Costa Rica Recording Laws: One-Party Consent, Penalties & 2026 Updates

Quick Answer: Is Costa Rica One-Party or Two-Party Consent?

Costa Rica is a one-party consent country for the act of recording itself. A participant in a conversation, whether in person, over the phone, or through a digital platform, may record that conversation without informing or obtaining permission from the other party.

This framework rests on the structure of Article 198 of the Código Penal, which criminalizes recording "the words of another person not intended for the public, without that person's consent." When you are a participant, the words are directed to you. The statute targets outside interception, not participant capture.

Where Costa Rica diverges from more permissive one-party regimes is in what happens after the recording is made. Recording the conversation may be lawful, but publishing it, sharing it widely, or distributing it to uninvolved parties can trigger criminal liability under Articles 201 and 202 of the Código Penal unless the content qualifies under a recognized public interest exception.

The Sala Constitucional confirmed in Resolutions 2022-007502 and 2022-020707 that recordings voluntarily provided by a participant are admissible as evidence and that media publication is justified when recordings address matters of public interest, public function, or justice needs.

Constitutional Foundation: Article 24

The starting point for all recording and privacy law in Costa Rica is Article 24 of the 1949 Political Constitution. It reads, in part:

The right to intimacy, to freedom and to the secrecy of communications is guaranteed. The private documents and the communications, written, oral or of any other type, of the inhabitants of the Republic, are inviolable.

The article goes further. Only courts may authorize seizure or examination of private documents, and only when "absolutely indispensable" to resolve matters before them. Any law permitting such exceptions requires a two-thirds supermajority vote in the Legislative Assembly. This supermajority requirement is why both Ley 7425 (1994) and Ley 8754 (2009) underwent heightened legislative scrutiny before passage.

Article 24 also contains an evidence exclusion rule with constitutional force: "The correspondence stolen or the information obtained as a result of the illegal intervention of any communication will not produce legal effects." Illegally obtained recordings are inadmissible in court. This constitutional exclusion applies to third-party intercepts, not to participant recordings.

The Sala Constitucional has applied Article 24 in a body of jurisprudence that clarifies how private recordings interact with freedom of expression and the press:

• Resolution 2022-007502 (April 1, 2022): The court rejected an amparo challenge and held that no constitutional violation occurred when a participant voluntarily provided their own recording as evidence. The court stated the conversation "was delivered freely and voluntarily by the accuser to substantiate the facts she reported."
• Resolution 2022-020707 (September 6, 2022): The court rejected an amparo challenging media broadcast of telephone intercept audio related to a drug trafficking investigation. The tribunal held that reproduction of image and voice is constitutionally justified when it involves "the notoriety of the person," "public function," "justice needs," or "facts, events or ceremonies of public interest."

These two rulings form the constitutional spine of the public interest doctrine described further below.

Código Penal: The Criminal Statutes That Govern Recording

Costa Rica's Código Penal (Criminal Code, Law No. 4573 of 1970, as amended) addresses recording and communications privacy in Title VI, covering crimes against the sphere of intimacy (Delitos Contra el Ámbito de Intimidad). A significant 2012 reform to Section VIII raised penalties for Articles 196 and 196 bis substantially. Always consult the in-force text on pgrweb.go.cr rather than secondary sources that may cite the pre-2012 figures.

Article 196: Violation of Correspondence or Communications

Article 196 is the broadest provision. It punishes anyone who, without authorization and with danger or harm to another's privacy, seizes, accesses, modifies, alters, suppresses, intercepts, opens, delivers, sells, redirects, or diverts documents or communications directed to another person.

Base penalty (in-force since the 2012 reform): 3 to 6 years in prison.

Aggravated penalty: 4 to 8 years in prison when the violation is committed by personnel responsible for handling mail or document delivery, system administrators with network access, or employees of communication providers.

Article 196 contains a public interest exception. Information of public interest and documents already in public databases may be published without triggering the penalty. This statutory carve-out has proven consequential in recent high-profile cases.

Note: Secondary sources, including some legal databases and commentary published before 2012, cite this article as carrying 1 to 3 years. That was the pre-reform figure. The 2012 reform text reads "prisión de tres a seis años" at base, which is significantly higher.

Article 196 Bis: Violation of Personal Data

Article 196 bis targets the unauthorized handling of personal data stored in computer or telematic systems. Prohibited conduct includes accessing, copying, transmitting, publishing, broadcasting, collecting, using, intercepting, retaining, selling, buying, or diverting personal data or images without the holder's authorization.

