1. Introduction

Personal Data Monetization Law in Morocco concerns the legal rules governing the commercial exploitation, licensing, sharing, processing, transfer and economic use of individuals' personal information.

In the modern digital economy, personal data has significant commercial value. Businesses use personal information to generate revenue through:

Targeted advertising and personalised marketing.

Customer profiling and behavioural analytics.

Sale or licensing of consumer databases.

Artificial intelligence and machine-learning systems.

Financial risk assessment and credit scoring.

E-commerce recommendation systems.

Location-based commercial services.

Digital identity and verification services.

Data analytics and market research.

However, the fact that personal information has economic value does not mean that a company automatically owns it or has unrestricted authority to sell it.

Moroccan law primarily approaches this subject through privacy, personal-data protection, consent, lawful processing, contractual responsibility and consumer protection.

The central legislation is Law No. 09-08 of 18 February 2009, concerning the protection of natural persons with regard to the processing of personal data, together with its implementing Decree No. 2-09-165 of 21 May 2009. The National Commission for the Control of Personal Data Protection (CNDP) supervises compliance.

Article 24 of the Moroccan Constitution also recognises the right to protection of private life.

cndp.ma+1

An important distinction must be made: Morocco does not have a separate, comprehensive statute establishing a general property right in personal data or a universal right to receive royalties whenever personal information generates commercial revenue. Monetization is instead governed by the existing data-protection and related civil and commercial laws.

2. Legal framework governing personal data monetization

The principal legal instruments include:

The CNDP's published regulatory materials identify Law No. 09-08 as the central legislation and explain the applicable notification, authorisation and international-transfer requirements.

cndp.ma+2

3. Meaning and nature of personal data monetization

Personal data monetization means deriving financial or commercial benefits from information relating to identifiable individuals.

Examples include:

A. Direct monetization

A company licenses or provides a database to another commercial organisation for an authorised purpose.

B. Indirect monetization

A digital platform uses customer information to improve advertising effectiveness and earns advertising revenue.

C. Analytical monetization

An organisation analyses purchasing patterns, preferences and customer behaviour to generate market intelligence.

D. AI-based monetization

A business uses personal information in authorised AI training, prediction, recommendation or profiling activities.

E. Data-sharing monetization

A company enters into commercial arrangements with business partners to share or process customer information.

Each activity must be examined according to its actual purpose, the categories of data involved, the identity of the recipient and the legal basis for processing.

A commercial agreement alone does not make otherwise unlawful processing lawful.

4. Consent and commercial exploitation of personal information

Consent is an important legal foundation for personal-data monetization.

Under Law No. 09-08, consent and the other recognised legal grounds must be considered in determining whether processing is lawful.

For commercial exploitation, businesses should establish:

What information is being collected.

Why the information is collected.

Whether commercial use was explained.

Whether the individual gave the required consent or another lawful basis applies.

Whether the information will be disclosed to third parties.

Whether international transfers are involved.

Whether the individual can exercise applicable statutory rights.

Consent to provide information for employment administration, for example, should not automatically be treated as consent to use that information for advertising.

Important principle: Consent must not be confused with ownership. An individual may authorise particular processing without transferring unrestricted ownership of their identity or personal information.

5. Purpose limitation and commercial reuse

Purpose limitation is particularly important in the Moroccan legal framework.

Information collected for one purpose cannot automatically be reused for an unrelated commercial purpose.

For example:

A bank collects customer information to administer accounts.

A marketing company subsequently requests the information.

The bank proposes to provide the information for targeted advertising.

The proposed disclosure and subsequent processing must have an appropriate legal basis and comply with the purpose requirements of Law No. 09-08.

The CNDP explains that a change of processing purpose requires prior authorisation.

cndp.ma

This requirement is significant for data brokers, advertising companies, financial institutions and digital platforms.

6. Commercial sale and licensing of personal data

Personal-data licensing is one of the most important areas of data monetization.

A company may enter into a commercial arrangement to provide data-processing or analytical services to another organisation. However, the parties must distinguish between:

Ownership of a database as a commercial asset.

Intellectual property rights in the database's structure or original selection.

Rights to process personal information.

Rights to disclose information to third parties.

Rights to use information for advertising.

Rights of individuals whose information appears in the database.

These are legally different interests.

Legal requirements

A lawful commercial data-sharing agreement should address:

The precise categories of personal data.

The purposes of processing.

The legal basis for processing and disclosure.

