Morocco's Law 09-08 and the CNDP's 2025 cookie rules: what they mean for websites
Morocco's data protection law dates from 2009, but its regulator, the CNDP, set out how cookies are handled only in Deliberation D-939-2025 of 28 November 2025. A website must inform visitors before placing the first cookie, ask consent for personalised-advertising and social-sharing cookies, keep cookie data no longer than six months, and file a simplified declaration with the CNDP before placing cookies.
Nov 2025
CNDP cookie deliberation D-939-2025
6 months
Cap on keeping cookie data
MAD 300,000
Top base fine · doubled for companies
The short answer
Does Morocco require cookie consent?
Partly. Under the CNDP's Deliberation D-939-2025, cookies used for personalised advertising and for sharing on social networks need the visitor's consent before the first one is placed. Audience measurement and content personalisation that build no profile do not need consent, but the visitor must still be informed before any cookie is placed, and the site must declare its cookies to the CNDP.
The deliberation is a model simplified declaration under Law 09-08: a site files it and commits to its conditions. It caps cookie data at six months, requires a simple way to refuse, and requires the CNDP's prior authorisation for profiling and for transfers abroad. It does not mention Google Consent Mode, and it sets no deadline for sites already using cookies.
CNDP Deliberation D-939-2025 (French, PDF)What the law is
Law No. 09-08 on the protection of individuals with regard to the processing of personal data was promulgated by Dahir No. 1-09-15 of 18 February 2009, with Decree No. 2-09-165 of 21 May 2009 implementing it.
It created the regulator, the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel), whose seven members are appointed by the King. Processing is lawful with the person's consent, given unambiguously (Article 4), or on another listed ground, including the controller's legitimate interest.
Before any processing starts, the controller must file a declaration with the CNDP, or obtain its prior authorisation for sensitive data, national ID numbers, interconnected files and transfers abroad (Articles 12 and 14). Deliberation D-939-2025 is a model simplified declaration for cookies: a site that files it commits to its conditions on purposes, consent, information and retention.
Penalties are criminal and imposed by the courts. The CNDP's president said in August 2026 that a revision of the law has been sent to the government's General Secretariat; Law 09-08 remains in force.
What the cookie deliberation requires of a website
- 01
Consent for advertising and social-sharing cookies
Personalised-advertising cookies and social-sharing cookies need the visitor's consent before the first one is placed, given by a clear, explicit action. Audience measurement and content personalisation without profiling do not need prior consent under the deliberation (D-939-2025, paragraph 6).
- 02
Inform before the first cookie
Before any cookie is placed, tell visitors who the controller is, the purposes, the categories of data, the recipients and any transfers abroad, how to exercise their rights, and the references of the CNDP receipt. This applies to every cookie, including those that need no consent (paragraph 6; Law 09-08, Article 5).
- 03
A simple way to refuse
The site must offer simple, accessible means to refuse cookies, and respect the refusal, keeping it for no more than six months. The deliberation does not prescribe toggles, a reject-all button or a ban on cookie walls.
- 04
Six months at most
Data collected through cookies may be kept for at most six months, then deleted or anonymised (paragraph 5). Check your analytics retention settings against it.
- 05
Declare before placing cookies
File the simplified declaration on the CNDP-FORMS platform before placing cookies; sites already using cookies must also bring their processing into line and declare. Using cookie data to build a profile of the visitor falls outside the simplified model and needs the CNDP's prior authorisation (paragraphs 3 and 8).
- 06
Transfers abroad need authorisation
Cookie data may not be transferred abroad without the CNDP's prior authorisation (paragraph 9). Most analytics and advertising platforms process data outside Morocco, so this is the point most sites have to check.
Penalties are criminal
Law 09-08's penalties are imposed by the courts. The CNDP itself can withdraw a receipt or authorisation, order data blocked or erased, ban processing and refer cases to the prosecutor.
- 01
No declaration
MAD 10,000 to 100,000 for processing without the required declaration or authorisation (Article 52).
- 02
Consent, retention and transfers
Three months to one year in prison and/or MAD 20,000 to 200,000 for processing without valid consent (Article 56), keeping data too long (Article 55) or transferring it abroad unlawfully (Article 60).
- 03
Sensitive data
Three months to one year in prison and/or MAD 50,000 to 300,000 for processing sensitive data without express consent (Article 57).
- 04
Companies and repeat offences
Fines are doubled for a legal person, which may also face confiscation or closure (Article 64), and penalties double again for a repeat offence within a year of a final conviction (Article 65).
What Arqam360 does for a Moroccan website
- 01
Information and consent before cookies
The banner appears before tags run and holds advertising tags until the visitor chooses; Google tags stay denied through Consent Mode v2 until then. With regime detection on, visitors in Morocco get the opt-in model with Arabic as the default language. Asking before analytics too is stricter than the deliberation requires.
- 02
Refusal that is easy and recorded
Accept and refuse sit side by side, and each choice is stored with its date, time and the categories accepted or refused, ready to export as a CSV file.
- 03
Arabic and English, with a cookie policy
A native right-to-left Arabic banner with an English version, and a cookie policy template you can adapt to list the information the deliberation asks for.
- 04
What stays with you
The CNDP declaration, any transfer authorisation and the receipt references are the site owner's to file; Arqam360 does not file them for you. The banner text can carry the receipt references once you have them.
Timeline
Law 09-08 promulgated
Dahir No. 1-09-15 of 18 February 2009, published in the Official Gazette that month.
Implementing decree
Decree No. 2-09-165 of 21 May 2009 sets out the CNDP's procedures, declarations and transfers.
Convention 108
Morocco ratified the Council of Europe's data protection convention.
Cookie deliberation
CNDP Deliberation D-939-2025 of 28 November 2025: the model simplified declaration for cookies.
Revision in preparation
The CNDP's president said a revision of the law prepared with the Ministry of Justice is with the government's General Secretariat. No bill has been published.
Check what your site does before consent
The free scanner loads your site in a real browser and lists the cookies and trackers that run before a visitor chooses, which is the list your CNDP declaration and cookie policy need.
Scan your siteDone for you
We set it up on your website
We install the consent banner, wire Google Consent Mode v2, test your Google and Meta tags, and publish your bilingual privacy policy. $299 to install, then $99.99 a month per domain.
Regulations
Compliance guides for GDPR, PDPL, and more
regulations.moroccoLaw0908.faq.title
regulations.moroccoLaw0908.faq.subtitle
For some. CNDP Deliberation D-939-2025 requires consent before the first cookie for personalised-advertising and social-sharing cookies; audience measurement and content personalisation without profiling are exempt from consent, though visitors must still be informed.
Put an Arabic consent banner on your site
The banner takes minutes on WordPress, Shopify, Zid or any custom site. The CNDP declaration and authorisations are yours to file; the banner is the part your visitors see first. Start free, or let our team install it and test your tags.