Legislation · 12 Oct 2023 · Rob Nidschelm

Colombia’s ‘Stop Bugging Me’ Law Turns Contact Preferences Into System Rules

Colombia’s Law 2300 regulates when, how and how often organisations may contact consumers. Compliance depends on shared preferences across diallers, messaging systems and outsourced agents.

Colombia enacted Law 2300 on 10 July 2023. Known publicly as the “Dejen de Fregar” or “Stop Bugging Me” law, it became applicable three months later, on 10 October 2023.

The law began with debt collection but also applies important contact controls to commercial and advertising messages. It is a useful example of privacy legislation moving beyond consent text and into the behaviour of communication systems.

Consumers choose the authorised channels

Entities engaged in collection activity may contact a consumer only through channels the consumer has authorised. Those channels must be explained so the person can make a meaningful choice.

A general term in a long credit agreement is not an adequate technical control. The organisation needs a current preference record that identifies the permitted channels and makes that decision available to employees, agencies and automated tools.

If a person authorises email but not WhatsApp or telephone, every campaign and collection workflow must enforce that distinction.

Frequency and hours must be enforced centrally

After direct contact has been established, a collection agent may not contact the consumer through several channels in the same week or more than once on the same day.

Collection activity is generally limited to Monday through Friday from 7:00 to 19:00 and Saturday from 8:00 to 15:00. Sundays and public holidays are excluded. A consumer can request different hours, but that request must be expressed separately from the agreement governing the underlying relationship.

These limits are difficult when several suppliers share a debtor portfolio. A call by one agency, an automated SMS from another and an internal email may each appear compliant in isolation while breaching the combined frequency rule.

The source of truth therefore has to operate across channels and vendors. It must record successful contact, not only attempted calls, and apply the correct Colombian time and holiday calendar.

References and workplaces receive protection

Collectors generally cannot contact personal or other references. Guarantors, co-debtors and joint debtors must be contacted under the same conditions established by the law.

Home and workplace visits are also restricted, subject to defined exceptions. These rules should be reflected in field-collection tools and supplier instructions, not left to agent discretion.

Advertising systems are also affected

The law applies the contact rules to commercial advertising through SMS, application messaging, email and telephone. It reinforces the excluded-numbers register and requires an easy, efficient mechanism for cancelling messages.

An organisation cannot require a person making a purchase or entering a premises to accept unrelated marketing. Where a promotion is designed to build a marketing database, that purpose must be clear and accepted explicitly.

Operational and security communications remain distinguishable. Alerts about suspicious transactions, requested information and confirmations of monetary operations are among the statutory exceptions. Systems should classify these messages correctly rather than labelling every customer communication “service-related”.

What a compliant contact platform needs

• A central record of channel permission, source, timestamp and purpose.
• Suppression that reaches employees, automated platforms and third-party agencies.
• Local time, weekend and public-holiday controls.
• Frequency limits calculated across all channels and suppliers.
• Separation between collection, advertising, transactional and fraud messages.
• A fast opt-out that does not require speaking to an agent.
• Audit logs showing who contacted the person, when, through which channel and why.
• Contractual monitoring of outsourced collection and marketing providers.

Contact governance is data governance

The law does not prohibit legitimate collection or customer communication. It requires organisations to treat access to a person’s attention as a controlled permission.

That permission cannot be governed reliably inside separate call-centre spreadsheets. It has to be represented as shared, testable system state. When the consumer changes a preference, every downstream channel should change with it.

Official sources

• Colombian Government: Law 2300 of 2023
• Colombian Superintendence of Industry and Commerce: Enforcement involving commercial prospecting

This article provides general information and is not legal advice.