The responsibilities of the data controller and processor.

Confidentiality and security obligations.

Retention and deletion requirements.

Individual access and objection rights.

Restrictions on onward disclosure.

Responsibility for unlawful processing.

CNDP notification or authorisation requirements.

A database cannot be sold as an unrestricted commercial asset simply because the seller lawfully collected it.

7. Targeted advertising and behavioural monetization

Targeted advertising is an important application of personal-data monetization.

Digital platforms may analyse:

Search history.

Shopping preferences.

Website activity.

Location information.

Customer interests.

Online purchasing behaviour.

Device identifiers.

Such information can be used to create advertising profiles.

Under Law No. 09-08, the processing must comply with lawful-purpose, proportionality, transparency and security requirements.

Direct marketing also requires particular attention. The statutory rules restrict unsolicited commercial prospecting using electronic communications and require the applicable prior consent, subject to legally recognised exceptions.

Companies should therefore provide meaningful information about advertising purposes and implement effective objection and withdrawal mechanisms.

8. Personal data and artificial intelligence monetization

Artificial intelligence creates additional opportunities to monetise personal information.

Examples include:

AI-based customer prediction: Businesses analyse consumer behaviour to forecast purchasing decisions.

Automated credit scoring: Financial institutions process customer information to assess credit risk.

AI advertising: Platforms use information to personalise commercial recommendations.

Facial recognition services: Organisations use biometric information for identity-related commercial services.

Predictive analytics: Companies derive commercial insights from customer datasets.

However, AI processing does not escape Law No. 09-08 merely because the data is processed automatically.

Organisations must consider:

Whether the information identifies an individual.

Whether sensitive information is involved.

Whether the proposed purpose was properly notified.

Whether prior CNDP authorisation is required.

Whether automated processing creates additional risks.

Whether the information is retained longer than necessary.

Whether third-party AI providers receive personal data.

Sensitive personal data, including health and genetic information, is subject to stricter controls. Processing involving the national identity card number and certain other specified categories also attracts prior authorisation requirements.

cndp.ma+1

9. Anonymisation, pseudonymisation and commercial data analytics

Anonymisation can facilitate commercial data analysis by reducing the possibility of identifying individuals.

For example, a retail company may analyse the number of customers purchasing particular products without revealing their identities.

Three concepts must be distinguished:

Pseudonymisation does not automatically remove information from the scope of personal-data protection.

The CNDP defines personal data broadly, including names, telephone numbers, photographs, fingerprints, vehicle registration details and IP addresses.

cndp.ma

Businesses should therefore assess re-identification risks before treating a dataset as anonymous.

10. International monetization and cross-border data transfers

Moroccan companies increasingly use international cloud providers, analytics companies, advertising platforms and AI service providers.

Consequently, personal information may be transferred outside Morocco.

Under Law No. 09-08, international transfers are regulated.

The CNDP identifies the following principal circumstances:

Transfer to countries recognised as providing an adequate level of protection.

Express consent of the individual in circumstances covered by the law.

Transfers necessary for specified contractual, public-interest, legal or other statutory purposes.

Applicable CNDP procedures and authorisations.

A business should not assume that a foreign cloud-hosting contract automatically authorises international data transfers.

cndp.ma+1

11. Civil liability for unlawful personal-data monetization

Unlawful commercial exploitation may create civil liability.

Examples include:

Selling customer databases without a lawful basis.

Publishing photographs for advertising without proper permission.

Sharing employee information with marketing agencies without authorisation.

Disclosing confidential customer records.

Using personal information for an incompatible purpose.

Continuing commercial exploitation after the relevant permission has ended.

The Dahir of Obligations and Contracts provides an important framework for contractual and non-contractual liability.

Article 77 addresses wrongful acts causing damage, while Article 78 addresses liability for damage caused by a person's acts or omissions.

Article 264 is relevant to the assessment of compensation for loss and damage.

Depending on the circumstances, a claimant may seek:

Compensation for material loss.

Compensation for moral injury.

Removal of unlawfully published information.

Cessation of unauthorised commercial exploitation.

Appropriate contractual remedies.

Other remedies available under the applicable procedural and data-protection rules.

12. Case laws and judicial precedents in Morocco

Relevant Moroccan jurisprudence

An important research qualification is necessary: Moroccan published jurisprudence specifically addressing the commercial monetization of personal databases remains limited. The following cases include direct decisions on commercial exploitation of personal information and closely related precedents concerning image rights, disclosure and civil liability. They should not all be described as decisions on the sale of databases.

