Colombia Recording Laws: All-Party Consent, Penalties & 2025 Updates

Quick Answer: Is Colombia One-Party or All-Party Consent?

Colombia is a de facto all-party consent jurisdiction. No statute uses that exact phrase, but the combined effect of Article 15 of the 1991 Constitution and Article 192 of the Código Penal (Ley 599 of 2000) is that recording a private communication without the agreement of every participant is a criminal offense. Unlike countries that recognize a participant exception, Colombian law does not automatically exempt the person doing the recording simply because they are a party to the conversation. The only recognized exception is the victim-protection doctrine established by the Constitutional Court in Sentencia SU-371/21: a genuine crime victim may record to document the offense against them.

This article covers the law as it stands in Colombia for private individuals, businesses, and US-Colombia cross-border calls. It does not address wiretapping by law enforcement agencies, which operates under separate judicial-authorization rules in Ley 906 of 2004.

Constitutional Foundation: Article 15

Article 15 of the 1991 Colombian Constitution establishes the right to personal and family privacy and declares that correspondence and other forms of private communication are inviolable.

The constitutional text states that private communications "may only be intercepted or recorded pursuant to a court order, following the formalities established by law." This language creates a strong default: no interception or recording without judicial authorization.

Article 15 also guarantees the right to know, update, and rectify personal information held in public and private databases. This provision became the constitutional foundation for Colombia's comprehensive data protection framework enacted through Ley 1581 of 2012.

The Constitutional Court has interpreted Article 15 to apply across all communication methods, including telephone calls, digital messaging, email, and face-to-face conversations conducted in private settings. The protection follows the communication, not the technology used.

Código Penal Articles 192 Through 197: The Core Criminal Offenses

Chapter VII of Title III of the Código Penal (Ley 599 of 2000) is titled "De la Violación a la Intimidad, Reserva e Interceptación de Comunicaciones." It contains the primary criminal provisions governing unauthorized recording and interception in Colombia.

Article 192: Unlawful Violation of Communications

Article 192 is the central provision. It states that anyone who unlawfully removes, conceals, misplaces, destroys, intercepts, controls, or prevents a private communication directed to another person, or who improperly learns of its content, commits a criminal offense.

The base penalty is 16 to 54 months in prison.

If the offender reveals the content of the communication, or uses it for personal gain or to the detriment of another, the penalty increases to 32 to 72 months in prison.

These penalty ranges reflect the increases applied by Ley 890 of 2004, Article 14, which took effect on January 1, 2005.

The language of Article 192 is broad. It covers interception by any means, whether electronic recording, physical eavesdropping, or accessing stored communications. It does not contain an explicit exception for participants in the conversation.

Article 193: Sale or Purchase of Interception Devices

Article 193 addresses the supply chain for surveillance equipment. Anyone who, without authorization from a competent authority, offers, sells, or purchases instruments capable of intercepting private communications between persons faces a monetary fine.

This provision targets the commercial distribution of wiretapping equipment, signal interceptors, and similar devices. The penalty is a fine rather than imprisonment, reflecting the preparatory nature of the offense.

Article 194: Disclosure of Confidential Documents

Article 194 criminalizes the disclosure or use of documents that must remain confidential, when done for personal benefit, for the benefit of a third party, or to the detriment of another person. The penalty is a fine.

This article applies to written and recorded materials that carry legal confidentiality obligations, including intercepted communications that are subsequently shared.

Article 196: Interception of Official Communications

Article 196 applies specifically to official government correspondence and communications. Anyone who unlawfully removes, conceals, misplaces, destroys, intercepts, controls, or prevents an official communication faces 48 to 108 months in prison.

The penalty increases by up to one-third when the intercepted communication is directed to or sent by the Judicial Branch or by state control or security agencies. This enhanced penalty reflects the heightened sensitivity of government communications.

Article 197: Unlawful Use of Communication Networks

Article 197 targets the possession or use of communication network terminal equipment or electronic devices designed or adapted to emit or receive signals for illicit purposes. The penalty is 4 to 8 years in prison (48 to 96 months).

If the conduct is carried out for terrorist purposes, the penalty doubles.

This provision captures the use of cloned devices, rogue base stations, and other technical means of intercepting communications infrastructure.

The Victim Exception: Sentencia SU-371/21

The most significant development in Colombia's recording law came from the Constitutional Court's Sentencia de Unificación SU-371/21, decided in 2021.

