Morocco has no standalone cookie law. Cookies that collect personal data fall under Law 09-08, which requires the visitor's unambiguous consent and a declaration of the processing to the CNDP, Morocco's data protection authority. Since 28 November 2025, a simplified declaration form exists for cookies.
How Law 09-08 governs cookies in Morocco
Morocco enacted Law 09-08 on 18 February 2009 to protect individuals with regard to the processing of personal data. Its implementing decree, Decree 2-09-165, followed on 21 May 2009. The law created the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) as the country's supervisory authority. The text of Law 09-08 as published in the Bulletin officiel is published by the DGSSI, Morocco's information systems security authority.
No Moroccan statute addresses cookies on their own. Instead, any cookie that collects or contains personal data, such as an IP address, a device identifier or any value that can be linked to an identifiable person, counts as processing of personal data under Law 09-08.
In practice, if your site sets cookies such as _ga, _fbp or any tracker that stores a unique identifier, you are processing personal data under Moroccan law.
What the CNDP requires for cookie consent
Article 4 of Law 09-08 allows processing of personal data only if the person concerned has unambiguously given consent, subject to a list of exceptions. For cookies, that means asking before non-essential cookies are set.
Your cookie banner must do three things:
Inform visitors about which cookies your site uses and why
Obtain consent before setting cookies that process personal data
Explain how visitors can refuse or withdraw consent
Strictly necessary cookies, those required for the basic functioning of a website, such as PHPSESSID or a shopping basket cookie, do not serve a tracking or profiling purpose and are generally treated as not needing consent.
On 28 November 2025, the CNDP adopted Decision D-939-2025, which introduced a simplified declaration form specifically for processing personal data through cookies. The regulator expects controllers to declare their cookie processing formally.
CNDP declaration obligations
Under Article 12 of Law 09-08, data controllers must file either a prior declaration or a prior authorisation request with the CNDP before processing personal data, depending on the type and sensitivity of the data. Standard cookie processing usually falls under the declaration route rather than the stricter authorisation route, which covers sensitive data among other cases.
Decision D-939-2025 makes this simpler for cookies: controllers can file a dedicated, shorter form for cookie-based processing on their websites.
Failing to declare processing to the CNDP is an offence in its own right, separate from any consent violation.
Law 09-08 contains no general duty to notify the CNDP of a data breach, unlike Article 33 of the GDPR. Article 23 requires appropriate technical and organisational measures to protect the data, but sets no breach-reporting deadline.
Fines and enforcement under Law 09-08
The penalties in Law 09-08 are criminal. Each offence carries its own range of fines, and some add a prison term:
| Offence | Article | Fine (MAD) | Imprisonment |
|---|---|---|---|
| Processing without the required declaration or authorisation | 52 | 10,000 to 100,000 | None |
| Refusing access, rectification or objection rights | 53 | 20,000 to 200,000 per offence | None |
| Processing in breach of the consent rule in Article 4 | 56 | 20,000 to 200,000 | 3 months to 1 year, or either penalty alone |
| Processing sensitive data without express consent | 57 | 50,000 to 300,000 | 6 months to 2 years, or either penalty alone |
Two rules raise these figures. When the offender is a company or other legal person, the fines are doubled (Article 64). For a repeat offence within a year of a final conviction, the sanctions are doubled again (Article 65).
No publicised fine specifically for cookies has been found to date. This should not breed complacency: Decision D-939-2025 shows the CNDP turning its attention to cookies, and formal enforcement may follow.
Morocco's Law 09-08 compared to the GDPR
Law 09-08 was modelled on the earlier EU Data Protection Directive (95/46/EC), not the GDPR. The two share core principles, such as lawfulness, purpose limitation, data minimisation and accuracy, but differ in important ways.
