In January 2026, Colombia’s SIC (Superintendence of Industry and Commerce) issued Circular Externa SIC 002 de 2026, imposing mandatory restrictions on bulk political A2P SMS and cross-border political marketing calls during the election cycle. Grounded in the *Ley 1581‑2012 Personal Data Protection Act* and Decreto 1074‑2015, the circular binds political parties, candidates and campaign marketing service providers.
Core mandatory provisions: Sending political campaign SMS or outbound calls requires prior, explicit and informed consent from users. Bulk delivery of campaign messages without consent is prohibited. It is forbidden to purchase mobile number lists from overseas to send mass political communications within Colombia. Users may not be added to broadcast lists or instant messaging groups without consent. Political affiliation is classified as sensitive personal data; profiling and audience segmentation are not allowed without clear user authorisation. Where AI is deployed to distribute political messages, data subjects must be transparently informed of data sources, segmentation logic and AI utilisation. Simple, accessible channels must be provided for users to access, rectify or delete their personal data. SIC will conduct rigorous investigations and impose substantial administrative fines against non-compliant entities.
The regulation applies equally to cross-border operations: Foreign organisations are prohibited from originating inbound political campaign SMS or calls. Even when relayed via local PCA/IT integrators, valid consent records for every recipient must be fully retained. Registered party members and supporters lists may only be used for internal communications and cannot be shared externally.
