Colombia Recording Laws: All-Party Consent Rules and Penalties (2026)

Overview of Colombia's Recording Consent Standard

Colombia operates under a de facto all-party consent standard for recording private conversations. No statute uses the phrase "all-party consent" in those words, but the combined effect of the 1991 Constitution and the Código Penal (Ley 599 of 2000) is that recording a private communication without the agreement of every participant is a criminal offense.

Unlike countries that grant a blanket right for one participant to record, Colombian law treats private communications as protected from any unauthorized capture. The person doing the recording is not automatically exempt simply because they are part of the conversation. A participant who secretly records a phone call, an in-person meeting, or a video chat without the other parties' knowledge can face criminal prosecution under Article 192 of the Código Penal.

There is one recognized exception, developed through Constitutional Court jurisprudence rather than written into the statute: a victim of a crime may record a conversation to gather evidence of that crime. Outside that narrow circumstance, all parties must consent before any recording takes place.

Constitutional Foundation: Article 15

Article 15 of the 1991 Colombian Constitution establishes the right to personal and family privacy and declares that correspondence and other forms of private communication are inviolable.

The constitutional text states that private communications "may only be intercepted or recorded pursuant to a court order, following the formalities established by law." This language creates a strong default: no interception or recording without judicial authorization.

Article 15 also guarantees the right to know, update, and rectify personal information held in public and private databases. This provision became the constitutional foundation for Colombia's comprehensive data protection framework enacted through Ley 1581 of 2012.

The Constitutional Court has interpreted Article 15 to apply across all communication methods, including telephone calls, digital messaging, email, and face-to-face conversations conducted in private settings. The protection follows the communication, not the technology used.

Código Penal Articles 192 Through 197: The Core Criminal Offenses

Chapter VII of Title III of the Código Penal (Ley 599 of 2000) is titled "De la Violación a la Intimidad, Reserva e Interceptación de Comunicaciones." It contains the primary criminal provisions governing unauthorized recording and interception in Colombia.

Article 192: Unlawful Violation of Communications

Article 192 is the central provision. It states that anyone who unlawfully removes, conceals, misplaces, destroys, intercepts, controls, or prevents a private communication directed to another person, or who improperly learns of its content, commits a criminal offense.

The base penalty is 16 to 54 months in prison.

If the offender reveals the content of the communication, or uses it for personal benefit or to the detriment of another, the penalty increases to 32 to 72 months in prison.

These penalty ranges reflect the increases applied by Ley 890 of 2004, Article 14, which took effect on January 1, 2005.

The language of Article 192 is broad. It covers interception by any means, whether electronic recording, physical eavesdropping, or accessing stored communications. It does not contain an explicit exception for participants in the conversation.

Article 193: Sale or Purchase of Interception Devices

Article 193 addresses the supply chain for surveillance equipment. Anyone who, without authorization from a competent authority, offers, sells, or purchases instruments capable of intercepting private communications between persons faces a monetary fine.

This provision targets the commercial distribution of wiretapping equipment, signal interceptors, and similar devices. The penalty is a fine rather than imprisonment, reflecting the preparatory nature of the offense.

Article 194: Disclosure of Confidential Documents

Article 194 criminalizes the disclosure or use of documents that must remain confidential, when done for personal benefit, for the benefit of a third party, or to the detriment of another person. The penalty is a fine.

This article applies to written and recorded materials that carry legal confidentiality obligations, including intercepted communications that are subsequently shared.

Article 196: Interception of Official Communications

Article 196 applies specifically to official government correspondence and communications. Anyone who unlawfully removes, conceals, misplaces, destroys, intercepts, controls, or prevents an official communication faces 48 to 108 months in prison.

The penalty increases by up to one-third when the intercepted communication is directed to or sent by the Judicial Branch or by state control or security agencies. This enhanced penalty reflects the heightened sensitivity of government communications.

Article 197: Unlawful Use of Communication Networks

Article 197 targets the possession or use of communication network terminal equipment or electronic devices designed or adapted to emit or receive signals for illicit purposes. The penalty is 4 to 8 years in prison (48 to 96 months).

If the conduct is carried out for terrorist purposes, the penalty doubles.

This provision captures the use of cloned devices, rogue base stations, and other technical means of intercepting communications infrastructure.

