Yes, a website with visitors in Cameroon needs consent before setting non-essential cookies. Law No. 2024/017 of 23 December 2024 on the protection of personal data requires the data subject's consent unless the law provides otherwise, and cookies like _ga and _fbp collect personal data. Its 18-month transition ended in June 2026, so the law now applies in full. It also requires prior authorisation from the new data protection authority for processing and for transfers abroad.
Cameroon's data protection framework, from Law 2010/012 to Law 2024/017
Cameroon passed its first privacy-related legislation in 2010. Law No. 2010/012 of 21 December 2010 addressed cybersecurity and cybercrime, including some provisions on electronic communications and personal data. That law was limited in scope and had no dedicated supervisory authority with real enforcement powers.
On 23 December 2024, Cameroon adopted a comprehensive data protection law. Law No. 2024/017 on the protection of personal data covers processing principles, consent, data subject rights, cross-border transfers and penalties.
The law gave organisations an 18-month transition, which ended in June 2026. If your website collects data from visitors in Cameroon, the rules apply to it now.
Who Law 2024/017 applies to
The law applies to any person or organisation that processes personal data of individuals established in, residing in or passing through Cameroon. This reach beyond the country's borders mirrors the GDPR's approach, so a website hosted outside Cameroon but aimed at Cameroonian users falls within it.
Personal data under the law includes any information that can identify a natural person, directly or indirectly. Cookies that store device identifiers or IP addresses, or track browsing behaviour, fall within this definition.
Cookie consent requirements under the law
According to DLA Piper's summary of Cameroon's data protection law, controllers must obtain the data subject's consent unless the law provides otherwise. The law does not regulate cookies by name: DLA Piper expects the authority's security framework, or a regulation from the Ministry of Posts and Telecommunications, to address cookies specifically.
Until then, the consent rule decides it. Your cookie consent banner should meet several conditions:
- Consent is collected before any non-essential cookies are set
- Visitors receive clear information about what data is collected and why
- Withdrawing consent is as easy as granting it
- Pre-ticked boxes and implied consent through continued browsing do not count
Strictly necessary cookies, such as PHPSESSID for session management, rest on the law's other grounds rather than on consent, because the site cannot work without them. Analytics cookies like _ga and marketing cookies like _fbp need prior consent.
The Personal Data Protection Authority
Law 2024/017 establishes an independent supervisor, the Personal Data Protection Authority (Autorité de protection des données à caractère personnel, or APDP).
The APDP is responsible for:
- Regulating data protection practices across Cameroon
- Investigating complaints from data subjects
- Conducting audits and inspections
- Issuing binding decisions and sanctions
- Issuing prior authorisations for processing and for cross-border transfers
Article 19 of the law makes processing subject to prior authorisation from the APDP, and a draft implementing decree sets out three types of authorisation. As of October 2026, whether the authority is fully up and running and the decree adopted could not be confirmed from a source opened for this update. The end of the transition does not depend on it: the law's obligations apply either way.
Penalties for non-compliance
Published summaries of the law describe a sanctions regime that is severe by regional standards, with administrative, civil and criminal penalties. Check the official text for the exact amounts before you rely on them.
| Violation type | Penalty, as reported |
|---|---|
| Processing without valid consent | Administrative fines up to XAF 1 billion (about EUR 1.5 million) |
| Failure to secure personal data | Criminal fines and up to 10 years' imprisonment |
| Unauthorised cross-border data transfer | Joint liability for sender and recipient, with administrative and criminal sanctions |
| Obstructing APDP investigations | Criminal penalties including imprisonment |
| Failure to notify data breaches | Administrative sanctions from the APDP |
Personal liability for executives is a notable feature. Directors and officers can face individual fines and prison sentences, not just the organisation.
