Illegal Listening and Secret Recordings in Morocco: Consent, Surveillance and Criminal Penalties

When an AI listening device exposes Morocco’s own legal blind spots

The withdrawal or restriction in Europe of an artificial-intelligence gadget capable of continuously capturing ambient conversations raises an obvious question for Moroccan users: what would happen if the same device were sold and used in Casablanca, Rabat or Marrakech?

Morocco does not yet have a statute devoted specifically to always-listening AI assistants, wearable recorders or connected domestic devices. That does not mean that their use falls outside the law. Secretly capturing another person’s words may already constitute a criminal offence under Articles 447-1 to 447-3 of the Moroccan Criminal Code. If the recording is stored, analysed or associated with an identifiable person, Law No. 09-08 on personal data protection may also apply.

There is, however, considerable public confusion. Applications and even legal articles sometimes refer to “Article 127 of the Criminal Code” as the provision governing illegal listening. That citation is inaccurate. The principal privacy offence is found in Article 447-1, not Article 127. The distinction matters because a complaint sent to the Public Prosecutor should identify the facts precisely, even though the prosecutor remains responsible for the final legal classification.

In practice, many victims discover their rights only after a recording has reached WhatsApp groups, colleagues or members of their family. By then, the original file may have been edited, the telephone reset and the social damage done. This article therefore examines the constitutional protection of privacy, criminal penalties, judicial interception, consent, workplace monitoring, CNDP proceedings and the remedies available to a victim of illegal surveillance in Morocco.

The constitutional foundation: privacy is a fundamental right in Morocco

Article 24 of the 2011 Constitution

The starting point is the Constitution of 29 July 2011, promulgated by Dahir No. 1-11-91. Article 24 protects private life, the home and personal communications. In substance, it provides:

“Everyone has the right to the protection of their private life. The home is inviolable. Searches may take place only under the conditions and according to the forms provided by law. Private communications, whatever their form, are secret. Only the courts may authorise access to their content, their total or partial disclosure or their use against any person, under the conditions and according to the forms provided by law.”

This is the constitutional basis of the right to privacy under the Moroccan Constitution of 2011. The phrase “whatever their form” is deliberately broad. It can encompass a telephone call, voice note, videoconference, private electronic message or conversation captured by a connected device.

Article 22 adds that no person’s physical or moral integrity may be infringed by a public or private actor. Coercive surveillance, intimate recordings and the threat of publication can therefore affect more than secrecy: they may attack a victim’s dignity and psychological integrity.

The Constitution sits at the top of the domestic hierarchy of norms. Yet a constitutional guarantee does not, by itself, answer every practical question. The Constitution is the roof; legislation and procedure must build the walls. Those walls exist, but they are scattered between the Criminal Code, Code of Criminal Procedure, Law No. 09-08 and sector-specific rules. Readers seeking broader context may consult this overview of privacy rights under Moroccan law.

What the Moroccan Criminal Code actually says about illegal listening

Article 447-1: intercepting or recording private words without consent

Article 447-1 was introduced by Law No. 103-13 on combating violence against women. It applies to any person who intentionally, and by any means including computer systems, intercepts, records, broadcasts or distributes private or confidential words or information without the consent of their author. It also covers the unauthorised capture, recording, broadcast or distribution of a person’s image while that person is in a private place.

Article 447-1 of the Criminal Code: the offence is punishable by imprisonment of six months to three years and a fine of 2,000 to 20,000 dirhams.

This is the key provision for an unauthorised recording of a conversation in Morocco. Contrary to material frequently copied online, Article 127 is not the governing privacy provision and does not create a general one-month-to-one-year penalty for recording calls.

The prosecution must ordinarily establish an intentional act, a private or confidential communication, an act of interception, recording, broadcast or distribution, and absence of consent. The technology is secondary. A hidden microphone, spyware application, conference-call recorder and AI wearable can all produce the same legal result.

“Interception” and “recording” are separate acts. Listening live through spyware without saving a file may amount to interception. Activating a recorder creates a fixation even if nobody later listens to it. Sending the file to a WhatsApp group constitutes an additional act of distribution.

Article 447-2: manipulated recordings and false allegations

Article 447-2 deals with the distribution or dissemination of a montage composed of a person’s words or image without consent, as well as the dissemination of false allegations or misleading facts intended to harm private life or defame the person. It is especially relevant to edited audio, synthetic speech and AI-generated “deepfake” recordings.