Base penalty (in-force since the 2012 reform): 3 to 6 years in prison.

Aggravated penalty: 4 to 8 years in prison when committed by system administrators, when the data concerns minors, or when it involves sensitive information such as ideology, religion, health status, racial origin, or sexual orientation.

This provision is directly relevant to digital recordings stored on servers, cloud platforms, or corporate databases. Accessing someone's stored voice or video recordings without authorization falls within its scope. AI-processed or stored biometric data derived from recordings also falls within the "personal data in telematic systems" definition.

Article 198: Unauthorized Recording of Private Communications

Article 198 is the core recording offense. It prohibits three forms of conduct:

1. Recording the words of another person that were not intended for the public, without that person's consent.
2. Using technical means to listen to or intercept private communications not directed at the listener.
3. Installing apparatus or instruments designed to intercept or prevent oral or written communications, regardless of whether interception succeeds.

Penalty: 1 to 3 years in prison.

The critical qualifier is "words of another not intended for the public." When you participate in a conversation, the words are directed to you. The prohibition targets someone outside the conversation capturing words meant for others. This is the textual basis for Costa Rica's one-party consent principle.

Article 200: Aggravated Circumstances

When violations of Articles 196, 196 bis, or 198 are committed by a public official exercising official functions, or by an employee of a public or private communications entity exploiting their position, the penalty increases to 2 to 6 years in prison.

Courts also have discretion to apply the aggravated range when the person who obtained the recording publishes the information, depending on the circumstances.

Article 201: Improper Use of Communications

A person who misuses stolen, reproduced, or unlawfully obtained correspondence, recordings, or communications of any kind faces 6 months to 1 year in prison.

This article most directly restricts what you may do with a recording after making it. Even if the underlying recording was lawful because you were a participant, sharing it in ways that harm the other party's privacy can constitute improper use.

Article 202: Unauthorized Disclosure

Publishing private correspondence or recordings that you lawfully possess, without proper authorization from the other party, carries a penalty of 30 to 100 days fine (day-fine system).

Article 203: Divulgence of Professional Secrets

Professionals who reveal confidential information learned through their work face 1 month to 1 year in prison or 30 to 100 days fine. Public officials and regulated professionals may also face disqualification from their position for 6 months to 2 years.

Ley 7425: Judicial Intercepts and State Surveillance

Law No. 7425, enacted August 9, 1994, governs when the state may intercept private communications. Its full title is the Law on Registration, Seizure, and Examination of Private Documents and Intervention of Communications. The law implements Article 24 of the Constitution by specifying when courts may authorize surveillance, what procedures apply, and what penalties govern official abuse.

When Judicial Intercepts Are Permitted

Under Article 9 of Ley 7425, courts may authorize interception of oral, written, or other communications, including fixed, mobile, wireless, and digital telecommunications, only when investigating specific serious crimes:

• Extortion and kidnapping
• Aggravated corruption and public corruption offenses
• Human trafficking and smuggling of migrants
• Drug trafficking (under Ley 7786)
• Qualified homicide and genocide
• Terrorism
• Aggravated pimping and production of pornography involving minors
• Organ trafficking

The law requires "sufficient indications" of criminal activity before authorization can be granted. Fishing expeditions are not permitted.

Procedural Requirements

Article 10 requires the judge to issue a "founded resolution" (resolución fundada) at the request of the Fiscal General (Attorney General). The judge may conduct the interception personally or delegate to judicial investigators who must provide written reports. Decision timelines are 3 days for ordinary cases and 5 days for organized crime matters.

Article 11 requires that the authorization or denial be documented in a reasoned resolution. If interception is ordered, the ruling remains confidential until the interception concludes and results are incorporated into the case file.

Duration Limits Under Ley 7425

Article 12 caps initial interception at 4 months. In cases of "extreme gravity," the judge may authorize up to two additional 4-month extensions. The absolute maximum under Ley 7425 is one year of continuous interception.

Ley 8754: Expanded Authority for Organized Crime

Ley 8754 (Ley contra la Delincuencia Organizada), enacted July 22, 2009, expands wiretap authority for organized crime investigations beyond what Ley 7425 provides. Article 15 authorizes courts to order communication interception by reasoned resolution. Article 16 extends coverage to 17 crime categories, including sexual exploitation, money laundering connected to serious crimes, and international crimes not listed in Ley 7425.