This ruling addressed whether recordings made by one participant in a conversation, without the knowledge or consent of the other participant, could serve as valid evidence in disciplinary proceedings. The Court established a framework for evaluating such recordings.

The core holding recognizes a victim-protection exception. When a person is the victim of a crime or disciplinary offense and participates in a conversation related to that offense, they may record the conversation without prior judicial authorization. The recording is admissible as evidence if two conditions are met:

1. The person making the recording is genuinely a victim of the conduct being documented.
2. The specific purpose of the recording is to demonstrate the existence of the crime or disciplinary violation.

This exception is narrow. It does not create a general one-party consent rule. A participant who records a conversation out of curiosity, for commercial advantage, or for any reason other than documenting victimization does not fall within its protection. The Court emphasized that the person's victim status must be demonstrable, and the recording must be tied to the specific wrongful conduct.

Prior to SU-371/21, the Supreme Court of Justice (Corte Suprema de Justicia) had already developed similar reasoning in criminal cases, holding that a victim could record threats, extortion attempts, or other crimes being committed against them. The Constitutional Court's 2021 ruling unified and formalized this doctrine across all judicial and administrative proceedings.

Ley 1273 of 2009: Computer Data Interception

Ley 1273 of 2009 created a new protected legal interest in the Colombian Penal Code titled "De la Protección de la Información y de los Datos" (Protection of Information and Data). This law addresses crimes committed through or against computer systems.

Article 269C of Ley 1273 criminalizes the interception of computer data. Anyone who, without a prior judicial order, intercepts computer data at its origin, destination, or within a computer system, or intercepts electromagnetic emissions from a system transporting such data, faces 36 to 72 months in prison.

The penalties increase by one-half to three-quarters if the interception targets state, official, or financial sector computer networks or communication systems, whether national or foreign.

This provision operates alongside Article 192 of the Código Penal. A person who intercepts a VoIP call, records a video conference without authorization, or captures data from a messaging application could face charges under both statutes. Ley 1273 specifically addresses the digital dimension, while Articles 192-197 cover communications interception more broadly.

Law Enforcement Interception: Ley 906 of 2004 and Decreto 1704 of 2012

Colombian law permits communications interception by law enforcement, but only under strict judicial oversight.

Ley 906 of 2004, the Código de Procedimiento Penal, governs the procedural framework. Article 235 authorizes the Fiscalía General de la Nación (Attorney General's Office) to order the interception of communications through magnetic recording or similar means for the purpose of obtaining material evidence, physical evidence, or locating accused or convicted persons.

The prosecutor must subsequently appear before a judge of guarantees (juez de control de garantías) to legalize the interception once the investigative activity concludes. Judicial Police officers must also provide partial reports when the interception yields information requiring immediate action.

Decreto 1704 of 2012 regulates the operational requirements for lawful interception. It obligates telecommunications providers to:

• Adopt measures ensuring interception is carried out in optimal, timely, and secure conditions.
• Provide subscriber identification data to the Fiscalía when legal requirements are met.
• Supply geographic location data for terminals involved in intercepted communications.
• Maintain subscriber information for five years.
• Guarantee data confidentiality under penalty of criminal and disciplinary sanctions.

All officials with access to intercepted communications are bound by strict confidentiality obligations.

Phone Calls vs. In-Person Conversations

Colombian law does not distinguish between phone calls and in-person conversations when applying recording restrictions. Article 192 of the Código Penal covers any "private communication," and Article 15 of the Constitution protects "correspondence and other forms of private communication" without limiting protection to specific technologies.

A phone call between two people carries the same legal protection as a face-to-face conversation in a private office. A video conference has the same status as a whispered exchange in a closed room. The determining factor is whether the communication is private, not the medium through which it occurs.

For digital communications, Ley 1273 of 2009 adds an additional layer of protection. Intercepting a WhatsApp call, recording a Zoom meeting without consent, or capturing messages from a messaging platform triggers both the traditional communications interception offenses and the computer data interception provisions.

