Deputies, accessed on October 28, 2026. Before adjusting your notice, review it with a lawyer in Mexico.