How to collect explicit and legal SMS consent in Morocco

However, having a person’s phone number (because they bought you a product or left their business card) doesn’t automatically give you the right to enroll them in a [massive SMS marketing] campaign.

The Act 09-08 (managed by the CNDP) requires prior, free, specific and informed consent (Opt-in). How to translate this legal jargon into technical processes on your website or in your store?

The legal nuance lies in the word "Explicit".The user must take a voluntary action to say "Yes".

🔸 What is illegal or invalid: - The pre-marked box on an e-commerce registration form ("I wish to receive offers via SMS"). Silence or inattention are not worth consent. - The clause drowned in a PDF of 20 pages of General Conditions of Sale (GTC). - The consent "group" ("By accepting these GTC, I agree to receive emails, SMS and my data to be resold"). - The collection of business cards at a trade fair (giving your card is not an opt-in for an SMS newsletter).

✅ What is valid: - A check box empty by default under the phone number field: "I agree to receive promotional offers by SMS from [Your Brand]". - A tablet at the reception of your physical store where the customer enters his number and voluntarily clicks on "Register to the VIP club by SMS".

The “Double Opt-in” is to ask for the number and then immediately send a Transaction SMS (OTP) saying: “Say YES to confirm your subscription to our offers”.

Moroccan legislation (CNDP) does not technically impose double opt-in (the "Simple Opt-in" explicit via form is enough). However, this is an excellent technical practice that many banks or retail giants adopt, as it protects the company from false entries (someone who enters his friend's number to make a joke with him).

If a consumer complains against your company to the CNDP for "Spam SMS", it is not up to him to prove that he did not give his consent, it is up to you to prove that he gave it.

Your database (MySQL, MongoDB or your CRM) shouldn’t just store a column phone_number.

Required fields in your database: - phone_number: +2126XXXXXX - optin_status: TRUE - optin_timestamp: 2026-10-15 14:32:00 - optin_source: "BlackFriday Web Form" or "IP: 192.168.x.x"

If the CNDP controls you, you can export this history to prove the legality of your list.

Let’s be clear: Buying or renting “Opt-in Number Files” sold by agencies in Casablanca or Rabat is an area of extreme danger.

Even if the seller swears to you that the numbers are "Opt-in", this consent has been given to a other company, not yours. The consent is generally not transferable unless at the initial collection it was explicitly mentioned: "I agree to receive offers from partners of the company X". But even in this case, the complaint rate (Disclaimer/STOP) will be massive, because the user will not recognize your [Sender ID(fr)/blog/how-obtain-un-sender-id-alphanerium-au-maroc-en-20/26/en).

SendSMS Recommendation: Never pay for number files. Use this budget to make qualified acquisitions (Facebook Lead Ads, competition games) where customers will voluntarily give their own number to your business. This is the only way to get a durable ROI.