IFT guidelines and consent: what you need to send commercial SMS legally in Mexico

Sending commercial SMS in Mexico is legal, but it comes with rules: demonstrable consent, a privacy notice, an opt-out mechanism and respect for exclusion lists. This guide summarises what your company has to comply with.

Why compliance matters more than it looks

SMS is a regulated channel in Mexico on several fronts: consumer protection, personal data protection and telecommunications. Non-compliance does not only expose you to fines; it also damages the sender reputation with the operators, who can filter or block traffic. And a contact base that receives unsolicited messages deteriorates fast.

This article is a practical guide, not legal advice. Every company should validate its own case with its legal team, especially in regulated sectors such as banking and insurance.

The legal framework in four pieces

The Federal Consumer Protection Law (LFPC) regulates advertising and commercial communications, and gives the Federal Consumer Protection Agency (PROFECO) authority over the Public Registry to Avoid Advertising (REPEP), where anyone can register their number to stop receiving advertising. Providers are required to honour it.

The Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP) governs the processing of a phone number as personal data: it requires a privacy notice, a stated purpose and, for marketing purposes, the consent of the data subject, who can revoke it at any time.

The Federal Telecommunications Institute (IFT) regulates the operators and issues guidelines on network use, including those covering short messages, service codes and practices to prevent abuse of the channel. Operators pass those obligations on to messaging providers and their customers through their traffic policies.

Finally, sector-specific rules: banking, for example, has specific CNBV provisions on authentication and customer notifications that shape how and when certain messages are sent.

Consent: how to obtain it and how to prove it

Consent for commercial SMS must be prior, informed and demonstrable. Prior: before the first commercial message. Informed: the person knows they will receive SMS communications and for what purpose. Demonstrable: you can evidence when, how and for what it was given.

In practice this is solved with a specific checkbox on the sign-up form or in the contract (not pre-ticked), a clear clause in the privacy notice, and a record of the date, source and wording of the consent for every contact. Lists bought from third parties, or collected without this process, do not meet the requirement no matter how valid the numbers are.

Transactional versus commercial messages

Not every SMS requires marketing consent. Transactional or informational messages arising from an existing relationship (an OTP code, a purchase confirmation, a charge alert, a parcel delivery notice) rely on that relationship and on the privacy notice. What does require specific consent is any message with a commercial or promotional purpose.

The common mistake is mixing the two: adding an offer inside an informational message turns it into a commercial one. If you want to use the channel to sell, do it in separate messages and only to people who authorised it.

Obligations when sending

• Clearly identify the sending company in the message text.
• Offer a simple, free opt-out mechanism and honour it immediately.
• Check the list against REPEP and against your own exclusion list before every campaign.
• Respect reasonable hours and avoid abusive frequency.
• Do not use deception in the sender or the content (impersonation, false urgency, non-existent prizes).
• Keep records of sends, deliveries and opt-outs; they are your evidence if a complaint is filed.

The Grupo Tecnophone platform makes several of these obligations easier: per-project exclusion lists applied automatically, inbound opt-out replies, scheduling by time window, per-message delivery reports and full traceability of every send.

Penalties and operational risk

Fines for breaching the LFPC and the LFPDPPP can be significant and are calculated on the basis of severity and repeat offences. But the most immediate risk is usually operational: operators detect abuse patterns (high rejection rates, user complaints, misleading content) and block the sender traffic, which also affects the transactional messages you genuinely need to deliver.

Working with a provider that operates under the IFT guidelines, with direct routes and clear traffic policies, is the best way to keep the channel healthy over the long term. If you have questions about your own case, you can contact the Grupo Tecnophone team.

Frequently asked questions