When online reality moves faster than Moroccan law
Consider a situation now familiar to many Moroccan families. A 13-year-old girl in Casablanca discovers that photographs taken at school have been reposted in a WhatsApp group, altered and accompanied by insulting comments. Within hours, the images move to TikTok and Instagram. Her mother wants everything removed immediately, the school asks the family to remain discreet, and the child is terrified of returning to class.
This is a composite example, not the account of an identified case. But it accurately reflects the legal problems regularly brought before lawyers, police services, schools and child-protection associations in Morocco. Who is liable? Can the parents of the children who shared the pictures be ordered to pay damages? Does Moroccan law treat the conduct as cyberbullying, invasion of privacy, defamation or an offence involving a minor? And how can evidence be preserved before the account disappears?
The international debate has become much sharper. Australia adopted legislation in November 2024 establishing a social-media age threshold of 16, with implementation entrusted primarily to platforms. France enacted legislation on a form of digital majority at 15, while the European Union has imposed stronger duties on large platforms through the Digital Services Act. These developments, widely discussed in the Moroccan press, inevitably raise the same question at home: does Moroccan law genuinely protect children on social media, or are families being asked to manage a dangerous legal vacuum?
The short answer is nuanced. Morocco does not yet have a single statute devoted to the protection of minors on social networks. Nevertheless, several existing texts apply: the Criminal Code, the Code of Criminal Procedure, Law No. 09-08 on personal data, the Family Code or Moudawana, the Code of Obligations and Contracts, and Law No. 07-03 concerning offences against automated data-processing systems. The protection is real, but fragmented. Parents must know how to combine these rules rather than search for a single provision bearing the label of a social-media law.
1. The Moroccan legal framework: what the legislation actually says
1.1 The Criminal Code and online offences involving children
The Moroccan Criminal Code contains no chapter entitled cyberbullying of children. Prosecutors must legally characterise each act according to its content: invasion of privacy, sexual harassment, threats, defamation, dissemination of intimate material, fraudulent access to an account, sexual exploitation or indecent assault.
Articles 447-1, 447-2 and 447-3 of the Criminal Code, introduced by Law No. 103-13 on combating violence against women, are central. Contrary to a frequent summary found online, Article 447-2 is not a general cyberbullying provision. Article 447-1 addresses the intentional interception, recording or dissemination of private or confidential words and the recording or dissemination of the image of a person in a private place without consent. Article 447-2 concerns, among other conduct, the dissemination by any means, including computer systems, of a person's statements or image, as well as false allegations or private facts, with the intention of harming privacy or reputation.
Article 447-3 of the Criminal Code provides an aggravated regime when the offences covered by Articles 447-1 and 447-2 are committed in specified circumstances, including where the victim is a minor.
The distinction matters. A complaint should not simply state that a child has been cyberbullied. It should identify each publication, message, threat, impersonation or unauthorised image and connect it to the legally relevant offence. Poor legal characterisation does not necessarily invalidate a complaint, since the Public Prosecutor can reclassify the facts, but it can delay the investigation.
Sexual offences require even greater precision. Article 484 punishes indecent assault without violence against a minor under 18. Article 485 deals with indecent assault committed with violence and provides heavier penalties where the victim is a minor. Article 486 defines and punishes rape, with an aggravated penalty where the victim is under 18. Article 503-2 also addresses the sexual exploitation of children in pornography, including the production, dissemination and possession of prohibited material under the conditions set out by the consolidated Criminal Code.
These provisions may apply even when the first contact occurred through Instagram, Snapchat, TikTok, a gaming platform or encrypted messaging. The internet is the instrument; the underlying criminal offence remains decisive. Morocco does not, however, have a fully autonomous offence of online grooming drafted in the same way as certain foreign statutes. Depending on the facts, repeated sexual messages, requests for images or preparation of a meeting may fall under sexual harassment, child pornography, attempted sexual offences or related provisions.
1.2 Law No. 09-08 and children's personal data
Law No. 09-08 on the protection of individuals with regard to the processing of personal data was promulgated by Dahir No. 1-09-15 of 18 February 2009 and published in Official Gazette No. 5714 of 5 March 2009. It applies to personal data such as a child's name, photograph, telephone number, location, school, device identifier and online account information.
Article 4 of Law No. 09-08 establishes consent as one of the legal foundations for processing personal data, subject to the exceptions listed by the statute. The law also contains duties concerning fairness, purpose, proportionality, information and security, together with rights of access, rectification and objection.
The weakness is obvious: the statute does not establish a specific age of digital consent for children and does not create a detailed child-oriented consent mechanism comparable to Article 8 of the European General Data Protection Regulation. It does not explain how a platform must verify that the person supposedly giving parental consent is actually the child's legal representative.