The Victim Exception: Sentencia SU-371/21

The most significant development in Colombia's recording law came from the Constitutional Court's Sentencia de Unificación SU-371/21, decided in 2021.

This ruling addressed whether recordings made by one participant in a conversation, without the knowledge or consent of the other participant, could serve as valid evidence in disciplinary proceedings. The Court established a framework for evaluating such recordings.

The core holding recognizes a victim-protection exception. When a person is the victim of a crime or disciplinary offense and participates in a conversation related to that offense, they may record the conversation without prior judicial authorization. The recording is admissible as evidence if two conditions are met:

1. The person making the recording is genuinely a victim of the conduct being documented.
2. The specific purpose of the recording is to demonstrate the existence of the crime or disciplinary violation.

This exception is narrow. It does not create a general one-party consent rule. A participant who records a conversation out of curiosity, for commercial advantage, or for any reason other than documenting victimization does not fall within its protection. The Court emphasized that the person's victim status must be demonstrable, and the recording must be tied to the specific wrongful conduct.

Prior to SU-371/21, the Supreme Court of Justice (Corte Suprema de Justicia) had already developed similar reasoning in criminal cases, holding that a victim could record threats, extortion attempts, or other crimes being committed against them. The Constitutional Court's 2021 ruling unified and formalized this doctrine across all judicial and administrative proceedings.

Ley 1273 of 2009: Computer Data Interception

Ley 1273 of 2009 created a new protected legal interest in the Colombian Penal Code titled "De la Protección de la Información y de los Datos" (Protection of Information and Data). This law addresses crimes committed through or against computer systems.

Article 269C of Ley 1273 criminalizes the interception of computer data. Anyone who, without a prior judicial order, intercepts computer data at its origin, destination, or within a computer system, or intercepts electromagnetic emissions from a system transporting such data, faces 36 to 72 months in prison.

The penalties increase by one-half to three-quarters if the interception targets state, official, or financial sector computer networks or communication systems, whether national or foreign.

This provision operates alongside Article 192 of the Código Penal. A person who intercepts a VoIP call, records a video conference without authorization, or captures data from a messaging application could face charges under both statutes. Ley 1273 specifically addresses the digital dimension, while Articles 192-197 cover communications interception more broadly.

Law Enforcement Interception: Ley 906 of 2004 and Decreto 1704 of 2012

Colombian law permits communications interception by law enforcement, but only under strict judicial oversight.

Ley 906 of 2004, the Código de Procedimiento Penal, governs the procedural framework. Article 235 authorizes the Fiscalía General de la Nación (Attorney General's Office) to order the interception of communications through magnetic recording or similar means for the purpose of obtaining material evidence, physical evidence, or locating accused or convicted persons.

The prosecutor must subsequently appear before a judge of guarantees (juez de control de garantías) to legalize the interception once the investigative activity concludes. Judicial Police officers must also provide partial reports when the interception yields information requiring immediate action.

Decreto 1704 of 2012 regulates the operational requirements for lawful interception. It obligates telecommunications providers to:

• Adopt measures ensuring interception is carried out in optimal, timely, and secure conditions.
• Provide subscriber identification data to the Fiscalía when legal requirements are met.
• Supply geographic location data for terminals involved in intercepted communications.
• Maintain subscriber information for five years.
• Guarantee data confidentiality under penalty of criminal and disciplinary sanctions.

All officials with access to intercepted communications are bound by strict confidentiality obligations.

Phone Calls vs. In-Person Conversations

Colombian law does not distinguish between phone calls and in-person conversations when applying recording restrictions. Article 192 of the Código Penal covers any "private communication," and Article 15 of the Constitution protects "correspondence and other forms of private communication" without limiting protection to specific technologies.

A phone call between two people carries the same legal protection as a face-to-face conversation in a private office. A video conference has the same status as a whispered exchange in a closed room. The determining factor is whether the communication is private, not the medium through which it occurs.

For digital communications, Ley 1273 of 2009 adds an additional layer of protection. Intercepting a WhatsApp call, recording a Zoom meeting without consent, or capturing messages from a messaging platform triggers both the traditional communications interception offenses and the computer data interception provisions.