Recording in Public Spaces

Colombian jurisprudence recognizes a graduated scale of privacy expectations based on the physical setting. The Constitutional Court has identified four categories:

• Public spaces: Open areas where privacy expectations are minimal. Recording in a public plaza or on a public street generally does not trigger Article 192 protections.
• Semi-public spaces: Areas with relatively open access where people gather for specific purposes, such as shopping centers or transportation terminals. Privacy expectations are limited.
• Semi-private spaces: Enclosed areas where a defined group engages in a shared activity, such as an office or classroom. Access is restricted and privacy expectations are moderate.
• Private spaces: Areas where individuals develop their personal lives in full privacy, such as homes and private offices. Recording protections are at their strongest.

The key principle is that as the setting becomes more private, the legal restrictions on recording become stricter. Recording a conversation that takes place in a genuinely public setting, where there is no reasonable expectation of privacy, is generally not considered a violation of Article 192. However, recording a conversation between identifiable individuals in a semi-private or private space without their consent falls squarely within the criminal prohibition.

Recording Police and Public Officials

Citizens in Colombia have an explicit statutory right to record police performing their public duties. Ley 1801 of 2016, the Código Nacional de Seguridad y Convivencia Ciudadana, establishes this right in Article 21:

"All police procedures may be recorded through any means of information and communication technologies, and it is prohibited for any person to prevent such recordings except for express restrictions by law."

A police officer who prevents a citizen from recording without a lawful justification commits a disciplinary offense. Colombian courts have classified such prevention as a "most serious fault" that can carry consequences up to dismissal.

The Constitutional Court reinforced this principle in T-260/2012 and T-904/2011, holding that recording a public official performing official functions does not violate the officer's right to privacy, because public acts are not private acts. The constitutional basis spans Article 20 (freedom of information and expression), Article 23 (right of petition), and Article 74 (access to public documents).

Three practical limits apply even when recording police:

1. Do not obstruct the procedure. Recording is a passive act. Physically interfering with an arrest, checkpoint, or inspection transforms the conduct from protected oversight to obstruction.
2. Do not endanger security. Recording a sensitive tactical operation from a position that creates risk to officers or bystanders may cross into restricted territory.
3. Do not impede public mobility. Gathering a crowd specifically to obstruct traffic in the course of recording can result in a citizen security citation unrelated to the recording itself.

Subject to those limits, recording police on a public street, at a traffic stop, during a search, or at a checkpoint is a recognized civic right in Colombia.

Workplace Recording and Ley 1581 of 2012

Ley 1581 of 2012, Colombia's comprehensive data protection statute, has significant implications for workplace recording.

Employers may install video surveillance cameras in the workplace, but only under specific conditions:

• Cameras must not be placed in areas where employees have a reasonable expectation of privacy, such as restrooms, changing rooms, or break rooms.
• Employees must be informed that monitoring is taking place. Notice must be clear and visible.
• The surveillance must serve a legitimate purpose, such as security or occupational safety.
• Captured images and recordings constitute personal data and are subject to all obligations under Ley 1581.

Audio recording in the workplace is treated more restrictively. Employers should avoid capturing audio in work environments except in exceptional and well-documented circumstances. The combination of Article 192 of the Código Penal (which criminalizes unauthorized interception of private communications) and Ley 1581 (which requires prior informed authorization for personal data processing) creates a high legal bar for workplace audio surveillance.

The Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, enforces Ley 1581 and can impose fines of up to 2,000 legal monthly minimum wages (approximately $500,000 USD or more) for violations. Organizations must register their databases containing personal data, including surveillance recordings, with the SIC's National Database Registry (RNBD).

Businesses that record customer calls must obtain prior and informed authorization from the data subject. The authorization must be obtainable by any means that can be verified later. A recorded verbal consent at the beginning of a call, combined with a clear statement of purpose, is the standard practice.

Ley 2197 of 2022: Non-Consensual Intimate Images (NCII)

Ley 2197 of 2022, the Citizen Security Law, added Article 199 Octies to the Código Penal and created a dedicated offense for non-consensual intimate image (NCII) abuse.

The statute covers two distinct prohibited acts:

1. Creation without consent: Filming, photographing, printing, or otherwise creating images, audio, or video with intimate sexual content involving an identifiable adult, without that person's consent.
2. Distribution without consent: Disclosing, sharing, distributing, or publishing intimate sexual images, videos, or audio of an adult without their consent, approval, or authorization.

