Key aspects from the criminal law perspective
This new legislation introduces significant changes to the criminal treatment of identity theft, addressing emerging risks associated with advanced technologies. The most relevant points include:
- New aggravating factor: The law modifies Article 296 of the Criminal Code, establishing that when identity theft is committed using AI, the applicable fine may be increased by up to one-third, provided the conduct does not constitute another crime.
- Legal recognition of deepfakes: For the first time, the Colombian criminal framework includes a legal definition of "deepfake" as AI-generated audiovisual content that falsely appears authentic, aiming to combat new forms of identity fraud.
- Traceability and criminal analysis: The Office of the Attorney General must implement a traceability system for cases involving the use of AI in identity falsification. This registry should allow the identification of criminal patterns, impacts, emerging risks associated with digital technologies, and the judicial measures applied.
Additionally, the law mandates the development of a joint public policy by the National Government, the Attorney General's Office, the National Police, and the Ministry of Information Technologies and Communications (MinTIC), with a focus on digital ethics, cybersecurity, international cooperation, transparency, and rapid response to identity theft incidents.
Current situation
The aggravating factor will come into effect one year after the law's enactment, with implementation expected by July 2026. This transition period is intended to give authorities time to strengthen their investigative and technological capabilities, align with public policies on the use and risks of emerging technologies, and establish protocols for responding to identity theft incidents involving AI.
This reform aligns with a global context of increasing concern over the malicious use of AI and represents a significant step toward protecting digital identity and building trust in virtual environments.
Biometric data
Due to their nature as sensitive data, the collection and processing of biometric data is subject to special regulation under the law and requires enhanced diligence from the data controller. Currently, biometric data is the subject of a regulatory project by the Superintendence of Industry and Commerce. In the draft Circular on the processing of personal data in the provision of financial services through digital technologies (fintech), the following obligations are included:
At the time of collection, the data controller must: (i) Inform the data subject, specifically, of the precise purposes for which their biometric data will be processed and why the collection of such data is necessary; and (ii) obtain additional and explicit consent for the processing of biometric data, in accordance with the stated purposes and necessity.
Throughout the entire processing cycle, both the controller and the processor must: (i) Refrain from using biometric data for purposes not explicitly consented to; (ii) implement additional security measures to ensure the protection of biometric data; (iii) take reasonable steps to ensure that the processing of biometric data is proportional to the risk level of the activity involved; (iv) refrain from sharing collected biometric data with third parties and from feeding centralized or integrated biometric databases; and (v) proceed with the deletion of biometric data within a reasonable period once the contractual relationship with the data subject has ended and the specific purposes for which the data was authorized no longer exist.
Additional information
For further details, you may consult Law 2502 of 2025 at the following link: Ley 2502 de 2025 Congreso de la República de Colombia.
Click here to read Spanish version.