The critical procedural difference from Ley 7425 is duration. Under Ley 8754, the interception period may be up to 12 months and may be renewed for additional 12-month periods with prior judicial authorization. Unlike Ley 7425's absolute one-year cap, Ley 8754 permits successive renewals for active organized crime investigations.

Penalties for Officials Who Abuse Intercepts

Article 24 of Ley 7425 imposes 1 to 3 years in prison on judges or officials who disclose intercepted information for unauthorized purposes or fail to observe required procedural formalities. Article 25 addresses negligent violations, carrying 6 months to 2 years for negligent improper disclosure. Intercepted information cannot be used beyond the purpose that motivated the original order.

Phone Calls and In-Person Conversations

Phone and Digital Calls

A participant in a phone call in Costa Rica may record it. This applies to landline calls, mobile calls, VoIP calls, and calls through apps like WhatsApp, Zoom, or Microsoft Teams. The participant records their own conversation, not a third party's communication.

Dissemination restrictions still apply. Recording a call for your own reference or potential use in a legal proceeding differs from broadcasting the audio publicly or providing it to media outlets. The latter raises exposure under Articles 201 and 202 unless a public interest exception applies.

In-Person Conversations

The same one-party principle governs face-to-face conversations. A participant in a discussion may record it. The recording captures words directed to the participant.

Placing a hidden recording device in a room to capture conversations you are not part of is third-party interception under Article 198, punishable by 1 to 3 years in prison.

Recording in Public Spaces

Costa Rican law does not contain a standalone statute governing recording in public places. The analysis depends on whether the person being recorded has a reasonable expectation of privacy.

In genuinely public settings such as streets, parks, government buildings open to the public, and commercial establishments, the expectation of privacy is reduced. Recording activity visible to passersby generally does not trigger criminal liability.

Conversations conducted at normal volume in public, audible to anyone nearby, carry less privacy protection than whispered discussions or meetings in semi-private areas such as restaurant booths or office lobbies.

Video surveillance (CCTV) by businesses and property owners is common in Costa Rica and is regulated primarily through the data protection framework under Ley 8968 rather than the criminal recording statutes.

Recording Police and Public Officials

The Sala Constitucional settled the question of recording police in public in Voto 2019-001105 (January 23, 2019). The court held that any person, journalist or not, has the constitutional right to film police actions in public spaces as an exercise of freedom of expression. The magistrates stated that "the desire to conceal and cover up is more characteristic of authoritarian regimes" and emphasized that police use of force requires justification and proportionality, which citizens must be able to document.

The case arose from the September 12, 2018, student protest at UCR, where an officer struck a journalist who was filming peacefully. The court found the officer's actions "clearly unjustified and therefore arbitrary."

Practical limits remain. Recording police actions does not authorize obstruction of an active law enforcement operation. You may not interfere with arrests or block officers from performing their duties while recording. The right is to observe and document from a lawful position, not to insert yourself into the operation.

The same principle extends to recording other public officials exercising public functions in public settings. Transparency and accountability are the constitutional basis; officials acting in their official capacity in public have a reduced expectation of privacy as to those actions.

Workplace Recording and Employee Privacy

Employees Recording in the Workplace

An employee who participates in a workplace conversation may record it under the one-party consent principle. This includes meetings with supervisors, discussions with HR, or interactions with colleagues where the employee is present and engaged.

Such recordings have practical value in labor disputes. Costa Rican labor courts operating under the Código de Trabajo may consider participant recordings when evaluating claims of harassment, wrongful termination, or wage violations.

Employer Monitoring

Employers who wish to monitor workplace communications must navigate both the Código Penal provisions and the data protection framework of Ley 8968.

Ley 8968 (Law on the Protection of Individuals Regarding the Processing of Personal Data, enacted 2011) requires that personal data processing occur only with the prior, express, and informed consent of the data subject, unless a specific legal exception applies. The consent must be "unequivocal, freely given, specific, and documented in written or digital form."

For employers:

• Employees must be notified in advance that monitoring or recording occurs.
• The purpose and scope of monitoring must be clearly stated.
• Monitoring must be proportionate to a legitimate business objective.
• Data retention policies must be defined and enforced.

PRODHAB Enforcement

The Agency for the Protection of Inhabitants' Data (PRODHAB) oversees compliance with Ley 8968 and handles complaints from employees and customers. Administrative penalties range from 5 to 30 base salaries (approximately USD 4,000 to USD 24,000 at current salary reference levels). PRODHAB Resolution 697-2023 ordered the Central Bank of Costa Rica to suspend data collection through its beneficial ownership registry, the first precautionary suspension of a major government data initiative, demonstrating that PRODHAB uses its authority actively.