Morocco has been a party to the Council of Europe's Convention 108 and its additional protocol since 1 September 2019, the 55th state and the sixth African country to join. Meeting the GDPR gets you close to Moroccan requirements, but the CNDP's declaration system has no direct GDPR equivalent.
| Aspect | Morocco Law 09-08 | EU GDPR |
|---|---|---|
| Year enacted | 2009 | 2016 (applies from 2018) |
| Supervisory authority | CNDP | National authorities in each member state |
| Registration requirement | Declaration or authorisation with the CNDP | No general registration (internal records instead) |
| Cookie-specific rules | No standalone cookie law. Law 09-08 and CNDP decisions apply | ePrivacy Directive and GDPR |
| Consent standard | Unambiguous consent (Article 4) | Freely given, specific, informed, unambiguous |
| Highest fine for one offence | MAD 300,000, doubled for companies and again for repeat offences | €20 million or 4% of worldwide turnover |
| Criminal penalties | Yes, up to 2 years before doubling for repeat offences | Varies by member state |
| Breach notification | No general duty in the law | 72 hours to the authority (Article 33) |
| Cross-border transfers | Only to countries with sufficient protection, or under an exception such as express consent (Articles 43 and 44) | Adequacy decisions, SCCs, BCRs |
Checklist for Moroccan cookie consent
If your website targets visitors in Morocco or processes data using equipment located in Morocco, work through this list:
Audit your cookies. Run a cookie scan to find every cookie your site sets, including those from third-party scripts like
_gaand_fbp.Categorise cookies. Sort them into strictly necessary, functional, analytics and marketing categories.
Display a cookie banner. Show a clear banner before setting non-essential cookies. It should explain the purpose of each category and let visitors accept or refuse.
Block scripts before consent. Do not fire tracking scripts until the visitor has accepted that category.
Publish a cookie policy. Write a cookie policy that lists each cookie by name, purpose, duration and category.
File your CNDP declaration. Submit the right declaration or authorisation form for your cookie-based processing, using the simplified form from Decision D-939-2025 where it applies.
Store proof of consent. Keep records of each choice with a timestamp, and document your processing activities.
Regional context: cookie consent across Africa and the Middle East
Morocco has one of the longer-established data protection regimes in Africa. The CNDP was set up in 2009, well ahead of many neighbouring countries.
If you run websites across several African or Middle Eastern markets, also review the cookie consent rules in Algeria, Egypt, Nigeria, Kenya and Saudi Arabia. Each country has its own rules, registration duties and enforcement record.
South Africa's POPIA is a useful comparison. The Protection of Personal Information Act takes a different approach to consent and has a more active enforcement record.
Questions about cookie consent in Morocco
Does Morocco have a specific cookie law?
No. Morocco has no standalone cookie statute. Cookies fall under Law 09-08 when they process personal data, and CNDP Decision D-939-2025 of 28 November 2025 created a simplified declaration form for cookie processing.
Do I need consent to set cookies for Moroccan visitors?
Yes, for cookies that collect personal data. Article 4 of Law 09-08 requires the person's unambiguous consent, subject to listed exceptions. Strictly necessary cookies for basic site functions are generally treated as not needing it.
What fines can the CNDP impose for cookie violations?
Processing without a declaration carries a fine of MAD 10,000 to 100,000, and processing in breach of the consent rule MAD 20,000 to 200,000 and up to a year in prison. Fines double for companies and again for repeat offences. No publicised fine for cookies alone has been found.
Do I need to register my cookie processing with the CNDP?
Yes. Law 09-08 requires a prior declaration or authorisation with the CNDP before processing personal data. Decision D-939-2025 introduced a simplified form for cookie processing.
Does meeting the GDPR cover Moroccan law?
Not fully. Law 09-08 shares principles with the GDPR, and Morocco has been a party to Convention 108 since 2019, but the CNDP declaration has no GDPR equivalent and must be filed separately.
Does Law 09-08 apply to websites outside Morocco?
It applies to controllers established in Morocco and to those outside Morocco that use means of processing located there. A controller outside Morocco in that second case must name a representative in Morocco to the CNDP.
Set up cookie consent for Moroccan visitors
Moroccan law requires consent for cookies that process personal data, alongside the CNDP declaration. That means auditing your cookies, setting up a banner that asks first and filing the right CNDP form.
Kukie.io scans your site for cookies, suggests a category for each one and shows a consent banner that asks before non-essential cookies load. The CNDP declaration stays with you.
