Which topic would you like to know more about?
What is the legal age of adulthood/ majority in your jurisdiction? Are all persons below this age considered a child/ minor?
The Colombian Civil Code determines the age of majority at 18 years of age and classifies minors as follows:
- Infants: 0 to 7 years of age. Absolutely incapable and their acts are not legally binding.
- Pre-pubescent: 7 to 14 years of age. Absolutely incapable and their acts are not legally binding.
- Adult minors: 14 to 18 years of age. They are considered incapable, but can perform certain legally binding acts, such as making a will and/or disposing of their property after their death, consenting to cosmetic procedures/surgeries.
Has the UNCRC been directly incorporated into national law in your jurisdiction?
Yes.
Yes, the United Nations Convention on the Rights of the Child (UNCRC) has been directly incorporated into Colombian national law. Colombia ratified the UNCRC in 1991.
Is there an ombudsperson/ commissioner for children in your jurisdiction?
Yes.
The institution responsible for the protection of children's rights is the Colombian Institute for Family Welfare (CIFW). Although there is no specific “ombudsperson” or “commissioner” for children, the CIFW has the function of guaranteeing the welfare and protection of minors in the country.
If there is an ombudsperson/ commissioner for children in your jurisdiction, do they have any responsibility for upholding children’s rights in the digital world or does the relevant regulator have sole competence?
Yes.
The Colombian Institute for Family Welfare promotes the prevention and comprehensive protection of early childhood, childhood and adolescence, and the strengthening of young people and families in Colombia, providing special attention to those whose rights are threatened, not respected or violated, including in the digital world.
Is there any standalone requirement to collect the consent of one or both parents when processing a child’s personal data (irrespective of any other obligations, e.g. the requirement to have a legal basis for processing)?
Yes.
According to the Colombia's Data Protection Law N° 1.581, consent is the only valid legal basis for the processing of personal data. Consequently, to collect personal data from minors, the express consent of his or her parents must be obtained.
At what age can children legally consent to the processing of their own personal data, such that parental permission/ consent is not required?
Considering civil regulations and the provisions of Colombia's Data Protection Law N° 1.581, the jurisprudence of the Colombian data protection authority, the Superintendence of Industry and Commerce, has stated that minors under 18 years of age cannot directly provide their consent and/or authorization for the processing of personal data. In this regard, it is necessary to obtain parental consent to process the data of minors under 18 years of age.
Are there specific requirements in relation to collection and/or verification of parental consent/ permission concerning the processing of a child’s personal data?
No.
Colombia's Data Protection Law N°1.581 does not contemplate specific steps to verify that the minor's parent has given its consent. However, the Colombian data protection authority, the Superintendence of Industry and Commerce, has indicated that the burden of obtaining parental consent falls on over the platform and that statements by the child that parental consent has been obtained will not be considered valid. It is also recommended to indicate in the consent mechanism that: (i) the personal data of children will be processed while parental consent is given; and (ii) parents ensure that they have considered the views of the child in accordance with his or her level of maturity and best interests. This is required by law and is usually enforced by a notice stating that, for the collection of consent, the parents or legal guardians will comply with the burdens and requirements in accordance with applicable law.
Are there any particular information or transparency requirements concerning the processing of children’s personal data?
No.
There are no information or transparency requirements in relation to the processing of personal data of minors in Colombia. However, Colombia's Data Protection Law N° 1.581 establishes general transparency obligations applicable to any personal data processed by a controller. Also, the processing of data of children and adolescents must respect the prevailing rights of children and adolescents.
Can children directly exercise their rights in relation to their personal data without the involvement of their parents?
No.
There is no specific regulation in Colombia that establishes the age from which children can legally exercise their rights without the involvement of their parents. However, based on a joint interpretation of the civil legislation and Colombia's Data Protection Law N° 1.581, we understand that in the case of children under the age of 18, parental consent is required and, normally, parents or guardians would have to exercise these rights on behalf of the child.
Can children make complaints on their own behalf directly to your national data protection/ privacy regulator(s)?
Yes.
Section 12 of the UNCRC provides that the child shall be given the opportunity to be heard in any judicial or administrative proceedings affecting the child, whether directly or through a representative or an appropriate body, in accordance with the procedural rules of national law.
Are there any particular requirements/ prohibitions related to:
a. processing specific types of children’s personal data;
b. carrying out specific processing activities involving children’s personal data; and/ or
c. using children’s personal data for specific purposes.
Yes.
Colombia's Data Protection Law Law N°. 1.581 describes the data of minors as a special category and as such they deserve enhanced protection to ensure that their fundamental rights are respected.
In addition, Section 12 of Decree 1377/2013 establishes that the processing of personal data of children and adolescents in Colombia is prohibited, except in cases involving data of a public nature, in accordance with the provisions of Section 7 of Law N° 1.581. In addition, the processing must comply with the following parameters and requirements: (i) best interests: it must respond to and respect the best interests of children and adolescents and (ii) fundamental rights: it must ensure respect for their fundamental rights.
Also, the Decree establishes that once these requirements have been met, the legal representative of the child or adolescent must grant the authorization, following an assessment of the exercise of the child's right to be heard. This opinion will be assessed taking into account the maturity, autonomy and capacity of the child to understand the matter.
It is important that all controllers and processors of children's personal data ensure the appropriate use of this information. To this end, they should apply the principles and obligations set out in Law N° 1.581 of 2012 and Decree 1377/2013. In addition, it is the responsibility of the family and society to ensure that those responsible for the processing comply with these obligations.