Frankly, Law No. 09-08 was enacted before today's short-video economy, algorithmic profiling and large-scale influencer culture had reached their present form. It remains legally useful, but it does not provide a sufficiently modern answer to the commercial exploitation of children's attention and data. For a broader analysis, see this guide to personal data protection in Morocco.
The National Commission for the Control of Personal Data Protection, or CNDP, receives complaints, supervises processing operations and can carry out the measures authorised by Law No. 09-08. Yet it does not possess the same administrative fine mechanism as a European authority operating under the GDPR. Criminal penalties under the Moroccan statute are ultimately imposed through the competent courts. Enforcement is also more difficult where the platform and its technical records are located abroad.
1.3 The Moudawana and legal guardianship
The Family Code, enacted by Law No. 70-03 and promulgated by Dahir No. 1-04-22 of 3 February 2004, provides the family-law basis for the protection and representation of minors. Its terminology must be used carefully.
Article 231 of the Family Code identifies the legal representatives of a minor: the adult father, the adult mother in the circumstances specified by the Code, the testamentary guardian and the judge. Article 235 requires the legal representative to attend to the minor's personal affairs, religious guidance, education and preparation for life, while also handling ordinary administration of the minor's property. Article 236 confirms the father's status as legal guardian by operation of law unless that guardianship has been withdrawn by a judicial decision, while providing for the mother's intervention in urgent matters where the father is prevented from acting.
No provision uses the expression digital guardianship. Still, education, protection and preparation for life cannot reasonably stop at the door of the family home while the child spends hours in a digital environment. The Moudawana therefore supports a duty of reasonable parental involvement, although it does not prescribe a particular monitoring application or a daily screen-time limit.
1.4 Law No. 07-03 on information-system offences
Law No. 07-03 inserted Articles 607-3 to 607-11 and related provisions into the Criminal Code concerning attacks on automated data-processing systems. The statutory scheme covers conduct such as fraudulent access, remaining unlawfully in a system, interference with its operation, alteration of data and the use of certain fraudulent instruments.
This law becomes relevant where a child has had an Instagram account hacked, a password stolen, messages altered or a false account created using unlawfully obtained information. It was not designed specifically for minors, however. Nor does it establish a comprehensive liability regime for foreign social-media hosts. For that reason, practitioners frequently combine Law No. 07-03 with privacy, threat, fraud or sexual-offence provisions.
2. Is there a legal age for joining social media in Morocco?
2.1 Platform rules are not Moroccan legislation
As matters presently stand, Moroccan legislation does not establish a general minimum age for opening a social-media account. Facebook, Instagram and TikTok normally set a contractual minimum age of 13, subject to local variations and specific account features. The threshold was strongly influenced by the American Children's Online Privacy Protection Act, commonly known as COPPA.
But platform terms of service are contracts, not Moroccan statutes. A ten-year-old who enters a false date of birth may violate the platform's rules, yet there is no Moroccan administrative mechanism that automatically prevents the account from being created. The platform may suspend it after detection or a report, but that is private enforcement.
The phrase age légal inscription réseaux sociaux Maroc therefore leads to a deceptively simple answer: there is no national statutory age applicable to all platforms. Thirteen is usually the platform threshold, not a Moroccan digital-majority rule.
2.2 Why parental consent remains legally uncertain
European law offers a useful comparison. Article 8 of the GDPR sets 16 as the default age at which a child may consent to information-society services, while allowing Member States to lower it to no less than 13. France selected 15. Morocco's Law No. 09-08 has no equivalent architecture.
This creates three practical questions. Who must consent where parents are separated? How should consent be verified? Can a child withdraw it independently as maturity increases? The Moudawana answers questions about legal representation generally, but not the technical process through which a social-media platform should obtain and authenticate consent.
Until the legislature intervenes, parents carry much of the practical burden. They should not assume that permitting an account removes their supervisory role, or that refusing permission will by itself prevent a technically capable child from registering secretly.
3. Parental liability for a child's conduct online
3.1 Article 85 belongs to the Code of Obligations and Contracts
A recurring legal error must be corrected. Parental civil liability is not governed by Article 85 of the Criminal Code. It is found in Article 85 of the Dahir forming the Code of Obligations and Contracts, or DOC.
Article 85 of the DOC establishes responsibility not only for damage caused by one's own act but also, under its stated conditions, for damage caused by persons for whom one is responsible. It addresses the liability of parents for damage caused by minor children living with them and provides a defence where the responsible person proves that the harmful act could not have been prevented.
