Rabat — The rollout of the Yalla app, the official platform for Fan ID registration ahead of the Africa Cup of Nations (AFCON 2025) in Morocco, has faced widespread criticism following technical failures and growing concerns about data protection compliance.
Users have reported frequent crashes, failed NFC scans, and registration delays due to heavy traffic on the app. However, a more serious issue emerged soon after launch — the absence of a mandatory legal notice on personal data protection, as required under Morocco’s Law 09.08.
The law, enacted in 2009, outlines strict rules governing how personal data is collected, processed, and stored. It mandates that such data must be:
- Collected lawfully and for specific, legitimate purposes.
- Adequate, relevant, and not excessive.
- Accurate and kept up to date.
- Retained only for as long as necessary.
Additionally, it places full responsibility on data controllers to ensure compliance, under the supervision of the National Commission for the Control of the Protection of Personal Data (CNDP).
On its official portal, the CNDP stresses that any website or app collecting user information must formally notify the Commission about its data processing practices. “Any website manager who collects and processes personal data is required by Law 09.08 to notify the CNDP of the processing carried out,” the regulator reiterated.
A source close to the matter told Yabiladi that the Yalla app’s compliance issue is expected to be resolved “imminently.” The Royal Moroccan Football Federation (FRMF), which launched the app, has not yet commented.
Currently, only the app’s Google Play Store page contains a brief mention of data security — one that lacks clarity about the app developer’s direct accountability. The issue has drawn attention as the CNDP has accelerated its nationwide compliance drive, requiring companies and public institutions to fully adhere to data protection standards across all sectors.