Has there been any enforcement action by your national data protection/ privacy regulator(s) concerning the processing of children’s personal data? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
The Colombian data protection authority, the Superintendence of Industry and Commerce sanctioned a multinational technology company for processing children's personal data without proper parental consent, violating the country's data protection regulations under Law N°1.581 of 2012. The sanction was based on the company's failure to implement adequate mechanisms for obtaining parental authorization before processing data from minors.
Are there specific rules concerning electronic direct marketing to children?
No.
There are no specific rules regarding direct marketing to minors.
Are there specific rules concerning the use of adtech tracking technologies, profiling and/or online targeted advertising to children?
No.
There are no specific rules concerning the use of adtech tracking technologies, profiling, or online targeted advertising directed at children.
Are there specific rules concerning online contextual advertising to children?
No.
There are no specific rules regarding online contextual advertising directed at children.
Has there been any regulatory enforcement action concerning advertising to children? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
The Colombian data protection authority, the Superintendence of Industry and Commerce (SIC) sanctioned a large beverage company. for misleading advertising aimed at minors in the promotion of a particular drink product. The campaigns contained misleading messages about the fruit content of the product, suggesting nutritional benefits that were not real. The SIC found that the rights of children as consumers were violated due to the lack of truthful information and the exaggeration of the product's qualities.
At what age does a person acquire contractual capacity to enter into an agreement to use digital services?
The contractual capacity to enter into agreements, including those related to digital services, is acquired at the age of 18, which is the age of majority under the Colombian Civil Code.
Do consumer protection rules apply to children?
Yes.
Section 5 of Consumer Protection Law No.1480 defines a consumer as any natural or legal person who, as the final recipient, acquires, enjoys or uses a given product, whatever its nature, for the satisfaction of a personal, private, family or domestic and business need when it is not intrinsically linked to his or her economic activity.
Are there any consumer protection rules which are specific to children only?
Yes.
Section 52 of Consumer Protection Law No. 1.480 stipulates that when a sale is made using e-commerce tools, the supplier shall take all possible measures to verify the age of the consumer. In case the product is to be purchased by a minor, the supplier shall record the express authorisation of the parents to carry out the transaction.
Has there been any regulatory enforcement action concerning consumer protection requirements and children’s use of digital services? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
The Colombian data protection authority, the Superintendence of Industry and Commerce, sanctioned an e-commerce technology company for several violations of consumer protection rules, including the lack of measures to prevent the delivery of alcoholic beverages to minors. The sanction highlighted deficiencies in the quality of service, such as double charges and delivery failures, as well as the omission of warnings about the harmfulness of advertised products, such as alcoholic beverages. It was confirmed that the company did not implement sufficient mechanisms to verify the age of users, in breach of its obligation to protect minors in e-commerce.
Are there any age-related restrictions on when children can legally access online/ digital services?
No.
However, please be advised that, under Colombian law, minors can provide consent when they are at least 18 years old.
Are there any specific requirements relating to online/ digital safety for children?
Yes.
Section 52 of Consumer Protection Law No. 1.480 stipulates that when a sale is made using e-commerce tools, the supplier shall take all possible measures to verify the age of the consumer. In case the product is to be purchased by a minor, the supplier shall record the express authorisation of the parents to carry out the transaction.
Are there specific age verification/ age assurance requirements concerning access to online/ digital services?
No.
There are no specific age verification/age assurance requirements. However, the law requires the consent of the parents of children under the age of 18. Consent must be obtained from the parent or legal guardian, according to jurisprudence in Colombia.
Are there requirements to implement parental controls and/or facilitate parental involvement in children’s use of digital services?
No.
There are no requirements to implement parental controls. However, the Colombian data protection authority, the Superintendence of Industry and Commerce, has indicated that the burden of obtaining parental consent falls on the platform and that obtaining declarations by the minor that parental consent was collected will not be considered valid.
Has there been any regulatory enforcement action concerning online/ digital safety? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
The Colombian data protection authority, the Superintendence of Industry and Commerce, sanctioned a social media company for failing to comply with Colombian data protection regulations, especially in relation to minors. The investigation revealed that the company handled data on 1.93 million children and adolescents without complying with legal requirements, such as providing clear information on the use of data or having policies in Spanish. There were also failures to obtain consent from children's legal representatives. Sanctions included fines of up to 2,000 legal minimum wages.
Are there any existing requirements relating to children and AI in your jurisdiction?
No.
N/A
Are there any upcoming requirements relating to children and AI in your jurisdiction?
No.
N/A
Has there been any other regulatory enforcement activity to date relevant to children’s use of digital services? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
The Colombian data protection authority, the Superintendence of Industry and Commerce, sanctioned a disposable vape company for failing to comply with several provisions of Law No. 1.480 in the sale of vapes through digital media. The company failed to provide clear and sufficient information on nicotine levels in its products and on health risks, which particularly affected young and underage consumers. In addition, shortcomings were found in the company's guarantee policies and in the promotion of its products, in breach of consumer protection rules, especially as regards advertising to minors.
Are there any other existing or upcoming requirements relevant to children’s use of digital services?
No.
There are no additional existing or upcoming legal requirements specific to children's use of digital services in Colombia. However, the Colombian data protection authority, the Superintendence of Industry and Commerce, has published a guide that includes a model for parental consent authorisation in case data is collected from minors. This guide is non-binding and serves as a general guideline to promote safe practices among minors.
Note also only one bill of law, BoL No. 478/2024C (which aims to regulate minors’ use of social media and digital platforms) relates to children as users of digital services. This was filed in March 2024.
Contributors
Pablo Palazzi
Allende & Brea
Mercedes Elaskar
Allende & Brea
Ariana Urba
Allende & Brea