Article 447-2: imprisonment from one to three years and a fine from 2,000 to 20,000 dirhams may be imposed for the conduct described by the provision.

A person who edits a private argument to reverse its meaning may therefore face a different and potentially cumulative analysis from someone who merely made the original recording. Other offences, including defamation or blackmail, may also apply depending on the purpose and method of publication.

Article 447-3: aggravated relationships and vulnerable victims

Article 447-3 aggravates the penalties where the perpetrator is a spouse, former spouse, fiancé, ascendant, descendant, person exercising authority or guardianship, or where other relationships specified by the text exist. It also addresses offences committed against women because of their sex and against minors.

Article 447-3: in the aggravated situations stated by the article, the penalty rises to imprisonment from one to five years and a fine from 5,000 to 50,000 dirhams.

There is therefore no “marital exception.” Secretly recording a husband or wife is not automatically permitted because the telephone or family home is shared. On the contrary, the relationship may place the facts within an aggravated provision.

Related offences: hacking, professional secrecy and blackmail

Spyware may also involve fraudulent access to an automated data-processing system under Articles 607-3 and following of the Criminal Code. If a doctor, lawyer, banker or another professional discloses information entrusted by reason of the profession, Article 446 on professional secrecy may become relevant.

Where the recording is used to demand money, a signature, withdrawal of a complaint or another advantage under threat of disclosure, the facts may amount to blackmail under Article 538. That offence must not be confused with Article 381, which is sometimes incorrectly cited in online summaries. Criminal classifications can accumulate where each offence protects a distinct social interest.

When can the Moroccan state legally intercept communications?

Articles 108 to 116 of the Code of Criminal Procedure

Private citizens and employers cannot invoke the powers reserved to criminal justice authorities. Articles 108 to 116 of the Moroccan Code of Criminal Procedure establish an exceptional framework for the interception, recording, copying and seizure of communications made by remote means.

Article 108 begins from a prohibition: interception is not allowed unless the statutory conditions are met. An investigating judge may order it where the requirements of the investigation justify the measure. For specified serious offences, the Public Prosecutor General at the Court of Appeal may request authorisation from the First President of that court.

The statutory list notably concerns offences affecting state security, terrorism, criminal gangs, homicide, poisoning, kidnapping and hostage-taking, counterfeiting of currency or public credit instruments, narcotics, weapons, ammunition and explosives, and certain public-health offences. The exact consolidated wording should always be checked because procedural statutes are amended periodically.

In an extreme emergency involving certain listed offences, the Public Prosecutor General may issue an interception order subject to rapid review by the First President. The judicial order must identify the communication targeted, the offence and the duration. Contrary to another widespread claim, the Moroccan statutory period is not simply 30 days renewable once. Article 109 provides for a maximum period of four months, renewable once under the same formal conditions.

Implementation is documented through official records, and legally irrelevant material is not supposed to become an unrestricted surveillance archive. Operators must cooperate with valid judicial orders, while the confidentiality framework of Law No. 24-96 on posts and telecommunications remains relevant to telecommunications providers.

Legal state interception is not private surveillance

An employer, landlord, spouse or business partner cannot “authorise” a clandestine interception by claiming a security concern. Judicial interception is an exceptional investigative power surrounded by procedural safeguards. Private monitoring remains subject to the Criminal Code, labour law and Law No. 09-08.

A recurring situation in Casablanca call centres illustrates the confusion. Management may have a legitimate reason to evaluate service quality, but that does not give a supervisor unlimited authority to listen to every employee and customer, retain recordings indefinitely or use personal conversations for disciplinary pressure.

Consent: the central question for recordings in Morocco

Does participating in the conversation make recording lawful?

No automatic exemption appears in Article 447-1 merely because the recorder participated in the exchange. The text protects private or confidential words and refers to the absence of consent of their author. The safest and most defensible approach is therefore to inform every participant before recording and obtain clear agreement.

Consent should be prior, specific and informed. A person should understand that audio is being captured, why it is being captured, who will receive it and, for systematic processing, how long it will be kept. Consent extracted through deception or pressure is vulnerable to challenge.

Concretely, if you use a dictaphone application during a commercial meeting without informing colleagues, the fact that you are seated at the same table does not eliminate criminal risk. Nor does buying the telephone or owning the meeting room create a right over everyone else’s words.

