Madagascar has no cookie-specific law, but cookies that collect personal data fall under Law No. 2014-038 on the protection of personal data, which makes prior consent the default legal basis. Its regulator, the Commission Malagasy de l'Informatique et des Libertés (CMIL), stood empty for a decade: its seven members were sworn in before the Supreme Court on 4 August 2025, so as of October 2026 Madagascar has a working data protection authority.
Madagascar's data protection framework: Law 2014-038
Madagascar adopted Law No. 2014-038 on 16 December 2014, with the law coming into force upon publication in the Official Gazette on 20 July 2015. The legislation was modelled on the EU Data Protection Directive (95/46/EC), with input from Francophone data protection authorities through the Association francophone des autorites de protection des donnees personnelles (AFAPDP).
The law establishes rules for collecting, processing, storing, and transferring personal data. It applies to any entity processing the personal data of individuals located in Madagascar, regardless of where the data controller is based.
A key detail for website owners: the law does not contain specific provisions on cookies, local storage objects, or similar tracking technologies. That gap does not mean your site is exempt from regulation. Any cookie that collects personal data - an identifier stored in _ga, a session token in PHPSESSID, or a marketing pixel like _fbp - falls under the general data processing rules of Law 2014-038.
Legal bases for processing personal data
Law 2014-038 follows a consent-first model. Before processing personal data, you must obtain prior consent from the data subject or rely on one of the alternative legal bases the law recognises.
The six lawful bases are:
Prior consent of the data subject
Compliance with a legal obligation
Protection of the data subject's life or vital interests
Execution of a public service mission
Performance of a contract or pre-contractual measures
Legitimate interest of the data controller, balanced against the rights of the individual
This structure closely mirrors the consent requirements in the GDPR and frameworks modelled on it. For most websites, setting analytics or advertising cookies before obtaining consent would require reliance on the consent basis, since the other grounds rarely apply to marketing-driven data collection.
How the law compares to the GDPR and other African laws
Madagascar's law predates the GDPR by several years, drawing instead from the 1995 EU Data Protection Directive. The similarities are clear: purpose limitation, data minimisation, and a consent-first approach all feature prominently. The differences are equally notable.
| Requirement | Madagascar (Law 2014-038) | EU GDPR | South Africa (POPIA) | Kenya (DPA 2019) |
|---|---|---|---|---|
| Primary legislation | Law 2014-038 (2015) | Regulation 2016/679 | POPIA (2020) | Data Protection Act (2019) |
| Supervisory authority | CMIL (members sworn in August 2025) | National DPAs | Information Regulator | ODPC |
| Cookie-specific rules | No | Yes (ePrivacy Directive) | No (general processing rules) | No (general processing rules) |
| Consent required | Prior consent (default basis) | Freely given, specific, informed | Voluntary, specific, informed | Free, informed consent |
| Maximum financial penalty | 5% of turnover, excluding tax, in the last closed financial year | 4% of global turnover or EUR 20m | ZAR 10 million | KES 5 million |
| Criminal sanctions | 6 months to 2 years, up to 5 years for sensitive data | Varies by member state | Up to 10 years imprisonment | Not specified |
For a broader view of African data protection, see the country guides for Kenya, Mozambique, and South Africa (POPIA).
The CMIL is now a working authority
Law 2014-038 created the Commission Malagasy de l'Informatique et des Libertes (CMIL) as the supervisory authority responsible for enforcement. On paper, the CMIL has significant powers: it can conduct on-site inspections, request documents, perform online verifications, and issue sanctions.
For years those powers existed only on paper, because the CMIL had no members. Decree No. 2023-1541 of December 2023 set out its attributions and functioning, and on 4 August 2025 its seven new members took their oath before the Supreme Court in Antananarivo, in the presence of the Prime Minister. As of October 2026, Madagascar therefore has an active data protection authority, though it has not yet published decisions or guidance on cookies.
Authorities in Africa have moved from dormancy to enforcement before: Nigeria's NDPR is a recent example.
Penalties under Law 2014-038
The sanctions under Law 2014-038 are more severe than many website owners expect from a developing regulatory framework.
Under Article 59, the CMIL's financial penalties can reach 5% of turnover, excluding tax, in the last closed financial year. For comparison, the GDPR caps fines at 4% of worldwide annual turnover. The law also sets criminal penalties, imposed by the courts: processing personal data without the required prior formalities carries six months to two years in prison and a fine of Ar 200,000 to 2,000,000 (Article 62), and offences involving sensitive data carry two to five years. Courts may order the erasure of unlawfully processed data, and the CMIL can withdraw processing authorisations entirely.