Recording in Public Spaces

Colombian jurisprudence recognizes a graduated scale of privacy expectations based on the physical setting. The Constitutional Court has identified four categories:

• Public spaces: Open areas where privacy expectations are minimal. Recording in a public plaza or on a public street generally does not trigger Article 192 protections.
• Semi-public spaces: Areas with relatively open access where people gather for specific purposes, such as shopping centers or transportation terminals. Privacy expectations are limited.
• Semi-private spaces: Enclosed areas where a defined group engages in a shared activity, such as an office or classroom. Access is restricted and privacy expectations are moderate.
• Private spaces: Areas where individuals develop their personal lives in full privacy, such as homes and private offices. Recording protections are at their strongest.

The key principle is that as the setting becomes more private, the legal restrictions on recording become stricter. Recording a conversation that takes place in a genuinely public setting, where there is no reasonable expectation of privacy, is generally not considered a violation of Article 192. However, recording a conversation between identifiable individuals in a semi-private or private space without their consent falls squarely within the criminal prohibition.

Workplace Recording and Ley 1581 of 2012

Ley 1581 of 2012, Colombia's comprehensive data protection statute, has significant implications for workplace recording.

Employers may install video surveillance cameras in the workplace, but only under specific conditions:

• Cameras must not be placed in areas where employees have a reasonable expectation of privacy, such as restrooms, changing rooms, or break rooms.
• Employees must be informed that monitoring is taking place. Notice must be clear and visible.
• The surveillance must serve a legitimate purpose, such as security or occupational safety.
• Captured images and recordings constitute personal data and are subject to all obligations under Ley 1581.

Audio recording in the workplace is treated more restrictively. Employers should avoid capturing audio in work environments except in exceptional and well-documented circumstances. The combination of Article 192 of the Código Penal (which criminalizes unauthorized interception of private communications) and Ley 1581 (which requires prior informed authorization for personal data processing) creates a high legal bar for workplace audio surveillance.

The Superintendencia de Industria y Comercio (SIC), Colombia's data protection authority, enforces Ley 1581 and can impose fines of up to 2,000 legal monthly minimum wages (approximately $500,000 USD or more) for violations. Organizations must register their databases containing personal data, including surveillance recordings, with the SIC's National Database Registry (RNBD).

Businesses that record customer calls must obtain prior and informed authorization from the data subject. The authorization must be obtainable by any means that can be verified later. A recorded verbal consent at the beginning of a call, combined with a clear statement of purpose, is the standard practice.

Penalty Summary Table

Violation	Law	Penalty
Unlawful interception of private communications	Código Penal Art. 192 (Ley 599/2000)	16 to 54 months prison
Interception with disclosure or exploitation	Código Penal Art. 192, paragraph 2	32 to 72 months prison
Sale or purchase of interception devices	Código Penal Art. 193	Monetary fine
Disclosure of confidential documents	Código Penal Art. 194	Monetary fine
Interception of official communications	Código Penal Art. 196	48 to 108 months prison
Unlawful use of communication networks	Código Penal Art. 197	48 to 96 months prison
Unlawful use of networks for terrorism	Código Penal Art. 197, paragraph 2	96 to 192 months prison
Computer data interception	Ley 1273/2009, Art. 269C	36 to 72 months prison
Data protection violations (SIC enforcement)	Ley 1581/2012	Fine up to 2,000 minimum wages

Business Compliance Checklist

Companies operating in Colombia that handle recorded communications should follow these steps.

Obtain prior authorization for call recording. Before recording any customer or business call, provide a clear notice explaining the purpose of the recording and obtain verifiable consent. A verbal opt-in captured at the start of the call meets this requirement.

Register databases with the SIC. All databases containing recorded communications must be registered with the National Database Registry (Registro Nacional de Bases de Datos). Keep registrations current when the nature or scope of data processing changes.

Limit workplace surveillance to non-private areas. Video cameras may be installed in common work areas, but never in restrooms, changing rooms, or other spaces where privacy is expected. Post visible notices wherever cameras operate.

Avoid audio capture in the workplace. Audio recording of employees should be avoided except in clearly justified and documented circumstances. Obtain legal counsel before implementing any audio monitoring.

Define retention and access policies. Establish written policies governing how long recordings are stored, who may access them, and when they must be deleted. Restrict access to personnel with a legitimate business need.

Implement security measures. Recordings constitute personal data under Ley 1581 of 2012. Apply technical and organizational safeguards including encryption, access controls, and audit logging.

Train employees on compliance. Staff who handle recordings must understand the legal restrictions on unauthorized interception, the requirements for obtaining consent, and the consequences of non-compliance.