A pending bill (No. 23097) would replace Ley 8968 with a GDPR-aligned framework, a revised supervisory authority structure, and a new sanctions regime. As of early 2025 the bill remained in Legislative Assembly committee debate and had not been enacted.

Call Centers and Business Telephony

Costa Rica hosts a significant call center and business process outsourcing industry. Companies that record customer calls should:

• Provide clear notice at the start of the call using an automated disclosure.
• Maintain documented consent frameworks and retention policies.
• Define how long recordings are kept and delete or anonymize them after that period.
• Restrict internal access to recordings to authorized personnel.

One-party consent means a company representative participating in the call may lawfully record it. Ley 8968 data protection obligations create additional compliance requirements beyond the criminal code analysis.

Voyeurism, Non-Consensual Intimate Images, and Deepfakes

Voyeurism and NCII Under Ley 9877

Ley 9877 (Ley contra el Acoso Sexual Callejero), effective August 27, 2020, created Article 175 quinquies of the Código Penal, which directly addresses non-consensual recording of intimate material. Anyone who, in a public space, space of public access, or paid passenger transport, records, captures, or produces audio, visual, or audiovisual material of a sexual nature of another person without that person's consent faces:

• 10 to 18 months prison or 30 to 45 days fine for the act of unauthorized capture.
• 18 to 36 months prison or 45 to 60 days fine if the material is distributed or transmitted.

Article 175 sexies increases these penalties by one-third when the victim is a minor, a person aged 65 or older, or a person with a disability.

Note that Ley 9877 applies specifically in public and semi-public spaces. Voyeuristic recording in private spaces (such as installing a hidden camera in a home or hotel room) may fall under Article 198 (unauthorized recording of private communications) or Article 196 bis (unauthorized handling of personal data in telematic systems).

Article 196 Bis and Stored Intimate Images

Article 196 bis of the Código Penal covers the unauthorized handling of personal data, including images, stored in computer or telematic systems. Sharing or publishing intimate images stored digitally without authorization from the person depicted falls within its scope, with a base penalty of 3 to 6 years prison and 4 to 8 years if the conduct involves minors or sensitive personal data.

This provision captures what many jurisdictions call "revenge porn" or non-consensual intimate image (NCII) distribution via digital platforms, even when the images were originally captured legally.

Deepfakes and AI-Generated Media

No standalone deepfake statute has been enacted in Costa Rica as of May 2026. The primary legal framework applicable to AI-generated audio or video of a person without their consent combines Article 196 bis (unauthorized creation and distribution of digital personal data) with the general tort liability framework.

At the policy level, Costa Rica's National Strategy for Artificial Intelligence (ENIA 2024-2027), presented by MICITT in October 2024, explicitly prohibits the creation and dissemination of deepfakes without the express consent of the person imitated. ENIA 2024-2027 is a government policy instrument, not a criminal statute; it does not itself create criminal penalties.

Three AI regulation bills remain in Legislative Assembly debate: Bill 23771 (presented May 30, 2023), Bill 23919 (presented September 6, 2023), and a third bill presented August 6, 2024. None has been enacted. Until one of these bills becomes law, deepfake enforcement in Costa Rica relies on existing criminal provisions covering data privacy violations and unauthorized use of communications.

The Public Interest Doctrine: The Navarro Recordings

The most consequential test of Costa Rica's recording laws in recent years came in December 2023, when La Nación published audio recordings of conversations between President Rodrigo Chaves and government officials. The recordings were made by former Communications Minister Patricia Navarro during her four-month tenure beginning May 2022. They allegedly revealed improprieties in the awarding of a government contract to a communications consultancy.

What Happened

Navarro was a participant in the recorded conversations and captured audio of discussions involving the president and other officials. The recordings were later provided to La Nación, which published them as part of an investigative report.

President Chaves and Communications Minister Jorge Rodríguez Vives filed a criminal complaint against La Nación and Navarro, alleging violations of the provisions on improper capture of verbal statements and improper use of correspondence under the Código Penal.

The Prosecution's Response

Prosecutors rejected the request to suppress the recordings. The rationale: the recordings fell within the public interest. Their relevance to allegations of public corruption and misuse of government contracts outweighed the privacy interests of the officials involved. This outcome aligned with the public interest exception in Article 196 of the Código Penal and the Sala Constitucional's 2022 jurisprudence on public-function recordings.

