How Morocco's parties use your data in their campaigns - explained

This is the third in a series of explainers on Morocco’s Sept. 23 legislative election.

Moroccans vote on Sept. 23 in a campaign where voter data are receiving closer regulatory scrutiny, as political outreach moves further onto digital platforms and the CNDP spells out ten rules for parties and other electoral actors.

Here is what has changed, what has not, and what has gone wrong before.

What does the law require?

Morocco’s data protection authority, the National Commission for the Control of Personal Data Protection (CNDP), published ten requirements for political parties on Aug. 31.

Parties must notify the CNDP before they begin processing personal data, collect it “loyally and transparently,” and use it only for a stated purpose. Data revealing a person’s political opinions is classified as sensitive and can be processed only with that person’s explicit consent. Retention is capped at whatever period the stated purpose requires, and any outside contractor a party uses must be bound by a compliant contract, including for any cross-border transfer of data.

The rules build on Law No. 09-08, a 2009 statute that created the CNDP and governs personal data processing generally. The commission has also opened a hotline, 3020, for citizens with questions or complaints about how their data is being used during the vote.

Where do parties get your information?

There are several pools of information, but little public evidence showing whether, or how, parties use them.
The first is the electoral roll itself. Parliament approved parties’ right to obtain final voter lists containing voters’ national ID numbers, names and addresses. It also tells a party who is registered in a given constituency, but not how that person voted, or which party they support.

A second pool is built by the parties themselves, through membership records and information gathered by candidates and local organizers during meetings, home visits, phone calls and text messages.

An Afrobarometer survey found that 18% of Moroccan respondents said a political party had contacted them during the 2016 campaign the survey covered, 6% describing the contact as an effort to mobilize existing supporters, 12% as persuasion, and 2% as an attempt to draw supporters away from another party.

The remaining layer is digital advertising, and in Morocco there exists a handful of digital agencies that openly offer parties and candidates audience segmentation, voter-data collection and personalized outreach, while at least one agency has publicly confirmed work for a major Moroccan party in 2021. But such disclosures are rare, and they reveal little about the data behind the work.

Advertising platforms such as Meta form a clearer part of the chain and parties pay them to reach selected audiences, while much of the information used to select those users remains with the platform.

Where did that ad come from?

A party can also take it one step further and upload names or phone numbers it has collected to Meta as a “Custom Audience.” Meta matches them with Facebook and Instagram accounts, then reports how many people saw the advertisement without identifying individual viewers.

The party can also ask Meta to find a “lookalike audience,” meaning other users who share characteristics with the people on its original list. The CNDP requires parties to declare this processing and tell citizens who is using their information and for what purpose. Prior consent is also required before personal data can be used for direct political solicitation.

Meta’s public archive can identify the advertisement and its sponsor, but it does not tell a voter whether they were reached because their number appeared on a party list, because they resembled the people on that list or because Meta placed them in another target group.

Has voter data leaked before?

In August 2021, what appeared to be an official voter list for a district of Mohammedia,including names, addresses and registration details dated days earlier, began circulating on social media during that year’s campaign. It was never established who leaked it or why.

Morocco’s National Human Rights Council, which monitored that campaign’s social media activity, separately found that political groups and candidates,without naming them, sent citizens unsolicited text messages, emails and letters urging them to vote.

The council also recorded online disclosures of personal information belonging to women candidates, including national ID numbers.

Does it actually work ?

Young Moroccans vote at lower rates than older citizens, and traditional voter outreach can be expensive. Ahead of the 2021 election, the Moroccan civic group Tafra and university researchers tested whether inexpensive online tools could help close that participation gap.

They recruited 7,521 Moroccans aged 18 to 35 through Facebook advertisements and randomly divided them into groups. Participants received voter-registration assistance, watched a short video about the value of voting, used a tool matching their views with party platforms or received none of those interventions.

A follow-up survey after the election found that the tools did not increase turnout across the full sample. They had some effect among participants who had initially been uncertain about voting, while the matching tool made people more likely to support the party closest to their stated views.