On April 7, 2026, PRI deputy Yericó Abramo Masso filed an initiative in Mexico's Chamber of Deputies—published in the Gaceta Parlamentaria on April 29, 2026—to overhaul the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) to confront non-consensual sexual deepfakes. It is the latest move in a fast-moving Mexican response to synthetic intimate imagery, and it deserves both credit for its aim and scrutiny for its design.
What the initiative proposes
The bill rests on five axes. First, it reclassifies a person's images, video, audio, voice, facial features, biometric data and other identifiable elements as sensitive personal data whenever those elements can be used to generate synthetic intimate or sexual content. Second, it introduces statutory definitions of "generative artificial intelligence" and "non-consensual synthetic sexual content." Third, it requires express, prior, informed, specific, written and separate consent for any processing aimed at producing intimate or sexual content. Fourth, it creates expedited blocking, cancellation and deletion rights for this kind of unlawful processing. Fifth, it adds new administrative infractions and a specific criminal penalty inside the data-protection law itself (SIL legislative file).
The case for acting
The strongest argument for the bill is simple and serious: non-consensual deepfake pornography is a fast-spreading form of gender-based abuse, and Mexico's existing data framework was not built for it. The 2010 LFPDPPP—and even the sweeping reform that replaced it on March 21, 2025—treats biometric data as sensitive but says nothing about the synthetic generation of a person's likeness (Greenberg Traurig). A consent-anchored rule that explicitly forbids using someone's face or voice to fabricate sexual content closes a genuine gap, gives victims a defined deletion right, and signals that a likeness is not free-floating raw material for any model that scrapes it. For survivors, an expedited takedown right inside data-protection law could be faster than a criminal complaint.
Why the data-protection frame strains
The trouble is that the instrument fits the harm awkwardly. Declaring images, voice and facial features "sensitive data" whenever they could be used to generate sexual content defines a data category by a hypothetical future misuse rather than by the data itself. Nearly every photograph and voice recording of a person is, in principle, raw material a generative model could abuse. A category that broad invites two failure modes: it either becomes a dead letter that no one can comply with, or it sweeps in legitimate uses—satire, journalism, consumer voice tools, lawful synthetic-media production—that have nothing to do with non-consensual abuse.
The better-targeted regulatory object is the conduct: creating or distributing sexual depictions of a real person without consent. Mexico, notably, has already legislated on exactly that conduct. In February 2026, Congress reformed the General Law on Women's Access to a Life Free of Violence and the Federal Penal Code to criminalize AI-generated intimate content, with prison terms of one to three years for related sexual harassment (Mexico Business News). Layering a second, parallel criminal penalty into the LFPDPPP risks duplicative offenses, inconsistent thresholds, and the kind of legal uncertainty that helps neither victims nor defendants.
The enforcement gap nobody should ignore
Proportionate regulation depends on a regulator capable of administering it. Here Mexico has a structural problem. The 2025 reform dissolved the autonomous data-protection authority, INAI, and transferred its functions to Transparencia para el Pueblo, a body inside the executive's anti-corruption ministry that lacks INAI's independence and, by most accounts, absorbed the bulk of its mandate with a fraction of its staff (Greenberg Traurig). Handing a criminal-adjacent deepfake regime to a downsized, executive-controlled office raises two risks at once: that urgent victim complaints stall for want of capacity, and that a politically directed regulator wields a vague "sensitive data" power selectively. A reform that creates strong rights on paper but routes them through a weakened enforcer can offer false comfort.
The experience elsewhere counsels humility about hastily drafted privacy text. As EFF argued in May 2026 about the U.S. SECURE Data Act, a bill can carry the privacy label while actually weakening protection through loose definitions and carve-outs (EFF). Good intentions do not substitute for precise drafting.
A more proportionate path
None of this argues for inaction. It argues for a tighter design. Lawmakers should: (1) anchor liability in the non-consensual act of creating or sharing synthetic sexual content, harmonized with the February 2026 penal reforms rather than duplicating them; (2) define "non-consensual synthetic sexual content" narrowly enough to spare satire, journalism and consensual or clearly-labeled synthetic media; (3) keep the expedited takedown and deletion right—its best feature—while ensuring it cannot be abused as a generalized censorship tool; and (4) pair any new mandate with real enforcement capacity and procedural safeguards at Transparencia para el Pueblo.
Mexico is right to treat a person's likeness as something more than free training data. The goal now is to protect victims without declaring every face and voice a regulated substance—and without writing rights that a hollowed-out regulator cannot deliver.