Case 1. Casablanca Commercial Court – 30 April 2024

Decision No. 5288, Case No. 2986/8202/2024

Publication non consentie des données personnelles d’un salarié.

The dispute concerned an employer publishing a former employee's photograph and personal information on social media for advertising purposes without express authorisation.

The court considered the exploitation of the employee's image and personal information without contractual authorisation or express agreement to constitute an actionable wrong.

It relied on Articles 66, 67 and 264 of the Dahir of Obligations and Contracts.

The court ordered compensation and removal of the photograph and personal information under a penalty mechanism.

Importance: This is a particularly relevant precedent for commercial data exploitation. A business cannot assume that information obtained during an employment relationship can subsequently be used to promote its products or services.

Jurisprudence+1

Case 2. Casablanca Commercial Court of Appeal – 31 October 2024

Decision No. 5311, Case No. 2024/8202/3306

L’utilisation de l’image et des données personnelles d’un ancien salarié à des fins commerciales.

The employer challenged a judgment concerning the commercial publication of a former employee's image and personal information.

The Court of Appeal rejected the argument that the employee's previous employment relationship implied permission for advertising use.

It distinguished between:

Providing personal information for employment administration.

Authorising its subsequent use for commercial advertising.

The court recognised both the infringement of image rights and the loss of a professional opportunity.

It increased the compensation to MAD 40,000, applying Article 264 of the Dahir of Obligations and Contracts.

Importance: The decision demonstrates that commercial use of personal information requires a proper and specific legal basis. It is particularly relevant to companies monetising employee profiles, photographs and professional identities.

Jurisprudence+1

Case 3. Casablanca Commercial Court of Appeal – 25 November 2025

Right to one's image: Filmed participation in an event does not constitute consent to advertising publication.

The dispute concerned the commercial publication of a consultant's image on social media.

The company argued that the consultant had participated in a filmed event, had received remuneration and had worn clothing displaying the company's brand.

The court rejected the argument that these circumstances constituted implied consent to public advertising.

It held that commercial exploitation of the individual's image required express and unequivocal authorisation.

The court upheld the underlying judgment and rejected the parties' appeals.

Importance: Receiving payment for participation in an event does not necessarily mean that an individual has authorised unlimited commercial exploitation of their image. The scope of permission matters.

Jurisprudence+1

Case 4. Moroccan Supreme Court – 18 July 2007

Decision No. 813, Commercial Case No. 2005/1/3/490

This Supreme Court precedent was expressly cited by the Casablanca Commercial Court in its 2024 decision concerning unauthorised commercial exploitation of an employee's image.

It concerned the principles of unjust enrichment under Articles 66 and 67 of the Dahir of Obligations and Contracts.

The 2024 court relied on this precedent when considering whether commercial exploitation without an appropriate agreement or authorisation could justify compensation.

Importance: The decision is relevant to disputes in which a business obtains an economic advantage through the unauthorised exploitation of another person's rights.

It is an unjust-enrichment precedent, rather than a judgment specifically concerning modern digital data brokerage.

Jurisprudence

Case 5. Moroccan Supreme Court – 28 June 2011

Decision No. 3127, Case No. 2006/9/1/2775

This Supreme Court decision was cited by the Casablanca Commercial Court in its 30 April 2024 judgment concerning the unauthorised publication of an employee's photograph.

The principle relied upon concerns the protection of the right to one's image as a personality right.

The 2024 court applied this principle to the commercial publication of an individual's image without authorisation.

Importance: Personal identity and image rights cannot be treated as ordinary commercial assets that businesses may freely exploit.

Jurisprudence

Case 6. Casablanca Commercial Court of Appeal – 2 February 2023

Bank's delayed disclosure of the identity of the originator of a transfer.

The dispute concerned a bank that delayed providing its customer with information identifying the person responsible for transfers made into the customer's account.

The Court of Appeal considered the bank's obligation to provide relevant information to its own customer and held that the delay had caused a loss of opportunity to pursue legal proceedings.

It awarded compensation for the resulting loss of opportunity.

Importance: Although this was not a personal-data monetization dispute, it illustrates the legal importance of information rights, confidentiality obligations and civil liability in the commercial and banking environment. It is relevant by analogy to disputes concerning the improper withholding or handling of commercially valuable personal information.

Jurisprudence

Case 7. Casablanca Commercial Court – 30 April 2024

Unauthorised commercial exploitation and removal of personal information.