The base penalty for either act is imprisonment. The law establishes aggravated circumstances that increase the penalty, potentially reaching up to 8 years in prison, in the following situations:

• The content is disseminated with an extortive purpose (threatening to release unless the victim provides money, sexual acts, or other value).
• The perpetrator is or was the victim's spouse, life partner, or intimate partner.
• The content involves fabricated or manipulated material (overlapping with deepfake scenarios).
• The victim is a minor (in which case separate provisions on child sexual abuse material also apply).

The law also mandates that digital platforms share responsibility for prevention and removal. Platforms are required to cooperate with law enforcement and take down non-consensual intimate content when notified.

From a recording-law perspective, the practical implication is this: recording a consensual intimate encounter and later sharing it without the other person's consent is a criminal act under Ley 2197, regardless of whether the recording itself was initially consensual. Consent to be recorded is not consent to have the recording distributed.

Deepfake and AI-Generated Media

Colombia became one of the first Latin American countries to enact criminal legislation specifically addressing AI-generated impersonation with the passage of Ley 2502 of 2025. The law amends Article 296 of the Código Penal (identity falsification) to introduce two significant changes.

First, the use of Artificial Intelligence to commit identity theft is now classified as a criminal aggravating factor. When identity theft is carried out using AI, the applicable fine may be increased by up to one-third.

Second, Ley 2502 provides the first statutory definition of "deepfake" in Colombian criminal law: AI-generated audiovisual content that falsely appears authentic. This definition anchors prosecution of AI-driven impersonation to a concrete legal standard rather than requiring courts to apply general fraud or defamation provisions on an ad hoc basis.

The Office of the Attorney General must implement a traceability system for cases involving AI in identity falsification, enabling the identification of criminal patterns and emerging digital risks.

Pending comprehensive AI regulation: Colombia does not yet have a general AI regulatory framework. Proyecto de Ley 043-2025 Senado, filed in May 2025 by the Ministry of Science, Technology and Innovation (MinCiencias), would designate MinCiencias as the National AI Authority and build a risk-classification framework aligned with OECD principles and the EU AI Act model. The 2024-2025 legislative session closed without enacting the bill; it carries over to the next session.

For recording-law purposes, deepfake audio or video depicting a real person in a private or intimate scenario falls under multiple overlapping provisions:

• Article 192 Código Penal, if the fabricated content is derived from intercepted private communications.
• Article 199 Octies Código Penal (Ley 2197/2022), if the AI-generated content has intimate sexual content.
• Article 296 Código Penal (Ley 2502/2025), if the deepfake is used to impersonate the depicted person.
• Ley 1581/2012, if the creation or distribution involves processing personal data (image, voice, likeness) without consent.

Civil Liability for Unauthorized Recording

Criminal prosecution is not the only legal risk from unauthorized recording in Colombia. The Constitutional Court has recognized that capturing a person's image or voice in a private environment without authorization invades the sphere of constitutionally protected privacy. When such recordings are disseminated, the harm is aggravated.

A victim of unauthorized recording in Colombia has at least four civil or quasi-civil remedies available:

1. Tutela (constitutional protection action): An expedited constitutional petition before any judge, asking for immediate protection of the right to privacy. Courts can order the deletion of recordings, prohibit further distribution, and require the offending party to cease the conduct. Results can be obtained within 10 days.

2. Civil lawsuit for moral damages (daño moral): Under general tort principles recognized by the Constitutional Court and the Consejo de Estado, a person whose privacy was violated by unauthorized recording may seek compensation for emotional distress, reputational harm, and dignitary injury.

3. SIC complaint under Ley 1581/2012: If the recording constitutes unauthorized processing of personal data (image, voice, biometric data), the victim can file a complaint with the Superintendencia de Industria y Comercio. The SIC can impose administrative fines of up to 2,000 legal monthly minimum wages on the data controller.

4. Criminal complaint triggering civil attachment: In criminal proceedings under Article 192 Código Penal or Ley 2197/2022, the victim can assert a civil claim for damages within the same criminal case, potentially recovering compensation alongside the criminal penalty.

There is no statutory cap on moral damages in Colombia; amounts are determined by courts based on the severity of the harm, the degree of dissemination, and the relationship between the parties.

Cross-Border Recording: US-Colombia Calls

Calls between parties in the United States and Colombia raise a layered consent question because two separate legal regimes apply simultaneously.

From the Colombian side: Colombian all-party consent applies to any party located in Colombia at the time of the call. A person in Colombia who records a phone call without the consent of all participants may face prosecution under Article 192 of the Código Penal, regardless of where the other party is located.

