Legal Compliance Audit — Moroccan E-commerce (Law 09-08 & Law 31-08)

When to use this skill

Use this skill when a user asks to audit, check, or assess the legal compliance of a Moroccan e-commerce website, specifically regarding:

• personal data protection (Law 09-08)
• consumer contract obligations and mandatory disclosures (Law 31-08)

Out of scope: Meta/Google advertising compliance (covered by a separate skill), law of other countries, definitive legal advice, marketplaces/multi-vendor platforms (not yet covered by this methodology), informal commerce without a website (selling only through a Facebook/Instagram page + WhatsApp, without formalized Terms & Conditions or privacy policy — not covered here, as this methodology assumes the existence of a website). The results of this audit are a structured starting point, to be validated by a professional before any contentious action.

Audit methodology

The audit always follows the same order, from the most visible/quick-to-check items to the more specific ones. For each site audited, duplicate assets/grille-audit-site-web.xlsx and fill in the Status column (Compliant / Non-compliant / To correct / To verify) as you go.

How to collect the information

The information needed for the audit is not all in one place — do not limit the check to the footer. Browse the entire site: homepage, footer, menu/sidebar, and a selection of product pages, to gather the elements required by each item in the grid. If an element remains unclear or cannot be found after this review (e.g. CNDP number never displayed, ambiguous return procedure), flag it as "To verify with the client" rather than guessing or defaulting to non-compliant.

How to rate each item (Compliant / Non-compliant / To correct)

• Compliant: the element is present and correct (e.g. right of withdrawal mentioned with the

correct 7-day period).

• Non-compliant: the element is absent or entirely missing (e.g. no mention of the right of

withdrawal anywhere on the site).

• To correct: the element is present but incorrect or incomplete (e.g. right of withdrawal

mentioned but with a 3-day period instead of 7) — in this case, specify what needs to change, not just flag the issue.

Some elements are non-negotiable (e.g. right of withdrawal, seller identity, consent for data collection): their absence should always be treated as High priority, regardless of context. Others tolerate some flexibility depending on the client's context (e.g. intellectual property terms of use, Low priority) — the priority already indicated in the grid reflects this distinction.

1. Foundational documents — Terms & Conditions and Privacy Policy

First check whether the site has a Privacy Policy and Terms & Conditions (often in the footer). Their mere presence is not enough: verify that they are genuinely tailored to the site (not an irrelevant generic copy-paste) and that they cover, point by point:

Privacy Policy (Law 09-08) — check each of these points separately:

• Is the customer informed that their data is being collected (message before or during checkout)?
• Is it specified that this data is used only to process the order, with no undisclosed reuse

(marketing follow-up, resale to a third party)?

• Is the customer informed they can request deletion of their data?
• Is there a mention of how collected data is secured (phone number, address)?
• Explicit consent for browsing data (unchecked checkbox by default, cookie banner before

trackers are activated)

• Data retention period specified
• If the site uses foreign tools (Meta Pixel, Google Analytics): mention of a transfer of data

abroad

Terms & Conditions (Law 31-08) — check each of these points separately, not as a single block:

• Seller identity and contact details clearly visible
• Total price displayed including tax
• Delivery time AND delivery fees both communicated before checkout (both, not just one)
• Payment terms specified before checkout (e.g. cash on delivery vs. bank transfer)
• Right of return: period specified (7 clear days), clear procedure, return costs

specified (who bears them), exceptions listed (personalized products, perishable goods, unsealed software, services already started)

• Terms & Conditions written specifically for this site (not a generic template copied without

adaptation)

2. Product pages

Once the foundational documents have been checked, verify the consistency of the information shown on product pages themselves: price, delivery times, availability — this information should match what the Terms & Conditions state.

3. Seller disclosures (Law 31-08)

Check separately:

• Seller name and contact visible (website, or Instagram/WhatsApp bio if activity is partly

informal)

• A dedicated address or channel for customer complaints (email or number distinct from the

general sales contact)

• Trade register (RC) registration — medium-term priority, not an immediate blocker
• Tax identification number — medium-term priority

4. Sector-specific authorizations (ONSSA / Ministry of Health)

Check whether the type of product sold requires a specific authorization — only relevant if the client sells in a concerned sector:

• Food supplements / imported food: ONSSA authorization mandatory before any sale (risk:

seizure, criminal prosecution, customs seizure)

• Medicines: sale strictly reserved to pharmacies (risk: illegal practice of pharmacy) — flag

as absolute top priority if detected, regardless of the rest of the audit

• Cosmetics: case to be examined individually, do not conclude automatically

5. CNDP declaration

Check for the presence of a CNDP declaration receipt number (mandatory as soon as personal data is collected). Medium-term priority (official process), useful for long-term recommendations, even though it does not block day-to-day sales.

6. Consent banner (cookies / pixels)

Check for a functional consent banner before advertising trackers are activated (Meta Pixel, Google Analytics) — in accordance with Art. 4 of Law 09-08.

7. Checkout process

Check separately:

• Is the customer informed of delivery times and fees before placing the order?
• Is a complete order summary presented before final confirmation (Art. 31, Law 31-08)?
• Is a written confirmation sent to the customer at delivery (its absence extends the

withdrawal period to 30 days)?

• Are payment terms (cash on delivery, bank transfer, etc.) specified before the order?

8. Right of withdrawal

Check that the legal withdrawal period (7 clear days from receipt, extended to 30 days if the mandatory information was not confirmed in writing) is clearly stated, along with its procedure and exceptions (personalized products, perishable goods, unsealed software, services already started).

9. Dispute resolution

The level of expectation depends on the size of the site:

• Large platforms: a more formal dispute resolution mechanism is expected (structured

complaint procedure, possibly mediation).

• Small e-commerce businesses: a clear, functional contact available in case of a problem is

sufficient (visible email or phone number) — no formal mechanism required.

When information cannot be publicly verified

If an element cannot be confirmed from outside the site (e.g. actual existence of a CNDP declaration, exact content of a supplier contract), flag it as "To verify with the client" rather than defaulting it to Compliant or Non-compliant.

Deliverables

1. Completed grid (assets/grille-audit-site-web.xlsx duplicated and filled in) — status per

item, with the legal reference already indicated in the grid.

1. Prioritized summary: group non-compliant items by priority (High / Medium / Low, already

indicated in the grid), not just a flat list.

1. Concrete recommendations: for any non-compliance related to the Terms & Conditions or the

Privacy Policy, propose a replacement clause based on assets/CGV_Template_Maroc_V3.docx and assets/Politique_Confidentialite_Maroc_V2.docx as a starting point — adapt the bracketed placeholders ([Company name], [RC number], etc.) to the audited client rather than copying them as-is.

Included resources

• assets/grille-audit-site-web.xlsx — 14-item Website audit grid, with legal reference and

priority level for each item.

• assets/CGV_Template_Maroc_V3.docx — Terms & Conditions template compliant with Law 31-08,

with fields to customize (in brackets).

• assets/Politique_Confidentialite_Maroc_V2.docx — Privacy Policy template compliant with Law

09-08, with a reminder of the prior CNDP declaration obligation.