| name | morocco-ecommerce-compliance-audit-omar-laftouh |
| description | Performs a legal compliance audit for a Moroccan e-commerce website, focused on personal data protection (Law 09-08) and consumer contract disclosures/obligations (Law 31-08). Use this skill when a user asks to audit, check, or assess the legal compliance of an e-commerce website operating in Morocco — presence and validity of Terms & Conditions, privacy policy, CNDP declaration, mandatory disclosures, right of withdrawal, consent banner. Out of scope: compliance for other countries, Meta/Google advertising compliance (covered by another skill), definitive legal advice (results are a starting point for professional review, not legal advice). |
Legal Compliance Audit — Moroccan E-commerce (Law 09-08 & Law 31-08)
When to use this skill
Use this skill when a user asks to audit, check, or assess the legal compliance of a Moroccan
e-commerce website, specifically regarding:
- personal data protection (Law 09-08)
- consumer contract obligations and mandatory disclosures (Law 31-08)
Out of scope: Meta/Google advertising compliance (covered by a separate skill), law of other
countries, definitive legal advice, marketplaces/multi-vendor platforms (not yet covered by this
methodology), informal commerce without a website (selling only through a Facebook/Instagram
page + WhatsApp, without formalized Terms & Conditions or privacy policy — not covered here, as
this methodology assumes the existence of a website). The results of this audit are a structured
starting point, to be validated by a professional before any contentious action.
Audit methodology
The audit always follows the same order, from the most visible/quick-to-check items to the more
specific ones. For each site audited, duplicate assets/grille-audit-site-web.xlsx and fill in
the Status column (Compliant / Non-compliant / To correct / To verify) as you go.
How to collect the information
The information needed for the audit is not all in one place — do not limit the check to the
footer. Browse the entire site: homepage, footer, menu/sidebar, and a selection of product pages,
to gather the elements required by each item in the grid. If an element remains unclear or cannot
be found after this review (e.g. CNDP number never displayed, ambiguous return procedure), flag
it as "To verify with the client" rather than guessing or defaulting to non-compliant.
How to rate each item (Compliant / Non-compliant / To correct)
- Compliant: the element is present and correct (e.g. right of withdrawal mentioned with the
correct 7-day period).
- Non-compliant: the element is absent or entirely missing (e.g. no mention of the right of
withdrawal anywhere on the site).
- To correct: the element is present but incorrect or incomplete (e.g. right of withdrawal
mentioned but with a 3-day period instead of 7) — in this case, specify what needs to change,
not just flag the issue.
Some elements are non-negotiable (e.g. right of withdrawal, seller identity, consent for data
collection): their absence should always be treated as High priority, regardless of context.
Others tolerate some flexibility depending on the client's context (e.g. intellectual property
terms of use, Low priority) — the priority already indicated in the grid reflects this
distinction.
1. Foundational documents — Terms & Conditions and Privacy Policy
First check whether the site has a Privacy Policy and Terms & Conditions (often in the
footer). Their mere presence is not enough: verify that they are genuinely tailored to the site
(not an irrelevant generic copy-paste) and that they cover, point by point:
Privacy Policy (Law 09-08) — check each of these points separately:
- Is the customer informed that their data is being collected (message before or during checkout)?
- Is it specified that this data is used only to process the order, with no undisclosed reuse
(marketing follow-up, resale to a third party)?
- Is the customer informed they can request deletion of their data?
- Is there a mention of how collected data is secured (phone number, address)?
- Explicit consent for browsing data (unchecked checkbox by default, cookie banner before
trackers are activated)
- Data retention period specified
- If the site uses foreign tools (Meta Pixel, Google Analytics): mention of a transfer of data
abroad
Terms & Conditions (Law 31-08) — check each of these points separately, not as a single block:
- Seller identity and contact details clearly visible
- Total price displayed including tax
- Delivery time AND delivery fees both communicated before checkout (both, not just one)
- Payment terms specified before checkout (e.g. cash on delivery vs. bank transfer)
- Right of return: period specified (7 clear days), clear procedure, return costs
specified (who bears them), exceptions listed (personalized products, perishable goods,
unsealed software, services already started)
- Terms & Conditions written specifically for this site (not a generic template copied without
adaptation)
2. Product pages
Once the foundational documents have been checked, verify the consistency of the information
shown on product pages themselves: price, delivery times, availability — this information should
match what the Terms & Conditions state.