The Ongoing Immunity Proceedings

The recordings became central to a broader corruption investigation. Prosecutors alleged that Chaves and Rodríguez rigged a contract to favor a company owned by businessman Christian Bulgarelli, with USD 32,000 allegedly funneled to Chaves's former adviser, Federico Cruz.

The Legislative Assembly voted on whether to strip President Chaves of immunity. The first vote on September 23, 2025 failed with 34 votes, short of the 38-vote majority required. The second vote on December 16, 2025 also failed (35-to-21, again three short of the threshold). As of May 2026 the Assembly continues to deliberate on the question. The Electoral Tribunal separately requested immunity removal in October 2025 to pursue alleged campaign interference violations. The audio recordings remain central to the prosecution's case.

What This Means for Recording Law

The Navarro case confirmed in practice what the Sala Constitucional stated in principle in 2022: a participant who records conversations involving public officials engaged in potential corruption, and who provides those recordings to the press, can invoke the public interest doctrine as a defense against criminal prosecution.

The doctrine applies narrowly. Recordings of purely private matters with no bearing on public affairs remain subject to the full weight of the dissemination restrictions in Articles 201 and 202.

Penalties at a Glance

Cross-Border Recording

Territorial Jurisdiction

Costa Rican criminal law applies to any act committed on Costa Rican territory, regardless of the nationality of the parties. A foreign national who records a conversation while physically present in Costa Rica is subject to Costa Rican law. The protections and restrictions described throughout this article apply equally to citizens, residents, and visitors.

Cross-Border Calls: Which Law Governs?

When one party is in Costa Rica and the other is abroad, the applicable law is determined by where the recording act occurs. A person in Costa Rica recording a call with a party in the United States is subject to Costa Rican one-party consent rules for the recording act, regardless of the US state's consent requirement. If the US-based party is in a two-party consent state, that party records at their own risk under their jurisdiction's rules; the Costa Rican participant records lawfully.

No single international treaty currently harmonizes call recording consent rules across jurisdictions. Compliance-conscious parties to cross-border calls often provide notification at the start of the call to satisfy both jurisdictions' rules.

Data Transfer Requirements Under Ley 8968

If recordings are transferred out of Costa Rica, the data transfer must comply with Ley 8968's requirements for international data transfers. PRODHAB oversees compliance with these provisions. Foreign-owned companies operating call centers in Costa Rica must apply Costa Rican law to all recording activities within the country, even when calls connect to parties abroad.

Bill 23097, if enacted, would introduce explicit adequacy and standard contractual clause mechanisms for cross-border data transfers aligned with GDPR Article 46 principles. Until that bill becomes law, Ley 8968's existing transfer provisions govern.

Business Compliance in Costa Rica

Companies that record conversations in Costa Rica should follow these steps:

Identify the legal basis under Ley 8968. Before collecting any voice recording, determine whether you rely on consent, contractual necessity, legal obligation, or another lawful basis. Document that determination in writing.

Provide clear notice. Ley 8968's transparency requirements mean businesses must inform individuals when recordings are being made. For phone calls, an automated disclosure at the start of the call is standard practice in the industry and recommended by PRODHAB.

Define retention periods. Establish written policies governing how long recordings are kept. Delete or anonymize recordings when the retention period expires.

Restrict access. Limit who within the organization can access stored recordings. Maintain access logs and audit them periodically.

Train your team. Employees who handle recordings need to understand that recording a conversation they participate in is lawful, but sharing those recordings outside authorized channels may not be.

Register with PRODHAB if required. Entities that maintain databases of personal data may need to register with PRODHAB. Check current registration requirements and ensure registration is current.

Monitor Bill 23097. If this GDPR-replacement bill is enacted, it will introduce new consent and transfer requirements with a 12-month compliance period. Compliance programs built to current Ley 8968 standards will need review.

Foreigners and Visitors

Costa Rica's recording laws apply equally to citizens, residents, and visitors. Anyone on Costa Rican territory who breaks the law is subject to the Costa Rican judicial system regardless of nationality.

Tourists and business travelers should be aware that while recording your own conversations is permitted, sharing those recordings online or with media could trigger criminal exposure under the dissemination provisions. The penalties apply to anyone on Costa Rican territory.

---

This article presents general legal information about recording laws in Costa Rica as of May 2026. It is not legal advice. Costa Rican law is subject to ongoing legislative and judicial developments. Consult an attorney licensed in Costa Rica for guidance on your specific situation.