In short: in Colombia, prospect only through channels the person has authorized, and never by cold WhatsApp, SMS or phone call. In Mexico, work email gives you more room, but every email needs a one-click opt-out and your site needs a privacy notice. In both countries, honor an opt-out the same day. HubSpot can do most of this on its own.
In October 2025, Colombia's Superintendence of Industry and Commerce (SIC) fined Movistar 670 million Colombian pesos for contacting people by SMS, WhatsApp and phone for commercial purposes without prior, express and informed authorization. This was not a small company without lawyers. It was a telecom carrier.
We ran our own review on September 27, 2026. We had 27 Colombian contacts in cold email sequences. The result of that cycle: zero positive replies and two opt-outs, one of them citing habeas data. That same day we removed all 27 from every sequence and changed the rule: in Colombia, permission comes first. This article explains why and what you can still do. It is not legal advice; before scaling in a country, one hour with a local data protection lawyer is worth it.
Colombia: the person authorizes the channel
Two laws overlap. Law 1581 of 2012 (habeas data) requires prior, express and informed authorization to process personal data. In a 2024 opinion, the SIC said corporate data such as an institutional email address falls outside that law, but it did not distinguish between sales@company.com and firstname.lastname@company.com. That is the gray zone.
The second is Law 2300 of 2023, known as "Dejen de fregar" ("stop bothering us"). Article 2 says consumers may only be contacted "through the channels they authorize", and article 5 extends the schedule in article 3 to commercial messages, email included: Monday to Friday 7 a.m. to 7 p.m., Saturday 8 a.m. to 3 p.m., never on Sundays or holidays. The law does not say whether it covers business-to-business sales, and the SIC has not settled it. Our cautious reading: a few contacts are not worth fighting over that gray zone.
Mexico: more room with work email, not with everything
Mexico's new Federal Law on the Protection of Personal Data Held by Private Parties took effect on March 21, 2025 (in Spanish). The INAI was dissolved and authority over private companies moved to the Ministry of Anti-Corruption and Good Governance. Two changes matter for prospecting: tacit consent remains the general rule when the person received the privacy notice, and if you use data for a new purpose you need to ask for consent again.
Article 5 of the 2011 regulations excludes work contact data (name, title, work email) when used in a work context. That is what gives cold B2B email some room. Before relying on that article, check with your lawyer whether new regulations have been published. What does not change: your site needs a privacy notice, every email needs a clear way to opt out, and WhatsApp is not a first-touch channel.
Your domain has its own rules
Even when the law lets you write, Gmail decides whether your email arrives. Its sender guidelines ask you to keep the user-reported spam rate below 0.1% and never reach 0.3%, to honor opt-outs within 48 hours, and to offer one-click unsubscribe through the List-Unsubscribe header on marketing email. A domain above 0.3% loses Google's mitigation support until it stays below that line for seven consecutive days.
So the rule is not only legal. If someone asks you to stop and the next sequence email still reaches them, that is the email that gets marked as spam. An opt-out that takes a week to process burns the domain your whole team relies on.
| Channel | Colombia | Mexico |
|---|---|---|
| Email to a named person | Only with channel authorization | Yes, with an opt-out in every email and a privacy notice |
| Generic email (sales@, contact@) | One email asking who to talk to, within Law 2300 hours | Yes |
| WhatsApp or SMS | Only with a number the person gave you, plus opt-in | Only with a number the person gave you, plus opt-in |
| Cold call | No | Not as a first touch; after a first exchange, yes |
| LinkedIn, content, referrals, events | Yes, and it is the best route | Yes |
How to set it up in HubSpot so it happens on its own
HubSpot already has the pieces. Under Settings, General, Email tab, the "Include unsubscribe link" checkbox adds the opt-out to one-to-one and sequence emails. Note that emails sent from Gmail or Outlook through the sales extension do not get it. When a contact clicks that link, HubSpot unenrolls them from the sequence automatically, just as it does when they reply, book a meeting or bounce.
What HubSpot does not decide is who can be enrolled. You define that rule: a property that stores the authorization (date, channel and source), a filter that blocks enrolling contacts with country Colombia without it, and forms that ask for consent and the preferred channel. With that in place, an opt-out is executed the same day without anyone having to remember.
What you can do this week
- Filter your sequence-enrolled contacts by country. If any are in Colombia without recorded authorization, remove them today.
- Check under Settings, General, Email that the unsubscribe link is on for every user, and send a test email to yourself to see it.
- Open Google Postmaster Tools for your domain and write down your spam rate for the last 30 days. If it is above 0.1%, pause cold sends before it reaches 0.3%.
When do you actually need help?
If your team prospects in several countries, with several sequences and no property that says who authorized what, the risk is not in one email, it is in the architecture. Sorting out consent, enrollment filters and opt-outs in a portal with history takes a couple of well-run weeks. If you want us to review it inside your portal, that is what our HubSpot assessment does.
If you want to know where your HubSpot stands today, the free self-assessment takes 3 minutes (in Spanish).
Frequently asked questions
Can I send cold email to a company in Colombia?
To the company's generic address (sales@, contact@), yes, because the SIC considers corporate data outside Law 1581, and within Law 2300 hours. To a named person, the rule has been unclear since 2023. The cautious move is to ask for permission first through another route, such as LinkedIn, a referral or a form.
Can I message a prospect on WhatsApp if they did not give me their number?
No. In Colombia that is exactly what Movistar was fined for, and in any country WhatsApp Business policy requires that the person gave you the number and agreed to receive messages. WhatsApp works very well as a second channel, once the conversation already exists.
What happens if someone opts out but is still enrolled in another sequence?
If they use HubSpot's unsubscribe link, they leave the sequence and are unsubscribed from that subscription type. If they ask by replying, someone has to record it. That is why a workflow helps: when the opt-out is marked, it removes the contact from every sequence and excludes them from future enrollment the same day.