Articles 77 and 78 of the DOC also form the general basis of Moroccan tort liability: a person who, intentionally or through fault, causes damage must repair it where the statutory conditions are met. The claimant normally has to establish fault or a legally attributable act, damage and causation.
Suppose a 14-year-old creates a false TikTok account in a classmate's name and publishes humiliating material from the family home. The victim may seek compensation for psychological harm, reputational injury, medical expenses and other proven losses. Depending on the living arrangements and evidence, the parents may be brought into the civil claim under Article 85. More detail is available in this overview of parental civil liability under Moroccan law.
3.2 Civil responsibility is not criminal guilt
The distinction is fundamental. Civil liability is intended to repair harm, usually through damages. Criminal responsibility concerns punishment and is personal: a parent is not imprisoned merely because a child committed an offence. A parent could only face personal criminal exposure if the parent's own conduct constitutes an offence, such as participation, concealment in circumstances punished by law, threats or deliberate dissemination.
The child's criminal position depends on age. Under Article 138 of the Criminal Code, a child under 12 is considered criminally irresponsible because of lack of discernment, without eliminating the protective measures and civil consequences allowed by law. Article 139 provides incomplete criminal responsibility for a minor aged from 12 to under 18, based on diminished discernment. Juvenile proceedings and protective or educational measures are governed further by the Code of Criminal Procedure.
A 13-year-old is therefore not treated in the same way as an adult offender. That does not mean nothing can happen. The juvenile justice system may intervene, protective or educational measures may be ordered, and the victim's civil compensation claim can remain very real.
3.3 How far does the duty to supervise extend?
No Moroccan law requires parents to install Google Family Link, inspect every WhatsApp message or confiscate a telephone after 10 p.m. The obligation to supervise a child's internet use is an obligation of reasonable care, not a guarantee that no harmful event will ever occur.
A civil court may examine the child's age, prior incidents, warnings from the school, access to devices, the parents' response after learning of the conduct and whether reasonable precautions were taken. A complete absence of reaction after repeated complaints is much harder to defend than a single unforeseeable incident committed despite proportionate supervision.
Attention, however: parental supervision must respect the child's dignity and evolving privacy. Secretly publishing a child's messages, humiliating the child publicly or using violent discipline is not legitimate digital education. For difficult custody or guardianship questions, families may consult an family lawyer in Casablanca.
4. Cyberbullying of children under Moroccan law
4.1 The applicable offences depend on the evidence
The expression cyberharcèlement enfants loi marocaine covers several possible legal classifications. Repeated insulting messages may lead to provisions on insults, defamation, threats or sexual harassment. Unauthorised private images may fall under Article 447-1. False allegations or the malicious dissemination of private material may trigger Article 447-2, with Article 447-3 potentially increasing the penalty where the victim is a minor.
Where electronic communications have a sexual character, Article 503-1-1 of the Criminal Code, introduced by Law No. 103-13, may be relevant to sexual harassment through persistent acts, words, gestures or written, telephone or electronic messages of a sexual nature. The exact charge and penalty must be checked against the current consolidated text and the facts retained by the prosecution.
For sexual images of a child, Article 503-2 and the offences against sexual integrity become central. Calling such material a private photo dangerously understates the matter. A child cannot be treated as the lawful producer of commercial or exploitative child sexual-abuse material merely because the child pressed the camera button.
4.2 Correcting common claims about penalties
Articles 447-1 and 447-2 are often inaccurately described as carrying only one to six months' imprisonment. In the consolidated Criminal Code, the basic penalty under those provisions is generally six months to three years' imprisonment and a fine of 2,000 to 20,000 MAD, subject to the precise offence. Under Article 447-3, specified aggravated circumstances, including the victim's minority, can lead to one to five years' imprisonment and a fine of 5,000 to 50,000 MAD.
Article 484 generally provides two to five years' imprisonment for indecent assault without violence against a minor under 18. Article 485 provides heavier punishment for indecent assault with violence and raises the range where the victim is under 18. Under Article 486, rape is punished more severely where the victim is a minor; the applicable range is not automatically life imprisonment. Additional aggravating circumstances under Article 487 can raise the penalty further.
Anyone facing such allegations should consult the current official version of the Criminal Code. Criminal statutes are strictly interpreted, and a one-paragraph internet summary is no substitute for identifying the applicable paragraph, amendments and aggravating factors. Readers may also consult this overview of digital criminal law in Morocco.
4.3 Limitation periods
Another common error is to state that all cyberbullying complaints have a five-year limitation period. Article 5 of the Moroccan Code of Criminal Procedure generally sets limitation periods for public prosecution at 15 years for felonies, four years for misdemeanours and one year for petty offences, subject to special rules, interruption and suspension.
