Colombia regulates digital privacy for minors

Colombia's Decree 0769 of 2026, issued on July 16, gives force to Law 2489 of 2025 on healthy and safe digital environments for children and sets privacy by design and by default obligations for platforms aimed at minors.

What the rule requires

According to the text released by the national government and the Ministry of ICT, providers of digital platforms that operate services for minors must put limits on profiling and on targeted advertising based on children's data, in line with data protection principles that apply to minors. They must also manage risks and report compliance progress to the relevant ministry every six months.

The decree also orders the drafting, within 12 months, of a National Public Policy on Healthy and Safe Digital Environments for girls, boys and adolescents. That policy will serve as the state coordination framework for online protection measures.

Operational scope

Among the public measures tied to the regulation is a free repository of resources and best practices for families, students and teachers. That space may not include targeted advertising aimed at minors or require the collection of personal data as a condition of access, reinforcing default privacy obligations in educational and awareness content.

The rule also creates an Integrated System for Monitoring, Evaluation and Technological Development, coordinated by MinTIC and with formal participation from the Ministry of Education, ICBF, the Attorney General's Office and the Ministry of Defense. The goal is to track digital risks and violence against minors.

In its public presentation of the decree, the national government and MinTIC framed it as a tool to prevent specific online risks, including cyberbullying, sexual exploitation and abuse, digital grooming, privacy violations and exposure to inappropriate content.

Technical reading and regulatory debate

Audio and video coverage from national media added that messaging apps and social networks will have to ban algorithmic profiling for advertising and addictive content aimed at children, and enable immediate reporting channels to the Attorney General's Office and ICBF when cases of violence or risk involving minors are identified.

At the same time, an academic analysis from Universidad El Bosque said the decree relies on a self-regulatory model for platforms. In that reading, age verification measures, parental controls and protection tools are required, but the text does not force disclosure of source code or algorithmic models, and several obligations depend more on best practices than on direct technical oversight by the state.

The same university warned about gaps and proposed that the state move toward mandatory default parental controls on devices and platforms, so protection does not depend only on industry self-regulation and on each family's individual supervision.

Fit with the sector framework

Infobae Colombia reported that Decree 0769 of 2026 adds a new title to Decree 1078 of 2015, the ICT sector's Single Regulatory Decree, bringing child online protection obligations into the existing sector regulatory framework.

In that same regulatory environment, Colombian media say a bill is moving through Congress that would toughen platform responsibility over minors' access to social networks, with age verification through identity documents, facial recognition or other tools, and with the Superintendency of Industry and Commerce as the inspection, oversight and control authority, carrying fines of up to 5,000 legal minimum wages for noncompliance. Political and technology analysis programs also link that initiative to a possible ban on social networks for children under 14 and restricted access for those between 14 and 16.