Colombia's Law 1581: cookie rules for Colombian visitors

What is Colombia's data protection law?

Law 1581 of 2012 is a statutory law (ley estatutaria) that develops the constitutional right of habeas data in Article 15 of the Colombian Constitution. It applies to personal data in any database that public or private entities can process. Decree 1377 of 2013, now compiled in the single regulatory decree for the trade sector (Decree 1074 of 2015), sets out how authorization is obtained and proven, the content of privacy policies and the duties of controllers. The Superintendencia de Industria y Comercio (SIC) supervises the law through its Delegation for the Protection of Personal Data.

Who does the law apply to?

Article 2 applies the law to processing carried out in Colombian territory, and to controllers or processors not established in Colombia when Colombian law applies to them under international rules and treaties. Personal data is any information linked or that can be associated with one or more identified or identifiable natural persons.

The SIC reads the territorial rule broadly. In Resolution 29826 of May 2021, it ordered WhatsApp LLC to bring its policies into line with Colombian law after finding that the company used cookies to collect and process the personal data of Colombian users. Because the cookies were installed on mobile devices and computers located in Colombia, the SIC held that the data was collected in Colombian territory and that Law 1581 applied. It ordered a compliant policy, authorization requests in clear and simple Spanish, and registration of the databases in the National Database Registry. Any foreign website that sets cookies on Colombian visitors' devices should assume the same reasoning applies to it.

The law excludes personal and household databases, national security and anti-money laundering files, intelligence files, journalism and editorial content, and some databases governed by special laws.

What does the law require for cookies?

Cookies can be personal data. In concept 16-172268 of 9 August 2016, the SIC explained that cookies are files that collect information on a website about the browsing habits of a user or their device, and that they may form a database under Law 1581 when the data relates to a natural person and can identify them, alone or combined with other data. In that case the controller must apply all the principles in Article 4: legality, purpose, freedom, accuracy, transparency, restricted access and circulation, security and confidentiality.

Authorization comes first. Article 3 defines authorization as the data subject's prior, express and informed consent, and Article 9 requires it before processing, obtained by any means that can later be consulted. Decree 1377 of 2013 specifies that it can be given in writing, orally, or through unequivocal conduct that reasonably shows consent was given, and that silence can never be treated as unequivocal conduct. Continuing to browse after a notice is therefore weak evidence; a click on an Accept button that follows clear information is stronger. Article 10 lists the cases where authorization is not needed, such as public data, requests by public authorities or medical emergencies; none covers advertising cookies.

Sensitive data. Data affecting the person's intimacy or whose misuse could lead to discrimination, such as racial or ethnic origin, political orientation, religious or philosophical beliefs, union or human rights membership, health, sex life and biometric data, can be processed only with explicit authorization or under a narrow exception (Articles 5 and 6). Article 7 requires respect for the prevailing rights of children and adolescents and, in its text, prohibits processing their data except data of a public nature.

Information and proof. Article 12 requires the controller, when requesting authorization, to state clearly the processing and its purpose, that answers about sensitive data or children's data are optional, the data subject's rights, and the controller's identity, address and phone number, and to keep proof that it did so.

A banner for Colombian visitors that names the purposes, keeps analytics and advertising cookies off until the visitor clicks to accept, offers a refusal, and stores the choice as evidence fits these rules.

What are the penalties?

Article 23 lets the SIC impose on private controllers and processors:

• fines of up to 2,000 legal monthly minimum wages (salarios mínimos mensuales legales vigentes) at the time of the sanction, which can be repeated while the breach continues;
• suspension of processing activities for up to six months, with the corrections to adopt;
• temporary closure of processing operations if the corrections are not made after the suspension;
• immediate and permanent closure of operations involving sensitive data.

Article 24 grades sanctions by the harm or risk caused, the economic benefit obtained, recidivism, obstruction of the investigation, refusal to follow SIC orders, and express acknowledgment of the infringement before the sanction. Public bodies are referred to the Procuraduría General de la Nación instead.

Besides orders such as the one addressed to WhatsApp, the SIC publishes guidance, including a guide on processing personal data for e-commerce.

How Cookiequiet handles Colombia

Colombia is not in Cookiequiet's default list of regulated countries, so add it to a custom list with geo-targeting, which is free on every plan, and Colombian visitors will see the consent banner, with Accept all and Reject all given the same weight, categories off by default, and Spanish text picked from the browser and editable. Scripts and embeds wait for consent, and the consent log keeps the proof of authorization that Decree 1377 of 2013 asks for. The cookie scanner lists what to describe in your policy. For neighboring rules, see Peru, Mexico and Brazil's LGPD.