Mexican Football Federation fined 42.8 million pesos over Fan ID data violations

Mexico’s Secretaría Anticorrupción y Buen Gobierno imposed a fine of 42.8 million pesos (about 2.3 million USD) on the Federación Mexicana de Fútbol (FMF) for breaching personal data‑protection law in the operation of its Fan ID system. The authority found that the federation failed to inform fans that the photographs collected for Fan ID constitute sensitive personal data and did not obtain the explicit, written consent required for processing such data.

The penalty was calculated based on the seriousness of the infractions, the sensitivity of the biometric information involved, and the FMF’s economic capacity as reflected in its 2024 tax declaration. The FMF may appeal the sanction. Fan ID, introduced after violent incidents at Liga MX stadiums, is a mandatory biometric identification tool used to control stadium access during events such as the 2026 World Cup. A statement from the agency warned that “this omission prevented the data subjects from knowing the real scope of the treatment of their personal information and deciding informedly about its use.”