The classification of the offence is therefore decisive. Repeated conduct also raises questions about the date on which the offence was completed. Do not wait for the limitation issue to become complicated. Early reporting improves both the legal position and the chance of preserving platform data.
5. What penalties can an online offender actually face?
The following summary is indicative and must be matched to the current consolidated legislation:
- Unauthorised recording or dissemination of private words or images: Article 447-1, generally six months to three years and a fine of 2,000 to 20,000 MAD.
- Malicious dissemination of private material, false allegations or montages: Article 447-2, generally six months to three years and a fine of 2,000 to 20,000 MAD.
- Aggravated privacy offence involving a minor: Article 447-3, potentially one to five years and a fine of 5,000 to 50,000 MAD.
- Indecent assault without violence against a minor: Article 484, generally two to five years.
- Indecent assault with violence against a minor: Article 485, potentially ten to twenty years where the statutory conditions are met.
- Rape of a victim under 18: Article 486, generally ten to twenty years, with possible further aggravation under Article 487.
- Child sexual exploitation material: Article 503-2, with penalties varying according to production, distribution, facilitation or possession.
- Hacking or interference with an account or system: Articles 607-3 and following, with penalties depending on the conduct and consequences.
Several offences can sometimes be investigated from the same factual sequence, but Moroccan rules on concurrence of offences determine how convictions and penalties are ultimately handled. For example, hacking an account, obtaining private photographs and then publishing them to damage a child may involve both information-system and privacy offences.
The foreign platform is a different problem. Morocco has no national equivalent of the European Digital Services Act imposing the same comprehensive due-diligence structure on global platforms. The CNDP can act within the powers granted by Law No. 09-08, but obtaining account-identification data from an overseas company may require preservation requests, judicial cooperation or the company's own law-enforcement procedure.
Morocco is a Party to the Budapest Convention on Cybercrime, in force for Morocco since 1 October 2018. The Convention facilitates international cooperation and preservation of electronic evidence. In practice, however, a formal foreign request may take months, especially if the request is incomplete or the requested data have already been deleted. For serious criminal allegations, legal assistance from an criminal lawyer in Marrakech or another competent city can help ensure that requests are properly framed.
6. How to report illegal content involving a child
6.1 Preserve evidence before seeking removal
The first instinct is often to delete everything. Resist it. Before blocking the account or asking the platform to remove the content, preserve:
- full screenshots showing the account name, content, date and surrounding conversation;
- the profile URL and direct URL of each post, where available;
- the date and time, preferably with the device clock visible;
- voice notes, videos and original files without editing them;
- names of witnesses, school notifications and earlier reports;
- medical or psychological records showing harm to the child.
A screenshot can be challenged, particularly if cropped or detached from context. For a serious case, a bailiff's report or technically documented extraction may strengthen the evidence. Never ask the child to continue a dangerous conversation solely to collect more proof.
6.2 Use the platform and Moroccan authorities simultaneously
Report the content through Facebook, Instagram, TikTok, WhatsApp or the relevant service. Select the most accurate ground: child sexual exploitation, harassment, impersonation, privacy violation or threat. Save the report confirmation number.
At the same time, a report may be submitted through the DGSN's official e-Blagh portal. This channel is useful for illegal digital content, but it does not prevent the family from filing a formal complaint. Where a child is in immediate danger, call the police emergency number 19 or attend the nearest police or Royal Gendarmerie service, depending on territorial jurisdiction.
A written complaint can be filed with the Public Prosecutor at the competent Court of First Instance, usually where the victim lives or where the relevant acts or consequences occurred. Set out the chronology, identify known accounts, list the evidence and request urgent preservation and investigation measures. A lawyer is not legally required merely to submit a complaint, and filing with the prosecution is free.
Families in Fès may seek an criminal lawyer in Fès where the file involves threats, intimate material or an adult suspect. In urgent cases, do not postpone police contact while waiting for a legal appointment.
6.3 CNDP, ANRT and child-protection associations
A complaint concerning unlawful processing of a child's personal data can also be submitted to the CNDP. Provide copies rather than surrendering the only version of the evidence. Processing times depend on complexity, cooperation from the controller and whether international elements are involved; no responsible practitioner should promise a fixed two-month outcome.
The National Telecommunications Regulatory Agency, or ANRT, regulates electronic communications and technical market matters. It is not a general social-media content police authority. Reporting an Instagram insult to the ANRT alone is therefore unlikely to produce the required criminal investigation.