Public places do not eliminate privacy

A conversation in a café, train, souk or administrative waiting area is not automatically public material. Courts may consider the place, volume, number of listeners and the speakers’ reasonable intention of confidentiality. Two people speaking quietly in a café may still be exchanging private words; a speech deliberately addressed to a public gathering is different.

Workplace call recording

A Moroccan employer may record professional calls for quality control, evidence of customer instructions or regulatory needs, but the system must be transparent, necessary and proportionate. Employees should receive advance written information, normally through an IT charter, policy, employment documentation or internal regulations. Customers should hear a notice at the beginning of the call and be given meaningful information about the purpose.

For undertakings regularly employing at least ten workers, Article 138 of the Labour Code governs the establishment of internal regulations. Recording rules may be incorporated into those regulations, but a generic clause stating that “all activity may be monitored” is not a blank cheque.

The related personal-data processing must also comply with Law No. 09-08 and the applicable CNDP formality. A signed IT charter helps prove notice, yet it does not cure an excessive or unlawful system. Employers facing this issue can consult employment lawyers in Casablanca.

Law No. 09-08 and the CNDP: the data-protection layer

Voice recordings are personal data when a person is identifiable

Law No. 09-08, promulgated by Dahir No. 1-09-15 of 18 February 2009, protects natural persons in relation to the processing of personal data. A voice recording is personal data where the speaker is identified or identifiable, whether directly by name or indirectly through the voice, number, context or metadata.

The law requires personal data to be processed fairly and lawfully, collected for explicit and legitimate purposes, relevant rather than excessive, accurate and retained no longer than necessary. The controller must also provide the information required by Article 5, including its identity, the purpose of processing, recipients and the existence of access and rectification rights.

Not every recording requires “authorisation” in the strict technical sense. Depending on the processing, the law may require a declaration, prior authorisation or another compliance step, while statutory exemptions can apply. Transfers to a foreign cloud provider require separate attention under Articles 43 and 44. This is particularly relevant to AI assistants whose servers are outside Morocco.

The role of the CNDP

The Commission Nationale de contrôle de la protection des Données à caractère Personnel, or CNDP, supervises Law No. 09-08. It receives complaints, conducts controls, examines formalities and may refer suspected criminal offences to the competent prosecution authorities.

A complaint can be filed without charge through the official CNDP website or sent to the Commission with copies of supporting evidence. In practice, processing times vary substantially according to technical complexity and the responsiveness of the controller. Two to four months may be a reasonable initial expectation in a straightforward matter, but complex investigations can take longer. The CNDP’s resources remain limited compared with the expanding volume of cloud, biometric and connected-device processing.

Specialist assistance is available through Moroccan digital and personal-data lawyers. Legal representation is not compulsory for the initial CNDP complaint.

Penalties under Law No. 09-08

Chapter VII, Articles 51 to 66, creates offence-specific sanctions. For example, Article 52 penalises the implementation of processing without the declaration or authorisation required by the law with a fine of 10,000 to 100,000 dirhams. Article 54 penalises fraudulent, unfair or unlawful collection with a fine of 20,000 to 200,000 dirhams. Other articles address purpose limitation, sensitive data, excessive retention, data-subject rights, security and unlawful transfers.

Legal persons can be fined under Article 65, with possible supplementary measures, while the individuals responsible may also be prosecuted where their personal conduct is established. The exact sanction depends on the offence proved; it is inaccurate to present Law No. 09-08 as creating one universal fine and prison term for every privacy violation.

Criminal and civil exposure: what can illegal surveillance cost?

These provisions may overlap. Secretly installing spyware can involve privacy infringement, unlawful data collection and fraudulent access to an information system. Posting the extracted audio may create a new offence. Using it to obtain money can add blackmail under Article 538.

Civil compensation under Articles 77 and 78 of the DOC

A victim may claim damages under Articles 77 and 78 of the Dahir forming the Code of Obligations and Contracts. Article 77 establishes liability where an intentional act, without legal justification, causes material or moral damage. Article 78 addresses fault causing damage.

Compensation may cover psychological harm, damage to reputation, loss of employment, medical expenses and provable commercial loss. There is no official Moroccan tariff awarding 20,000 to 150,000 dirhams in every serious privacy case. Awards are highly fact-sensitive and published case law is too fragmented to promise a dependable range. A claimant should document each consequence rather than request an arbitrary round figure.