This is the first-instance judgment underlying Case 2, not a separate independent dispute. Its importance deserves separate consideration because it expressly addressed removal of unlawfully published information under a penalty mechanism.

The court recognised that monetary compensation alone might not adequately protect the affected person's personality rights.

It therefore combined compensation with an order requiring removal of the disputed material.

Importance: This remedial approach is relevant to digital platforms that continue displaying personal information after their authority to use it has ended.

Jurisprudence

Jurisprudential caution: Cases 1, 2 and 7 concern the same underlying litigation. They should not be counted as three independent disputes. Similarly, Cases 4 and 5 are earlier precedents cited in the 2024 judgment. Thus, the above provides seven judicial references, but not seven independent, directly relevant monetization cases. The directly relevant modern decisions are principally the 2024 and 2025 image-exploitation cases.

13. Role of the National Commission for Personal Data Protection (CNDP)

The CNDP plays a central role in supervising commercial personal-data processing.

Its responsibilities include:

Monitoring compliance with Law No. 09-08.

Receiving processing declarations.

Granting authorisations where required.

Supervising international data transfers.

Examining complaints.

Issuing regulatory guidance.

Monitoring unlawful processing activities.

The CNDP requires organisations to notify relevant processing operations before implementation through the appropriate declaration or authorisation procedure.

A change of purpose, sensitive-data processing and certain interconnections of databases may require prior authorisation.

cndp.ma+1

14. Data monetization in important Moroccan industries

15. Unlawful personal-data monetization and legal consequences

Unlawful monetization can expose an organisation to several forms of legal liability.

A. Civil liability

An affected individual may seek compensation where the requirements for civil liability are established.

B. Criminal liability

Law No. 09-08 establishes criminal sanctions for specified violations, including unlawful processing and breaches of statutory obligations.

C. Regulatory consequences

The CNDP can exercise its statutory supervisory and enforcement powers.

D. Contractual liability

A business may be liable for breaching contractual confidentiality, security or processing obligations.

E. Consumer protection liability

Where commercial data practices involve misleading representations or unfair commercial practices, Law No. 31-08 may also become relevant.

Ministère de l’Industrie et du Commerce+2

16. Practical compliance framework for Moroccan businesses

A business intending to monetise personal information should adopt the following framework:

17. Future development of personal data monetization law in Morocco

Morocco's digital economy creates a need for more detailed rules addressing the commercial value of personal information.

Important areas for future legal development include:

1. Individual data economic rights: Clarifying whether individuals should receive compensation when their personal information generates commercial value.

2. Data licensing: Developing standard contractual frameworks for lawful data-sharing arrangements.

3. AI monetization: Establishing clearer requirements for using personal information in commercial AI training and predictive analytics.

4. Digital advertising: Strengthening transparency concerning behavioural advertising and profiling.

5. Data brokerage: Improving oversight of companies that aggregate and commercially distribute personal information.

6. Anonymised data markets: Establishing standards for effective anonymisation and preventing re-identification.

7. Cross-border data markets: Improving safeguards for international data-sharing arrangements.

8. Collective data rights: Exploring mechanisms through which consumer organisations can represent affected individuals.

9. Digital identity protection: Preventing the commercial misuse of identity information and biometric identifiers.

10. Compensation mechanisms: Clarifying the relationship between privacy violations, unjust enrichment and financial compensation.

These are potential reform directions, not descriptions of rights already established by Moroccan legislation.

18. Conclusion

Personal Data Monetization Law in Morocco is an emerging area of civil, commercial and digital law.

Law No. 09-08 provides the central legal foundation for regulating the collection, processing, commercial use and disclosure of personal information. The Constitution protects private life, while the Dahir of Obligations and Contracts provides mechanisms for civil compensation and other remedies.

The Moroccan judicial decisions concerning unauthorised commercial exploitation of employee photographs and personal information are particularly significant. They demonstrate that commercial value does not override personality rights and that permission for one purpose does not automatically authorise another.

The fundamental legal principle is that personal data may generate commercial value, but its monetization must respect the individual's legally protected rights, the applicable processing requirements and the limits of the relevant commercial authorisation.

Academic note: This topic is best studied through the combined disciplines of Moroccan civil liability, privacy law, contract law, consumer protection, intellectual property and digital commerce. The case references above should be distinguished from independent precedents specifically deciding the sale or licensing of personal databases.