Mexico’s new tax rules unsettle internet companies as government demands real‑time data access

Digital platforms in Mexico are preparing to establish a permanent, real-time digital connection onlinewith the tax authorities. Starting April 1, companies like Amazon and Mercado Libre will be required to share internal data with Mexico’s Tax Administration Service (SAT), which intends to use this bridge to strengthen its oversight of the lucrative online economy. The industry warns, however, that the measure could open backdoors for cybercrime and put sensitive user and business information at risk.

The change stems from the 2025 amendment to the Federal Tax Code, which has sparked controversy in the sector following the reform of Article 30-B. This provision stipulates that taxpayers providing digital services must grant tax authorities “permanent, real-time online access only to the information necessary to verify compliance with tax obligations, as recorded in their systems or records.” When asked about the reform, the Digital Transformation and Telecommunications Agency referred EL PAÍS to the SAT. Gari Flores, the SAT’s general administrator for Revenue Collection, says in an interview that this is the same information companies already submitted monthly, but that now “direct access” will be established, so authorities can view the “data in real time.”

The information, he explains, includes: the type and number of sales transactions, the type and origin of the products, whether they were subject to foreign trade taxes, and whether they carry tariff restrictions. The obligation applies to all platforms where a digital transaction occurs: from e‑commerce sites to vacation‑rental platforms and mobility apps, as well as delivery services and small and medium‑sized businesses that sell online. “The two main goals are to increase tax collection and reduce tax evasion through platforms, and to improve control over smuggling,” Flores adds.

However, for representatives of the digital economy, the root of the dispute lies precisely in the direct connection the measure would grant the authorities. For Julio Vega, director general of the Internet MX Association, integrating high‑traffic platforms in real time with government systems will create weak points and back doors that criminals can easily exploit. “These are situations that affect the user, the citizen, and put us at risk,” he says. “We have seen that institutions like the Tax Administration Service itself have been compromised and have suffered losses of their users’ personal data, which is now in the hands of organized crime.”

Security firms documented that at the end of January a massive hack compromised agencies including the tax service, the Mexican Social Security Institute (IMSS), the federal government, state and municipal governments, and even political parties such as Morena. That information typically ends up feeding databases used by fraud and extortion networks.

The Internet MX Association — whose members include AWS, TikTok, and online stores of major retail brands — says the sector did manage to negotiate wording that limits the article to strictly fiscal data, but discussions with the SAT continue regarding implementation and the fine print. “We have reviewed, hand in hand with the sector, how the connection will be made: first, that the implementation is not too costly, and second, that it complies with all the information security and cybersecurity standards that we have at the SAT, which are the highest standards,” says Flores. “There will be no connection of any kind with anyone until we are completely sure that these international standards are met.”

Who will safeguard the data?

The sector also sees this new provision as an escalation in the regulation of internet companies at a time when the government of Claudia Sheinbaum is seeking to expand tax collection amid tight public spending. The rule states that noncompliance will result in the temporary blocking of platforms — something the industry fears could amount to activating a kill switch, taking websites offline until the SAT clarifies the reasons for the alleged violations.

A source at Amazon with direct knowledge of the matter adds that the company — along with other major U.S. tech firms operating in Mexico — has informed the government of its concerns, reminding officials that its operations are protected under the free‑trade principles of the USMCA. Excessive pressure on the day‑to‑day functioning of companies could be perceived by the Donald Trump administration as running counter to the agreement, the source says. Even so, the source dismisses the idea that Amazon will scale back its ambitious investment plans in the country, noting that the double‑digit growth of e‑commerce makes Mexico a highly profitable market. A request for comment sent to Amazon was not answered in time for publication. Mercado Libre, another multinational that has previously expressed caution over the tightening of tax rules, declined to comment on this occasion.

Faced with the urgency of the new rule taking effect in less than two months, additional concerns have emerged. While technical teams work to define the necessary adjustments to digital architecture, legal consultants are racing against the clock to determine whether sharing this information live would violate contracts or expose business models and trade secrets.

Érika Mendoza, business director at Identy.io, a company that provides identity‑protection services to other businesses, explains that the biometric‑security industry is waiting for “clear rules” on how — and by whom — access to this connection within the SAT will be granted, noting that it is people, not systems, who are the source of leaks. “We are migrating to a world where digital activity has become increasingly integrated into the daily lives of Mexicans. It is clear that, if the goal is better tax oversight, the SAT has the right to use the information derived from these platforms,” says the expert. “Now, the ‘what’ has been defined; what needs to be worked out is the ‘how’ and the ‘who.’”

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition