Morocco Outbound Calling Compliance: CNDP and ANRT (2026)

Morocco is a market where the penalty structure, rather than the rulebook's size, is the thing to understand. Loi n° 09-08 is a 2009 data protection statute with no telemarketing chapter, no register and no numbering rules. What it does have is article 59, which makes it a criminal offence, punishable by imprisonment, to process someone's personal data despite their objection or for marketing purposes in breach of articles 9 and 10. Calling a person who has objected, or auto-dialling without prior consent, is not an administrative slip in Morocco.

At a Glance

Who Regulates Outbound Calling in Morocco

Two authorities, with a clear division. The CNDP supervises personal data under loi n° 09-08 and is where the marketing rules actually live. ANRT regulates telecommunications, runs the numbering plan, and operates the value-added-service declaration regime under loi n° 24-96.

Neither issues a telemarketing licence, but Morocco does require filings that catch most outbound operations. Article 12 of loi 09-08 provides that, absent particular legislative provisions, a processing of personal data must be the subject of a prior authorisation where it concerns, among other things, the use of personal data for purposes other than those for which it was collected, and a prior declaration in other cases. Read that carefully before you buy or reuse a list: repurposing customer data for outbound marketing is an authorisation case, not a simple declaration. The declaration itself, under article 13, carries an undertaking that the processing will be carried out in conformity with the law, and it is filed with the Commission nationale.

On the messaging side there is a second filing. The CNDP's own communiqué, issued in Rabat on 23 April 2019 after a meeting with ANRT and the telecom operators, states that providers of SMS marketing must be declared with ANRT as value-added-service providers and must be bound to the telecom operators by service contracts. The SVA regime is a declaration rather than a licence, provided for by articles 5, 17 and 18 of loi n° 24-96, and it requires the filing of a declaration of intention to open the service. The file comprises the signed declaration form, a copy of the commercial register, an identity copy, and proof of payment of a flat, non-refundable handling fee of MAD 1,800 including tax. Public administrations are exempt. The procedure is set by décision ANRT/DG/N° 12/08 of 4 August 2008.

One caution. The published SVA categories are messaging and data services, from voice messaging and audiotex to EDI, file transfer and internet services. Which of those an outbound voice call centre falls under is not stated, so establish your position with ANRT rather than assuming the declaration covers voice. SVA providers must also lease their transmission capacity from an existing public telecommunications network unless they hold a licence of their own.

Consent and Opt-Out

Morocco has two consent rules stacked on top of each other, and flattening them produces the wrong answer.

The baseline is article 4: personal data may be processed only where the person concerned has unambiguously given consent to the operation or set of operations envisaged. Disclosure to a third party additionally requires purposes directly linked to the functions of both parties, plus the data subject's prior consent.

The marketing-specific rule is article 10, and its scope is narrower than it is usually described. It prohibits direct prospection by means of an automated calling machine, a fax, an email, or a means employing a technology of the same nature, using in any form the contact details of a natural person who has not given prior consent to receive direct prospection by that means. An auto-dialler, an IVR broadcast or an AI voice agent placing marketing calls sits squarely inside the automate d'appel category and needs prior consent. A marketing call dialled manually by a live agent is not caught by that per-channel ban: it is caught instead by the article 4 consent rule and the article 9 right to object. The distinction is real and worth keeping, because it changes which of your campaigns need consent evidenced per channel.

Article 10 also defines the terms: consent means any free, specific and informed indication of will by which a person accepts that their data may be used for direct prospection, and direct prospection means sending any message intended to promote, directly or indirectly, goods, services or the image of a person selling goods or providing services.

There is a soft opt-in, and it is email-only. Prospection by email is permitted where the details were collected directly from the recipient, lawfully, on the occasion of a sale or a provision of services; where it concerns similar products or services from the same person; and where the recipient is offered, expressly, unambiguously and simply, a free way to object, both at collection and in every prospection email. There is no equivalent for automated calls. How consent must be evidenced, and for how long, is not prescribed, so set your own evidential standard and keep it.

Do-Not-Call

There is no national Do Not Call register in Morocco. None appears in loi 09-08, on ANRT's site, or in the CNDP material reviewed. There is consequently no list-checking duty, because there is no list to check.

What exists instead is an individual right. Article 9 gives the person the right to object, free of charge, to their data being used for prospection purposes, notably commercial prospection, by the current controller or by the controller of a subsequent processing. That right does not apply where the processing meets a legal obligation, or where an express provision of the act authorising the processing excludes it. Because there is no register, the only place that objection can be recorded is your own suppression list, which makes that list the compliance control rather than an operational convenience.

Article 10 adds a per-message duty. It is prohibited, for the purposes of direct prospection, to send messages by automated calling machine, fax or email without indicating valid contact details to which the recipient may usefully send a request for the communications to cease, at no cost other than that of transmitting the request.

The operators have been made to police that duty on the messaging side. Following the 23 April 2019 meeting, they undertook, as infrastructure providers, to require value-added-service providers to include in every commercial prospection SMS an indication of the means made available to the customer to stop receiving them, with a non-complying provider exposed directly to the measures provided by the texts in force. The CNDP and ANRT also agreed to put in place mechanisms for controlling companies operating in commercial prospection SMS.

One further point from that communiqué is worth internalising: the operators do not supply the target lists. They act as infrastructure to value-added-service providers using their own customer databases, and those databases must be built in compliance with the regulations in force. The list is the marketer's legal problem, not the carrier's.

For consumers, the CNDP publishes the short code 3020 and the portal 3020.cndp-cdai.ma as the complaint route.

Calling Hours and Days

Morocco is the market where the honest answer is that the hours are not verified.

No calling-hours rule was found in any Moroccan instrument that could be read. Loi 09-08 contains no hours, days or holiday restriction. ANRT's published décisions for 2025 and 2026 concern operator conventions and fibre access rather than telemarketing, and the national numbering plan contains no time rule.

The likeliest home of such a rule is loi n° 31-08 on consumer protection, and that text could not be read: the copy published by ANRT is an image-only scan with no text layer. Its démarchage provisions, and anything they say about canvassing hours, cooling-off periods or canvassing formalities, therefore remain unverified. Check the Bulletin Officiel text or a readable copy of loi 31-08 before you publish or configure a Moroccan calling window, and do not adopt a neighbouring country's hours as a proxy.

Two related points. Morocco observes UTC+01:00 year round and shifts the legal time during Ramadan, but both are general timekeeping facts rather than rules in any instrument reviewed, and the Ramadan shift should be verified against the current décret before it is used to schedule campaigns. And no frequency cap was found, so restraint is a matter of your own policy and of the article 9 objection right rather than of a published number.

Caller ID and Number Presentation

Morocco has no reserved telemarketing prefix. ANRT's Plan National de Numérotation, in its version of 13 July 2026, allocates mobile blocks to the three operators and contains no marketing, prospection or call-centre range. Nothing in the plan tells a consumer that an incoming call is commercial.

What the law does regulate is honesty about who is calling. Article 10 provides that it is also prohibited to conceal the identity of the person on whose behalf the communication is sent, and to state a subject unrelated to the service or product offered. That covers both halves of a misleading call: who you say you are, and what you say you are calling about. An outsourced campaign that presents only the BPO's identity, or an opening line that disguises a sales call as a survey, runs into that provision directly.

Rules on withheld or spoofed CLI presentation for commercial calls were not located in loi 09-08 or on ANRT's site. Treat that as an unconfirmed area rather than as permission, and present a number you own and are entitled to present.

Call Recording and Notices

No recording notice or consent duty specific to commercial calls was found in loi 09-08. That is an absence from the instrument reviewed, not a positive permission.

What is certain is that a recording is personal data, so article 4 consent, the article 3 purpose-limitation and proportionality rules, and the article 12 declaration or authorisation regime all apply to it. The sharpest consequence sits in article 55: keeping data beyond the period provided by the legislation in force or by the declaration or authorisation is itself a criminal offence, carrying three months to one year's imprisonment and MAD 20,000 to 200,000. In Morocco your own CNDP filing is the enforceable retention ceiling, which makes the retention figure you declare an operational commitment rather than paperwork.

Messaging Rules for SMS and WhatsApp

SMS is the channel with the clearest Moroccan supervision, and it runs through two filings and one undertaking. The sender must be declared with ANRT as a value-added-service provider and be under contract with the operators. Every commercial prospection SMS must carry the means to stop receiving them, which the operators have undertaken to enforce. And the underlying customer database must have been built in compliance with the regulations, which brings the article 12 declaration or authorisation question back to the marketer.

Article 10's prior-consent ban reaches beyond SMS by its own wording, since it covers a fax, an email, an automated calling machine, or a means employing a technology of the same nature. Confirm the point with the CNDP if the campaign is large: a messaging app used to broadcast marketing may fall within that wording, which loi 09-08 does not define, so treat WhatsApp and similar channels as requiring prior consent and a working opt-out.

Data Protection and Retention

Retention under article 3 is purpose-bound: data must be kept in a form allowing identification of the persons concerned for no longer than necessary for the purposes for which it is collected and further processed. The CNDP may authorise longer retention for historical, statistical or scientific purposes on a legitimate-interest request. As noted above, article 55 turns the period you declared into the enforceable ceiling.

Cross-border transfer is an adequacy regime. Article 43 provides that a controller may transfer personal data to a foreign State only if that State ensures a sufficient level of protection of privacy and of fundamental rights and freedoms, assessed on the destination's law, its security measures, and the purpose, duration, nature, origin and destination of the data, and it charges the Commission nationale with establishing the list of States meeting those criteria.

Article 44 provides the derogations where the destination is not on the list: the data subject's express consent; necessity for the person's life, the public interest, a legal right, a contract with the data subject or pre-contractual measures at their request, a contract in their interest with a third party, international judicial cooperation, or medical care; a bilateral or multilateral agreement to which Morocco is party; or an express and reasoned CNDP authorisation where the processing guarantees a sufficient level of protection, notably through contractual clauses or internal rules. In practice the CNDP treats a transfer as its own procedure, offering notification of a transfer request abroad as a distinct filing alongside declarations and prior-authorisation requests.

The adequate-country list itself could not be read, because it is published on a CNDP site that was unreachable. Any offshore contact centre, cloud region or recording archive holding Moroccan personal data must be checked against that list, or documented under an article 44 derogation, before go-live.

Penalties and Enforcement

Loi 09-08 is unusual among data protection statutes in how readily it reaches for imprisonment.

Article 59 is the one to quote in an internal policy. It punishes whoever processes personal data concerning a natural person despite a legitimately founded objection, or for prospection purposes as mentioned in article 9 or by electronic means as provided in article 10. Calling someone who has objected, or auto-dialling without prior consent, is a criminal offence in Morocco rather than merely an administrative one. Alongside that, article 51 lets the CNDP withdraw the declaration receipt or the authorisation without delay where the processing harms public safety or order or is contrary to morals. Whether the 2009 fine amounts have been uprated could not be confirmed, so treat the figures above as the law as enacted.

What Changed in 2025 and 2026

No amendment to loi n° 09-08 was located, and no successor Moroccan data protection statute was found. The CNDP's own presentation of the regulatory framework still names loi 09-08 and décret n° 2-09-165 with no successor instrument listed. That negative was taken from an archived copy of the regulator's site while the live site was unreachable, so it is not proof that nothing newer exists: verify with the CNDP directly before relying on it.

The CNDP's 2025 activity, on its own news feed, is programmatic rather than normative: a partnership convention with the CGEM on 13 November 2025, work on monitoring inappropriate publication of personal data on the dark web on 7 November 2025, a national awareness tour on 4 July 2025, and Maroc Telecom and ANGSPE joining its DATA-TIKA programme in April 2025. What DATA-TIKA obliges a participant to do was not established.

ANRT's published décisions for late 2025 and 2026 concern service-provider conventions and fibre access, and include suspensions and terminations of Convention Prestataire agreements with several named service companies in November and December 2025. Whether those relate to marketing SMS abuse was not confirmed, but they are the obvious place to look for live Moroccan enforcement against marketing intermediaries. ANRT last republished the numbering plan on 13 July 2026, and it still contains no marketing range.

The open item that matters most operationally is unchanged: loi n° 31-08 could not be read, so Moroccan canvassing rules and any calling window remain unverified.

How the Platform Supports Each Rule

DialerBee provides compliance-supporting controls that help you meet the obligations above. Morocco does not ship as a jurisdiction pack, so calling hours, do-not-call handling and consent are configured per tenant. The legal responsibility stays with the operator of the campaign.

Morocco Outbound Compliance Checklist

• File a CNDP declaration for the processing before the first campaign runs.
• Apply for prior CNDP authorisation where you are reusing data for a purpose other than the one it was collected for.
• Obtain prior consent before any automated marketing call, IVR broadcast or AI voice agent campaign.
• Keep automated and agent-dialled campaigns separate, because article 10 and article 4 impose different tests.
• Record every objection in your own suppression list, since Morocco has no register to hold it.
• Treat an objection as a hard block at dial time, and apply it to every campaign and channel.
• Put working opt-out contact details in every automated marketing message, free to use.
• Name the company the call is made on behalf of, and state the real subject of the call.
• Declare a retention period you can actually hold to, because article 55 makes it the enforceable ceiling.
• Check the CNDP's adequate-country list, or document an article 44 derogation, before any offshore processing.
• Notify a transfer request abroad to the CNDP as its own filing where the transfer needs it.
• Declare with ANRT as a value-added-service provider before running commercial SMS, and hold operator contracts.
• Confirm with ANRT which SVA category an outbound voice operation falls under before relying on the declaration.
• Obtain a readable copy of loi n° 31-08 and confirm Moroccan canvassing hours before committing to a calling window.