Associations such as Bayti, INSAF and Touche Pas à Mon Enfant may provide or facilitate psychological, social and legal support, depending on their current programmes and geographical availability. Confirm the service and eligibility directly rather than assuming that every case will receive free legal representation.
7. Practical parental protection without turning the home into a police station
7.1 Choose supervision according to age and risk
There is no statutory formula, but a proportionate approach works better than either total neglect or permanent secret surveillance. For children under 12, account access should normally remain closely controlled and age restrictions respected. Between 12 and 15, privacy settings, contact lists, screen-time rules and regular conversations should operate together. From 15 to 18, dialogue should become dominant, although stronger controls remain justified after threats, self-harm concerns, sexual solicitation or repeated harmful conduct.
Free tools include Google Family Link and the parental controls built into Android and iOS. Instagram and TikTok also provide family-supervision and privacy features, although settings can change after updates. Paid products such as Qustodio or Bark may cost roughly €50 to €100 per year depending on the plan and exchange rate. No software can guarantee protection, and technically skilled teenagers may circumvent it.
Most importantly, tell the child that reporting a mistake will not automatically lead to humiliation or confiscation. A child who fears punishment may conceal threats until an offender has obtained images, an address or school information.
7.2 Adopt a family digital agreement
A short family agreement can define acceptable platforms, private-account settings, screen times, rules on photographs and the steps to take after contact from a stranger. It is not generally a contract intended for court enforcement. Its value is educational: everyone knows what happens when a problem appears.
The agreement should include a simple emergency sentence: If someone asks for a private image, threatens you, requests secrecy from your parents or proposes an unsupervised meeting, stop replying and tell an adult immediately.
7.3 When should a family consult a lawyer?
Seek legal advice promptly where intimate images are involved, an adult is contacting a child, a threat mentions the child's home or school, an account has been hacked, or earlier reports have not stopped repeated abuse. A first consultation with a lawyer experienced in digital or criminal law in Casablanca or Rabat commonly costs around 500 to 1,500 MAD. Fees are not fixed nationally for this type of consultation and should be agreed in advance.
Representation in a first-instance cybercrime or cyberbullying file may cost roughly 3,000 to 8,000 MAD, sometimes more where urgent applications, technical experts, extensive hearings or international cooperation are required. Filing the criminal complaint itself remains free. Families can locate an internet law lawyer in Casablanca, an internet law lawyer in Rabat or an internet law lawyer in Tangier.
Ask for a written fee agreement covering first instance, appeals, expert costs and civil-party representation. The case may pass from the Court of First Instance to the Court of Appeal and, on legal questions, potentially to the Court of Cassation. An initial fee does not automatically cover every stage.
8. Does the Moudawana reform create digital guardianship?
The reform proposals publicly announced on 24 December 2024 focused primarily on family-law questions such as marriage, divorce, custody, legal representation and property relations. They did not establish a detailed statutory system for social-media consent or a clearly defined concept of digital guardianship.
Legislative status must always be checked through the Official Gazette. Political announcements, ministerial statements and draft proposals do not amend the Family Code by themselves. Families should therefore avoid relying on claims that a Moudawana reform has already created a specific obligation to install parental-control software.
There is nevertheless a genuine opportunity for reform. A modern Moroccan framework should address at least six issues: a clear age of digital consent, verifiable parental authorisation, child-friendly privacy information, restrictions on profiling and targeted advertising, rapid preservation of evidence, and enforceable duties for platforms receiving reports about minors.
The reform of Law No. 09-08 is equally necessary. The CNDP, the National Human Rights Council, Parliament, child-protection organisations, lawyers and technical experts all have a role. Copying a foreign model word for word would be a mistake; Morocco needs rules adapted to the Moudawana, local judicial capacity, Arabic and Amazigh accessibility, and the realities of children sharing devices within families.
Conclusion: parents should not wait for a perfect statute
Moroccan law offers genuine remedies, but they are dispersed across several codes. The Criminal Code punishes privacy violations, sexual exploitation and attacks on minors. Law No. 09-08 protects personal data without creating a satisfactory child-specific consent regime. The Moudawana establishes legal representation, while Article 85 of the DOC can expose parents to civil liability for damage caused by a minor child living with them.
In clear terms, the legislative gap is not a reason to do nothing. Preserve evidence, report dangerous material, contact the Public Prosecutor where an offence may have occurred, and obtain advice before the trail goes cold. At the same time, supervision must remain proportionate and respectful.
The most effective protection still begins with a conversation between parent and child. Codes, police reports and court judgments become essential after harm occurs. They can never fully replace the trust that allows a child to ask for help before the situation becomes irreversible.
