Cold Email Laws in Colombia: Ley 1581, Consent and Sending Hours

October 11, 2026. Colombia treats a cold email to a named person as processing of personal data, and its data protection law requires the person's authorization, which it defines as "consentimiento previo, expreso e informado", prior, express and informed consent, before you process it. A second law, Ley 2300 de 2023, limits advertising emails to consumers to Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturday from 8:00 a.m. to 3:00 p.m., with nothing on Sundays or public holidays. The regulator, the Superintendencia de Industria y Comercio (SIC), can fine a company up to 2,000 monthly minimum wages per sanction, and in October 2025 it announced a COP 670 million sanction against Movistar for commercial contact without authorization.

Here is what that means for B2B outreach into Colombia, from the text of Ley 1581 de 2012, Decreto 1377 de 2013 and Ley 2300 de 2023 on the government's legal database, read 11 October 2026. Sending from authenticated domains with a working unsubscribe is the floor everywhere; our email infrastructure work starts there. This is a map of the rules, not legal advice.

Who the law protects, and who it does not

Ley 1581 protects "dato personal", defined in Article 3 as information linked or linkable to "personas naturales", natural persons. A company is not a natural person, so a generic company address such as ventas@ or info@ that identifies no individual sits outside the law. A named work address, such as [email protected], identifies a person and is personal data, exactly like a personal Gmail address. Most B2B prospect lists are lists of named people, so most cold email into Colombia is inside the law.

On territory, Article 2 applies the law to processing "en territorio colombiano" and to a controller or processor not established in Colombia when Colombian law applies to it under international norms and treaties. If you are outside Colombia and building lists of Colombian contacts, plan as if the law applies to you; the downside of assuming otherwise is a fine you cannot easily contest from abroad.

Consent: prior, express, informed and provable

Article 9 requires the data subject's prior and informed authorization, "obtenida por cualquier medio que pueda ser objeto de consulta posterior", obtained by any means that can be checked later. Decreto 1377 accepts authorization given in writing, orally, or through "conductas inequívocas", unequivocal conduct from which it can reasonably be concluded that the person agreed, and adds that silence can never count as consent. When you ask for authorization, Article 12 requires you to tell the person clearly what processing you will do and why, what rights they have, and who you are, with an address and phone number.

Article 10 lists the cases where authorization is not needed. The one that matters for prospecting is "datos de naturaleza pública", public data, which Decreto 1377 says includes data about a person's profession or trade and their status as a merchant, of the kind held in public registries. That is narrower than it sounds: it is far from clear that an email address scraped from a website or a social profile counts as public data just because it is visible online, and the sources we read do not settle whether marketing to an address taken from a public registry is safe. Treat the exemption as a reason to keep good records, not as a licence for list buying.

Sending hours and frequency under Ley 2300

Ley 2300, known as the "dejen de fregar" law, was written mainly for financial entities and debt collection, but its Article 5 extends it "en los mismos términos" to producers and suppliers sending advertising by SMS, app or web messaging, email and commercial calls. Paragraph 3 of that article says advertising messages, emails and calls may only be sent within the hours in Article 3: Monday to Friday from 7:00 a.m. to 7:00 p.m. and Saturday from 8:00 a.m. to 3:00 p.m., with no contact on Sundays or public holidays. Once there has been direct contact, the person may not be reached through several channels in the same week or more than once on the same day.

The law also requires contact only through channels the person has authorized (Article 2), and Article 5 requires explicit acceptance for promotions designed to build databases and "un mecanismo ágil, sencillo y eficiente" to stop receiving messages and emails at any time. The law speaks of consumers, and whether a company buyer counts is open to argument, but scheduling sends inside the window costs nothing. Set your sequencer to Colombia time (UTC minus 5) and block Sundays and the national holiday calendar.

Penalties and what enforcement looks like

Article 23 of Ley 1581 lets the SIC impose fines of up to 2,000 "salarios mínimos mensuales legales vigentes" at the time of the sanction, repeatable while the breach continues, suspend the processing activity for up to six months, close the related operations temporarily, and close operations that involve sensitive data permanently. Data subjects can also revoke authorization and demand deletion at any time through a complaint to the controller, unless they have a legal or contractual duty to stay in the database.

The most visible recent case is commercial contact. On October 29, 2025 the SIC announced a COP 670 million sanction, about US$172,000 according to EFE's report, against Colombia Telecomunicaciones, which trades as Movistar, for contacting another operator's users for commercial purposes without authorization. Movistar said it disagreed with the decision and would take legal action. The lesson for email is the same: the SIC looks at whether you can prove authorization for the specific purpose, not at how polite the message was.

A compliant first email to a Colombian contact

The safest structure is a short email whose job is to earn authorization rather than to pitch. Write it in Spanish unless you know the contact works in English, and include:

1. Your company's legal name, a physical address and a phone number, which Article 12 requires when you request authorization.
2. One line on why you are writing and where you found the address.
3. A clear question: may we send you information about a specific product or service, and for what purpose will we use your data.
4. A one-click way to refuse and a statement that they can ask to be deleted at any time.
5. A send time inside the Ley 2300 window, and no follow-up on another channel the same week.

Store the reply, with the date, the text you sent and the purpose it covered, because Article 9 makes you prove authorization later. If you buy or rent data, ask the seller for the authorization records behind each contact; our guide to buying email lists explains why a bought list rarely comes with them.

How Colombia compares with its neighbours

Colombia sits at the strict end of Latin America for email. Argentina lets you send advertising without consent from lawful sources if you label it and honour removals, and Mexico and Brazil each have their own rules, covered in our guides. If you run one campaign across the region, build to the Colombian standard and you will usually clear the others; our cold email laws by country table sets them side by side.

Checklist for emailing Colombia

• Separate generic company addresses from named people; only the first group is outside Ley 1581.
• For named contacts, get prior, express, informed authorization and keep a record you can produce later.
• Give your identity, address, phone, purpose and the person's rights when you ask.
• Send only Monday to Friday 7:00 a.m. to 7:00 p.m. and Saturday 8:00 a.m. to 3:00 p.m. Colombia time, never on Sundays or holidays.
• One channel per week and no more than one contact a day once you have spoken.
• Honour refusals and deletion requests immediately, across every list and tool.
• Send from authenticated domains with a visible unsubscribe, and keep your sending infrastructure separate from your main domain.