A composite example drawn from recurring business disputes is the family-owned Casablanca SME in which one partner installs monitoring software on a shared company telephone. What begins as suspicion over customer diversion quickly becomes a criminal complaint, a CNDP issue and a shareholder dispute. Ownership of the device does not necessarily mean ownership of every private communication passing through it.

Can an illegally obtained recording be used in a Moroccan court?

Criminal proceedings: free proof is not unlimited proof

Article 286 of the Code of Criminal Procedure states the general principle that offences may be proved by any means unless the law provides otherwise, and the judge decides according to personal conviction. Under Article 287, the court may base its decision only on evidence produced and discussed orally and adversarially at the hearing.

This does not give a party permission to commit an offence in order to manufacture evidence. Moroccan courts examine authenticity, legality, relevance, contradiction and respect for defence rights. A clandestine private recording is not automatically admissible merely because Article 286 recognises freedom of proof. Nor is there a universal statutory rule declaring every unlawfully obtained private recording automatically void.

The distinction between evidence gathered by public authorities in breach of mandatory procedure and evidence produced by a private litigant is crucial. The consequences may include exclusion, reduced evidential weight, a technical examination or separate prosecution of the person who made the recording.

Civil, employment and family proceedings

Civil judges also assess whether evidence is legally and reliably established. The Code of Obligations and Contracts contains formal rules for proving obligations, especially under Articles 404 and following. A secret recording does not automatically become admissible because it is the only evidence available.

In a divorce file, a spouse may ask the family division of the court of first instance to reject the recording, contest its integrity and point to Articles 447-1 and 447-3. The judge may consider the broader factual context, but the spouse who recorded the exchange remains exposed to a criminal complaint.

Claims that a particular Supreme Court judgment created a broad right to use clandestine recordings should be treated cautiously unless the full official decision, chamber, file number and legal issue can be verified. Moroccan case-law databases remain incomplete, and isolated summaries often omit decisive facts.

What to do if you are the victim of illegal listening in Morocco

Step 1: preserve evidence before altering the device

Do not immediately factory-reset a telephone suspected of containing spyware. Disconnecting it from networks may be sensible if extraction is continuing, but first obtain tailored technical advice. Preserve screenshots, suspicious permissions, battery logs, account alerts, file names, URLs, telephone numbers and the dates on which the surveillance was discovered.

A commissaire de justice, the profession resulting from the reform and merger of judicial officers, may formally record visible findings. Fees are not fixed uniformly for every technical operation, but a straightforward digital observation often costs approximately 700 to 2,000 dirhams, excluding travel and specialist work. A private forensic examination may cost 3,000 to 15,000 dirhams or more. A court-ordered expert’s advance is fixed by the judge according to the mission.

An adoul can authenticate certain declarations and documents within the limits of the adoul’s statutory competence, but an adoul does not replace a digital forensic expert. For malware, deleted files and metadata, technical expertise is usually more persuasive.

Step 2: file a criminal complaint

A complaint may be lodged with the Public Prosecutor at the competent court of first instance, or reported to the police or Royal Gendarmerie. Filing the complaint is free and a lawyer is not compulsory at this initial stage. State the facts chronologically and refer, where appropriate, to Articles 447-1 to 447-3, Articles 607-3 and following, or Article 538, without attempting to force an unsupported classification.

Attach copies rather than surrendering the only version of critical evidence without obtaining a receipt. Request preservation of operator logs, cloud records and device data where delay may cause their deletion. A practical overview is available in this guide to filing a criminal complaint in Morocco.

Depending on the city and complexity, a preliminary investigation may take several weeks or many months. A contested first-instance criminal case can take six to eighteen months, sometimes longer where forensic expertise or international requests are required.

Legal fees are negotiated freely. For a moderately complex privacy complaint, first-instance assistance may commonly range from 5,000 to 20,000 dirhams, excluding tax, experts and appeal work. Readers may contact criminal lawyers in Casablanca, Rabat or Marrakech.

Step 3: submit a parallel CNDP complaint

If personal data was collected or used, a CNDP complaint can be pursued at the same time as the criminal complaint. Include the controller’s identity if known, screenshots, policies, correspondence, technical reports and proof that access, deletion or objection requests were ignored.

The CNDP route and the prosecution route serve different purposes. The Commission examines data-processing compliance; the Public Prosecutor investigates criminal responsibility. Using both channels can prevent the case from being reduced to a purely domestic or employment disagreement.

Step 4: seek civil damages and urgent protective measures

A civil claim may be joined to criminal proceedings by constituting oneself a civil party, or pursued separately depending on procedural strategy. The victim should request cessation of the interference, removal of published material where legally available, return or destruction of unlawful copies, and compensation supported by evidence.

Platforms should be notified immediately through their privacy and intimate-content reporting tools. Save the URL and evidence before requesting removal. Never respond to blackmail by sending more intimate material or negotiating without preserving the threats.

Prescription periods

Another recurring error concerns limitation. Under the current wording of Article 5 of the Code of Criminal Procedure, the ordinary limitation period for public prosecution of a misdemeanour is four years, not five, subject to interruption, suspension and special statutes. Calculating the starting date can be difficult where recording, retention and repeated publication occur at different times.

For tort liability, the relevant provision is Article 106 of the DOC, not Article 387. A damages action based on an offence or quasi-offence is generally barred five years after the victim knew of the damage and the person responsible, and in all cases twenty years after the damage occurred, subject to the exact facts and interruption rules.

Four common surveillance scenarios in Morocco

1. An employer records employees’ calls

The recording can be lawful only if there is a legitimate and proportionate professional purpose, transparent prior information, appropriate access controls and compliance with Law No. 09-08. Informing employees does not authorise continuous monitoring of private calls. Customers must also receive proper notice. Covert surveillance used to pressure union representatives or gather personal information creates serious labour, criminal and data-protection risks.

2. A spouse installs spyware during a divorce dispute

Moroccan law creates no immunity between spouses. Article 447-3 may aggravate the privacy offence precisely because of the marital or former marital relationship. A victim should preserve the telephone, seek technical analysis and ask counsel to challenge the evidence before the family court. Assistance may be sought from family lawyers in Casablanca.

A composite example frequently encountered in family disputes involves one spouse linking the other’s WhatsApp account to a laptop and monitoring conversations for weeks. The decisive evidence often comes not from the messages themselves, but from linked-device logs, security emails and synchronisation records.

3. A landlord or neighbour hides a microphone

A property owner does not retain a right to monitor a rented home. Secret audio capture in the apartment may fall under Article 447-1. Unlawful entry into the dwelling may also engage the Criminal Code provisions protecting the home, depending on the means used and the status of the perpetrator. The victim should avoid touching the device until its position and condition have been formally documented.

4. A connected AI assistant records everyone in the home

There is no Moroccan “AI assistant act” at present. Nevertheless, Article 447-1 can apply to the user who intentionally configures a device to record private visitors without consent. Law No. 09-08 can apply to the manufacturer, service provider or local controller where identifiable voice data is processed within its territorial and material scope.

A household user should activate visible or audible recording indicators, disable unnecessary retention, review linked accounts and warn guests. Companies deploying voice analytics should conduct a documented necessity assessment, verify CNDP formalities, regulate foreign transfers and set short retention periods.

Where Moroccan law remains inadequate

The existing framework offers real protection. Article 24 of the Constitution is clear, Article 447-1 is technologically neutral, judicial interception is regulated by Articles 108 to 116, and Law No. 09-08 creates enforceable data-processing duties.

The weaknesses are equally real. Morocco still lacks detailed legislation on ambient AI, biometric voice profiles, connected toys and domestic IoT surveillance. Law No. 09-08 predates today’s generative AI economy and does not reproduce all the safeguards of the European GDPR. The CNDP has addressed connected technologies through its publications and awareness work, but guidance cannot replace a modern statute passed by Parliament.

Enforcement also remains uneven. Digital expertise is expensive, regional courts do not all have the same technical resources, and victims frequently arrive after deleting the evidence. Casablanca courts may see more commercial and call-centre disputes, while smaller jurisdictions may rely more heavily on external experts, adding delay.

What years of observing these disputes teach is simple: the law protects people who preserve evidence and use the available procedures. Too many victims remain silent because the perpetrator is a spouse, employer or relative. That silence is exactly what allows illegal surveillance to continue. If you suspect that somebody is listening, do not retaliate with your own secret recording and do not erase the device. Secure the evidence, obtain legal advice, and act before the digital trail disappears.