How Cameroon compares with the GDPR and Nigeria
Cameroon's law draws heavily on European models but includes some distinct provisions.
| Feature | Cameroon (Law 2024/017) | GDPR (EU) | Nigeria (NDPA) |
|---|---|---|---|
| Consent basis | Consent unless the law provides otherwise | Consent for cookies, several legal bases for other processing | Consent or another lawful basis |
| Supervisory authority | APDP (new) | National authorities (established) | NDPC (operational) |
| Prior authorisation | Required for processing and transfers | Not required | Not required |
| Criminal penalties | Reported up to 10 years' imprisonment | Varies by member state | Limited |
| Cross-border transfers | Prior APDP authorisation | Adequacy decisions or SCCs | Adequate safeguards |
| Transition | 18 months, ended June 2026 | 2 years, ended May 2018 | Already in force |
For the Nigerian rules in detail, see cookie consent under Nigeria's NDPR and NDPA. Ghana's Data Protection Act 2012 and Kenya's Data Protection Act 2019 also include criminal provisions.
Checklist for website operators
If your website receives traffic from Cameroon, these steps apply now that the transition has ended:
- Audit your cookies. Run a cookie scan to identify every cookie and tracker on your site, including third-party scripts from analytics and advertising platforms.
- Categorise cookies. Separate them into strictly necessary, functional, analytics and marketing categories. Only strictly necessary cookies may load without consent.
- Ask before non-essential cookies. Your banner must block non-essential cookies until the visitor actively consents. A dismiss button or "continue browsing" does not count as consent.
- Disclose clearly. Your cookie policy should list each cookie by name, purpose, provider and retention period.
- Make withdrawal easy. Visitors must be able to change or revoke their consent at any time without going through several menus.
- Check your authorisations. Find out whether your processing and your transfers outside Cameroon need prior authorisation from the APDP.
- Keep consent records. Keep logs of when and how consent was obtained, since this is your evidence if the APDP investigates a complaint.
Cross-border data transfers
Law 2024/017 makes transfers of personal data outside Cameroon subject to prior authorisation from the APDP. Before granting it, the authority checks for safeguards, including standard contractual clauses that it is to draw up and publish, according to DLA Piper. Reports of the law describe the sender and recipient as jointly liable for violations, which creates shared risk for businesses using cloud services or analytics hosted abroad.
For websites relying on Google Analytics, the Meta Pixel or other services that send data to servers outside Cameroon, valid consent before these scripts fire is the first safeguard. Geo-targeting lets you apply the consent model you set for Cameroon to visitors from there, alongside the rules for other countries' privacy laws.
Questions about Cameroon's data protection law
Does Cameroon require cookie consent for all websites?
Law 2024/017 requires consent for processing personal data of individuals in Cameroon unless the law provides otherwise. Since non-essential cookies collect personal data such as device identifiers and browsing behaviour, websites aimed at Cameroonian users need cookie consent. Strictly necessary cookies are the exception.
Is Cameroon's data protection law in force now?
Yes. Law 2024/017 was enacted on 23 December 2024 with an 18-month transition, which ended in June 2026. Its obligations, including consent and prior authorisation, now apply in full.
What is the maximum fine under Cameroon's data protection law?
Published summaries report administrative fines of up to XAF 1 billion, about EUR 1.5 million, and imprisonment of up to 10 years for serious violations, with personal liability for executives. Check the official text for the exact amounts.
Can I transfer personal data from Cameroon to another country?
Transfers are permitted with prior authorisation from the Personal Data Protection Authority (APDP), which checks for safeguards such as its standard contractual clauses. The sender and recipient are reported to be jointly liable for violations.
How does Cameroon's law compare with the GDPR?
It shares many features with the GDPR, including consent, data subject rights and breach notification. Key differences are prior authorisation from the authority for processing and transfers, and criminal penalties reported at up to 10 years' imprisonment.
Do I need a cookie banner if my website is not hosted in Cameroon?
Yes. The law applies to any processing of data of people in Cameroon, regardless of where the website or server is located.
Set the consent rules for visitors from Cameroon
If you are not sure which cookies your site sets, start with a scan. Kukie.io scans your site, blocks non-essential scripts until visitors accept them, applies the consent model you set for each country and records every choice.