Sources

1. Loi n° 09-08 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel, promulgated by Dahir n° 1-09-15 of 18 February 2009, Bulletin Officiel n° 5714 of 5 March 2009. Read from an archived copy of the CNDP's own PDF. Loi 09-08, French text
2. CNDP communiqué on direct commercial prospection by SMS, Rabat, 23 April 2019, following the meeting with ANRT and the telecom operators. CNDP communiqué, 23 April 2019
3. ANRT, Services à Valeur Ajoutée declaration regime under loi n° 24-96, procedure set by décision ANRT/DG/N° 12/08 of 4 August 2008, BO n° 5680 of 6 November 2008. ANRT SVA e-service
4. ANRT, Plan National de Numérotation, French version of 13 July 2026. ANRT numbering plan
5. ANRT, Décisions, including the late-2025 Convention Prestataire suspensions and terminations. ANRT décisions
6. CNDP consumer complaint portal, short code 3020. CNDP
7. Loi n° 31-08 édictant des mesures de protection du consommateur. Text located but published only as an image-only scan, so its démarchage provisions could not be read and are treated as unverified throughout this guide.

Frequently Asked Questions

What are the legal calling hours in Morocco?

Not verified. No calling-hours, day-of-week or holiday rule was found in loi 09-08, in ANRT's published décisions or in the national numbering plan. The likeliest home of one is loi n° 31-08 on consumer protection, which is published as an image-only scan and could not be read, so no Moroccan window is stated here. Confirm the position with the CNDP, ANRT or local counsel before configuring a calling window.

Does Morocco have a Do Not Call register?

No. No national register appears in loi 09-08, on ANRT's site or in the CNDP material reviewed. What exists is the article 9 right to object free of charge to the use of one's data for prospection, and the article 10 duty to carry working opt-out contact details in every automated marketing message. Because there is no register, your own suppression list is the control that has to work.

Do I need consent to call Moroccan consumers?

For automated calling, yes, and in advance. Article 10 prohibits direct prospection by automated calling machine, fax or email using the details of a natural person who has not given prior consent to that means. A marketing call dialled manually by an agent is not caught by that per-channel ban, but it is still caught by the article 4 requirement of unambiguous consent to the processing and by the article 9 right to object.

Is auto-dialling a criminal offence in Morocco?

It can be. Article 59 punishes whoever processes personal data concerning a natural person despite that person's legitimate objection, or for prospection purposes as mentioned in article 9 or by electronic means as provided in article 10, with three months to one year's imprisonment and a fine of MAD 20,000 to 200,000, or either penalty alone. Auto-dialling without prior consent falls within article 10.

Is there a telemarketing prefix in Morocco?

No. ANRT's Plan National de Numérotation, in its version of 13 July 2026, allocates mobile blocks to the operators and contains no marketing, prospection or call-centre range. What article 10 does require is that you not conceal the identity of the person on whose behalf the communication is sent, and that you not state a subject unrelated to the service or product offered.

Do I need to register before sending marketing SMS in Morocco?

Yes. The CNDP's 2019 communiqué states that providers of SMS marketing must be declared with ANRT as value-added-service providers and must be bound to the telecom operators by service contracts. The SVA regime is a declaration under loi n° 24-96 with a flat handling fee of MAD 1,800 including tax, and the procedure is set by décision ANRT/DG/N° 12/08 of 4 August 2008.

How long may I keep Moroccan contact data and recordings?

For no longer than necessary for the purposes of the processing under article 3, and in practice for no longer than the period you declared to the CNDP. Article 55 makes keeping data beyond the legal or declared period a criminal offence carrying three months to one year's imprisonment and MAD 20,000 to 200,000, so the retention figure in your filing is an operational commitment.

Can I process Moroccan customer data outside Morocco?

Only if the destination State is on the list the CNDP establishes under article 43 as offering a sufficient level of protection, or if you fall within an article 44 derogation such as the data subject's express consent or an express and reasoned CNDP authorisation based on contractual clauses or internal rules. The CNDP also treats notifying a transfer abroad as a distinct filing, and its adequate-country list should be checked before go-live.

Related Reading

• Morocco outbound dialer overview
• Indonesia outbound dialer overview
• Brazil outbound dialer overview
• Compliance Autopilot
• Caller-ID Pool Control