From the US side: Under the federal Wiretap Act (18 U.S.C. § 2511), the prohibition on interception applies where the interception occurs. If the recording is made entirely in Colombia, the federal Wiretap Act's interception prohibition may not attach. However, if the recording equipment or interception point is on US soil, federal law applies. The federal baseline is one-party consent: a US party who is a participant to the call may record it without informing the other party, subject to state law. Several US states impose two-party (all-party) consent requirements, including California, Florida, Illinois, Pennsylvania, and Washington.

Practical guidance for US-Colombia business calls:

• If the Colombian party records the call without consent of the US party, the Colombian party faces potential criminal liability under Article 192 Código Penal.
• If the US party records the call without consent of the Colombian party, US federal law may permit it (one-party consent baseline), but the Colombian party could pursue a civil or criminal claim in Colombia.
• The safest approach for businesses is to disclose recording at the start of every call and obtain verbal consent from all parties, regardless of the country of origin. This satisfies both Colombian law and the stricter US state consent laws.
• Customer service centers operating in Colombia that record inbound international calls must obtain authorization before recording, consistent with Ley 1581/2012 and Article 192 requirements.

Penalty Summary Table

Violation	Law	Penalty
Unlawful interception of private communications	Código Penal Art. 192 (Ley 599/2000)	16 to 54 months prison
Interception with disclosure or exploitation	Código Penal Art. 192, paragraph 2	32 to 72 months prison
Sale or purchase of interception devices	Código Penal Art. 193	Monetary fine
Disclosure of confidential documents	Código Penal Art. 194	Monetary fine
Interception of official communications	Código Penal Art. 196	48 to 108 months prison
Unlawful use of communication networks	Código Penal Art. 197	48 to 96 months prison
Unlawful use of networks for terrorism	Código Penal Art. 197, paragraph 2	96 to 192 months prison
Computer data interception	Ley 1273/2009, Art. 269C	36 to 72 months prison
Data protection violations (SIC enforcement)	Ley 1581/2012	Fine up to 2,000 minimum wages
Non-consensual intimate image creation or sharing	Ley 2197/2022, Art. 199 Octies	Up to 8 years (aggravated)
AI-driven identity theft (deepfake impersonation)	Ley 2502/2025, amending Art. 296	Fine increased up to one-third

Business Compliance Checklist

Companies operating in Colombia that handle recorded communications should follow these steps.

Obtain prior authorization for call recording. Before recording any customer or business call, provide a clear notice explaining the purpose of the recording and obtain verifiable consent. A verbal opt-in captured at the start of the call meets this requirement.

Register databases with the SIC. All databases containing recorded communications must be registered with the National Database Registry (Registro Nacional de Bases de Datos). Keep registrations current when the nature or scope of data processing changes.

Limit workplace surveillance to non-private areas. Video cameras may be installed in common work areas, but never in restrooms, changing rooms, or other spaces where privacy is expected. Post visible notices wherever cameras operate.

Avoid audio capture in the workplace. Audio recording of employees should be avoided except in clearly justified and documented circumstances. Obtain legal counsel before implementing any audio monitoring.

Define retention and access policies. Establish written policies governing how long recordings are stored, who may access them, and when they must be deleted. Restrict access to personnel with a legitimate business need.

Implement security measures. Recordings constitute personal data under Ley 1581 of 2012. Apply technical and organizational safeguards including encryption, access controls, and audit logging.

Train employees on compliance. Staff who handle recordings must understand the legal restrictions on unauthorized interception, the requirements for obtaining consent, and the consequences of non-compliance.

Address NCII risk under Ley 2197/2022. If your business operates a platform that allows users to upload content, implement a reporting and takedown mechanism for non-consensual intimate images. Platforms that fail to respond to verified reports face potential liability under the law's platform responsibility provisions.

Monitor AI legislation. Proyecto de Ley 043-2025 Senado, if enacted, will impose new obligations on companies that develop or deploy AI systems in Colombia. Businesses using AI for voice synthesis, image generation, or identity verification should track this legislation closely.

Legal information notice: This article presents general legal information about recording consent laws in Colombia. It is current as of May 2026 and is based on publicly available primary sources from Colombian government and court publications. This article does not constitute legal advice and does not create any attorney-client relationship. Laws and interpretations change; consult a lawyer licensed in Colombia for advice specific to your situation.