3. Seller disclosures (Law 31-08)
Check separately:
- Seller name and contact visible (website, or Instagram/WhatsApp bio if activity is partly
informal)
- A dedicated address or channel for customer complaints (email or number distinct from the
general sales contact)
- Trade register (RC) registration — medium-term priority, not an immediate blocker
- Tax identification number — medium-term priority
4. Sector-specific authorizations (ONSSA / Ministry of Health)
Check whether the type of product sold requires a specific authorization — only relevant if the
client sells in a concerned sector:
- Food supplements / imported food: ONSSA authorization mandatory before any sale (risk:
seizure, criminal prosecution, customs seizure)
- Medicines: sale strictly reserved to pharmacies (risk: illegal practice of pharmacy) — flag
as absolute top priority if detected, regardless of the rest of the audit
- Cosmetics: case to be examined individually, do not conclude automatically
5. CNDP declaration
Check for the presence of a CNDP declaration receipt number (mandatory as soon as personal
data is collected). Medium-term priority (official process), useful for long-term
recommendations, even though it does not block day-to-day sales.
6. Consent banner (cookies / pixels)
Check for a functional consent banner before advertising trackers are activated (Meta Pixel,
Google Analytics) — in accordance with Art. 4 of Law 09-08.
7. Checkout process
Check separately:
- Is the customer informed of delivery times and fees before placing the order?
- Is a complete order summary presented before final confirmation (Art. 31, Law 31-08)?
- Is a written confirmation sent to the customer at delivery (its absence extends the
withdrawal period to 30 days)?
- Are payment terms (cash on delivery, bank transfer, etc.) specified before the order?
8. Right of withdrawal
Check that the legal withdrawal period (7 clear days from receipt, extended to 30 days if the
mandatory information was not confirmed in writing) is clearly stated, along with its procedure
and exceptions (personalized products, perishable goods, unsealed software, services already
started).
9. Dispute resolution
The level of expectation depends on the size of the site:
- Large platforms: a more formal dispute resolution mechanism is expected (structured
complaint procedure, possibly mediation).
- Small e-commerce businesses: a clear, functional contact available in case of a problem is
sufficient (visible email or phone number) — no formal mechanism required.
When information cannot be publicly verified
If an element cannot be confirmed from outside the site (e.g. actual existence of a CNDP
declaration, exact content of a supplier contract), flag it as "To verify with the client" rather
than defaulting it to Compliant or Non-compliant.
Deliverables
- Completed grid (
assets/grille-audit-site-web.xlsx duplicated and filled in) — status per
item, with the legal reference already indicated in the grid.
- Prioritized summary: group non-compliant items by priority (High / Medium / Low, already
indicated in the grid), not just a flat list.
- Concrete recommendations: for any non-compliance related to the Terms & Conditions or the
Privacy Policy, propose a replacement clause based on
assets/CGV_Template_Maroc_V3.docx and assets/Politique_Confidentialite_Maroc_V2.docx as a
starting point — adapt the bracketed placeholders ([Company name], [RC number], etc.) to
the audited client rather than copying them as-is.
Included resources
assets/grille-audit-site-web.xlsx — 14-item Website audit grid, with legal reference and
priority level for each item.assets/CGV_Template_Maroc_V3.docx — Terms & Conditions template compliant with Law 31-08,
with fields to customize (in brackets).assets/Politique_Confidentialite_Maroc_V2.docx — Privacy Policy template compliant with Law
09-08, with a reminder of the prior CNDP declaration obligation.