Consent requirements for cookies on Malagasy websites
Although Law 2014-038 does not mention cookies explicitly, the consent provisions apply to any processing of personal data. If your website sets cookies that collect or store personal data - and most analytics and marketing cookies do - you need a lawful basis.
The law does not say so expressly, but strictly necessary cookies, such as PHPSESSID for session management or a cookie that stores a chosen language, can likely be justified under the contract performance or legitimate interest bases. Analytics cookies like _ga or advertising cookies like _fbp almost certainly require prior consent.
A cookie banner that asks visitors for consent before non-essential cookies are set is the most practical approach. The banner should clearly explain what data is collected and why, giving visitors a genuine choice to accept or refuse.
Running a cookie scan on your website is the first step to understanding which cookies you set and whether any of them process personal data.
Cross-border data transfers
Law 2014-038 restricts transfers of personal data to countries that do not provide a sufficient level of protection for privacy and fundamental rights. Transfers are permitted only where the data subject has given informed consent, the transfer is necessary for contract performance, the transfer serves the public interest, or the transfer is needed for legal defence.
The recipient of transferred data cannot retransfer it to a third party without approval from both the original data controller and the CMIL. If your website uses third-party analytics or advertising services hosted outside Madagascar, these transfer provisions are directly relevant.
Data subject rights under Law 2014-038
Individuals in Madagascar have the right to opt out of marketing uses of their personal data without providing a reason. The law also requires that personal data be processed fairly and lawfully, kept accurate and up to date, and retained only for as long as necessary.
Your website should provide a mechanism for visitors to withdraw consent and request information about the data you hold. A consent management platform with geo-detection can help you apply Madagascar-specific rules to visitors from the country while maintaining different settings for other jurisdictions.
Checklist for your website
These steps cover what Law 2014-038 asks of a website that uses cookies.
Audit your cookies - Use an automated cookie scanner to identify every cookie your site sets, including third-party cookies from analytics and advertising scripts.
Classify cookies by purpose - Group cookies into categories: strictly necessary, functional, analytics, and marketing.
Implement a consent mechanism - Display a cookie banner that collects prior consent before setting non-essential cookies. Make sure the banner offers a clear accept and refuse option.
Draft a cookie policy - Publish a transparent cookie policy explaining which cookies you use, what data they collect, and how long they persist.
Review cross-border transfers - Check whether your third-party services transfer data outside Madagascar and confirm a lawful transfer mechanism is in place.
Document processing activities - Maintain records of what personal data you collect, why, and on what legal basis.
Watch the CMIL - Follow its deliberations and any guidance it publishes on cookies.
Questions about cookie consent in Madagascar
Does Madagascar have a specific cookie law?
No. Law 2014-038 does not contain specific provisions on cookies, local storage, or similar tracking technologies. Cookies that collect personal data fall under the general data processing rules of the law, which require prior consent or another valid legal basis.
Is cookie consent required for websites targeting Madagascar?
Yes, if your cookies collect personal data. Law 2014-038 requires prior consent as the default basis for processing personal data. Analytics and marketing cookies almost always collect personal identifiers, so consent is the appropriate legal basis.
What is the CMIL and is it active?
The CMIL (Commission Malagasy de l'Informatique et des Libertes) is the data protection authority created by Law 2014-038. Its seven members were sworn in on 4 August 2025, so it has been active since then, although it has not yet published guidance on cookies.
What are the penalties for data protection violations in Madagascar?
The CMIL's financial penalties can reach 5% of turnover, excluding tax, in the last closed financial year. Courts can impose six months to two years in prison for processing without the required formalities, and up to five years for sensitive data offences. Courts can also order the erasure of unlawfully collected data.
How does Madagascar's data protection law compare to the GDPR?
Both laws share a consent-first approach and recognise similar legal bases for processing. The GDPR caps fines at 4% of global turnover, while Madagascar's law sets a 5% cap on prior year pre-tax turnover. A major difference is the track record: EU authorities have years of decisions, while Madagascar's CMIL only began work in August 2025.
Can I transfer personal data from Madagascar to another country?
Only if the receiving country provides a sufficient level of protection for privacy rights, or if you have the data subject's informed consent, a contractual necessity, or a public interest justification. The recipient cannot retransfer data without approval from the original controller and the CMIL.
Ask visitors in Madagascar before cookies load
Law 2014-038 makes prior consent the default for cookies that collect personal data. Kukie.io scans your site, blocks non-essential cookies until consent and keeps a record of each choice.
