Consent to personal data in Morocco: collecting it, proving it, honouring withdrawal

Consent is the most used and the most poorly implemented legal basis. On most sites we audit there is a checkbox and nothing behind it: no record of what was accepted, when, or any way to reverse it. But consent you cannot prove is worth no more than no consent at all.

Three requirements, not one

• Collection — freely given, informed and specific. "I accept the privacy policy" covers several distinct purposes badly: receiving a quote is not receiving a newsletter.
• Evidence — which you must be able to produce: which version of the text was accepted, on what date, for which purposes.
• Withdrawal — as simple as the agreement, and genuinely applied downstream: if withdrawal does not empty the mailing list, it does not exist.

When consent is the wrong basis

A frequent and expensive mistake: asking for consent where the processing rests on something else. Invoicing a client, paying an employee or keeping accounts does not depend on their agreement — those activities have another basis. Asking for a consent you will not honour is worse than not asking: it creates a promise the system cannot keep.

The practical test: if a withdrawal cannot be executed without breaching a legal obligation, that is the sign the chosen basis was wrong.

What this looks like in software

• One purpose per checkbox, and no pre-ticked boxes.
• A timestamped record per consent: purpose, date, text version, channel.
• The text versions retained — otherwise you cannot prove what was accepted.
• A withdrawal propagated to every system concerned, third-party tools included.
• A retention period that also applies to the consent evidence itself.

Cookies and audience measurement

A tracker that is not strictly necessary to the site’s operation requires prior agreement. In practice that means dropping nothing before the person chooses — not dropping first and informing after. A banner that informs while the trackers are already running has no value, and that describes the majority of sites.

What we check on an existing site

In this order, because it is the order in which problems appear: what is dropped before the choice; what is actually recorded when someone accepts; what happens when someone refuses or withdraws; and what remains in third-party tools after a withdrawal. See CNDP compliance, or take stock with our self-assessment.

Related guides: the CNDP declaration, law 09-08 and the GDPR.