Understanding how LFPDPPP and REPEP affect SMS in Mexico

You will learn

Learn about best practices for SMS marketing in Mexico and how to comply with Mexican data protection and anti-telemarketing regulations.

The following regulations apply to SMS marketing in Mexico:

• Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP)
• Registro Público Para Evitar Publicidad (REPEP) — Mexico's national do-not-call/do-not-text registry
• Ley Federal de Protección al Consumidor (LFPC)

SMS compliance in Mexico

There are a number of compliance dos and don'ts for SMS marketing in Mexico:

Do:

• Obtain explicit, informed consent from recipients before messaging them.
• Register your sending numbers and SMS programs with carriers via Klaviyo.
• Check the REPEP registry and exclude registered numbers before every send.
• Allow recipients to easily opt out at any time.
• Only send during permitted daytime hours.
• Clearly identify your brand or organization in every message.
• Maintain accurate consent records in accordance with LFPDPPP.

Do not:

• Send to recipients whose numbers appear on the REPEP registry.
• Include prohibited content in your messages.
• Contact consumers outside permitted sending hours.
• Use deceptive or misleading messaging that violates LFPC consumer protection rules.

The following sections explain these practices in more detail.

Obtain explicit consent

When collecting consent in Mexico, you must provide a clear explanation — via an Aviso de Privacidad (Privacy Notice) — of how you plan to use the subscriber's personal data. Under LFPDPPP, consent must be free, specific, informed, and unambiguous.

Double opt-in is strongly recommended as a best practice to clearly demonstrate that consent has been properly obtained. Customers using Branded Sender IDs should consider using Smart Opt-in for collecting SMS consent.

When asking for consent:

• Make it easy for recipients to opt out.
• Provide a link to your Aviso de Privacidad (Privacy Notice) and terms of service.
• Be clear about what personal data you are collecting and the purpose for which it will be used.
• Be clear about what subscribers are subscribing to (e.g., promotional texts, order updates).
• Ask for separate consent for each communication channel — if you collect consent for both SMS and email, use distinct fields so subscribers can choose one without the other.
• Ensure the subscriber takes an active step (e.g., checking an unchecked box) to give consent — pre-ticked boxes are not valid.
• Do not make consent a condition of purchasing a product or service.
• Do not collect SMS consent from individuals under 18 years of age unless you have documented parental or guardian authorization.
• Keep accurate, auditable records of when, where, how, and for what purpose each subscriber gave their consent, as required by LFPDPPP.

Check and honor the REPEP registry

REPEP (Registro Público Para Evitar Publicidad) is Mexico's national registry that allows consumers to opt out of receiving unsolicited commercial communications, including SMS messages. It is administered by PROFECO (Procuraduría Federal del Consumidor) and overseen in part by SABG (Secretaría Anticorrupción y Buen Gobierno).

As a sender, you are legally required to:

• Consult the REPEP registry before initiating any unsolicited commercial SMS campaign.
• Remove from your send list any phone number that appears on the REPEP registry.
• Re-check the registry at least every 30 days, or before each new campaign, to capture newly registered numbers.
• Retain documentation of each REPEP consultation as evidence of compliance.

Only send during permitted hours

In Mexico, SMS marketing messages must not be sent too early in the morning or late at night. Sending outside permitted hours may expose you to complaints filed with PROFECO and sanctions under the LFPC.

Send in the recipient's local time zone (Mexico has multiple time zones — Central, Mountain, and Northwest) and avoid sending:

Mexican federal public holidays include January 1, February 5, March 21, May 1, September 16, November 20, and December 25, among others. Consult PROFECO guidance for the current official list.

Identify your brand or organization

Each SMS message you send to recipients in Mexico should clearly identify you as the sender. Failure to identify the sender may constitute a deceptive commercial practice under the LFPC.

Many companies do this by either:

• Customizing their sender ID (when using branded sender IDs).
• Including their organization name at the start of each message (when using long codes or short codes).

When using Klaviyo SMS, you can customize your sender ID under Settings > SMS and automatically add your organization's name to the start of each SMS in the message editor by selecting the option in the Compliance tab (this is turned on by default).

Do not include prohibited content

Wireless carriers may refuse to deliver SMS messages that reference or otherwise contain content relating to certain topics, including:

• Illegal substances
• SHAFT content:
• Sex
• Hate speech or discriminatory content
• Alcohol
• Firearms
• Tobacco (including CBD and vaping products)
• Gambling and lotteries
• Sweepstakes
• Debt collection or debt forgiveness schemes
• High-risk financial services (e.g., cryptocurrency, unauthorized lending)
• Multi-level marketing
• Fireworks and pyrotechnics

While not all of these topics are prohibited in every context, carriers periodically reassess what content they will allow and do not always make this information public promptly. It is best to avoid content related to these topics in any campaign.

Anything related to these prohibited topics — in either your messages or your linked website — may result in those messages being filtered by the carrier or the carrier completely blocking the sending number.

Allow people to opt out easily

Each SMS message you send to recipients in Mexico must include a clear and easy opt-out mechanism. This is required both under LFPDPPP (which grants individuals the right to revoke consent at any time) and under consumer protection principles enforced by PROFECO.

When creating an SMS in Klaviyo's message editor, the unsubscribe link is added automatically to your messages via the option in the Compliance tab.

Do not contact users on REPEP or equivalent registries

As a firm requirement under Mexican law, do not contact any consumer whose phone number appears on the REPEP registry with unsolicited commercial messages. Violations can result in:

• Formal complaints to PROFECO and subsequent administrative investigations.
• Fines and sanctions issued by PROFECO under the LFPC.
• Data protection complaints to SABG where personal data has been misused.
• Reputational damage and carrier-level blocking of your sending numbers.

PROFECO makes the REPEP registry available to businesses for download. Integrate REPEP checks into your list hygiene process and verify numbers before every campaign send.

Additional resources