Basic mode or advanced mode in Morocco: which one to pick?

Advanced mode in 95% of cases. Law 09-08 does not distinguish the two modes: compliance hinges on the absence of an identifying cookie until consent is granted, which both modes honor. Advanced mode layers in cookieless pings that contain no personal identifier, and lets Google model 60 to 70% of denied conversions. Basic mode is only relevant if your legal team mandates zero traffic to Google before consent — a defensible position, but one that costs heavily in signal.

Is Moroccan law 09-08 equivalent to European GDPR?

On substance, yes — about 90%. The two texts share the same principles: prior consent, explicit purpose, capped retention, rights of access and deletion. On enforcement, law 09-08 was applied more loosely for years. Since the CNDP March 2024 deliberation, Moroccan doctrine explicitly aligns on the French CNIL line. For a Moroccan site also serving EU visitors, aiming for GDPR compliance automatically guarantees 09-08 compliance.

Cookiebot or OneTrust: which CMP for a Moroccan SMB?

Cookiebot in 90% of cases. Pricing starts at 9 EUR/month for a small site, scales to 39 EUR for a full SMB pack, and includes automatic cookie scanning, French/Arabic multilingual UI and a CNDP-ready audit log. OneTrust only justifies itself beyond five domains, or for groups with an in-house legal team able to exploit its advanced governance features. Above that line, the cost gap is not absorbed by operational gains.

How do you measure the real impact of Consent Mode v2 on Google Ads?

Three indicators to track over the first eight weeks. First, the modeled conversions column in GA4 Consent Report: it should account for 12 to 18% of total. Second, the Google Ads CPA on Smart Bidding campaigns: expected drop of 18 to 26% at constant budget. Third, the volume of remarketing audiences: expected recovery to 65 to 75% of pre-GDPR levels. If any of these three indicators stays flat after six weeks, the CMP-to-gtag mapping is at fault.

Is Consent Mode v2 compatible with Meta CAPI?

Yes — and it is in fact the stack Webotic recommends. Consent Mode v2 steers Google tags. Meta CAPI, fired server-side from a Server-Side GTM container, handles Meta tracking with its own consent signals (Meta CAPI accepts an opt_out field per event). Both layers share the same CMP banner that drives consent states, and both honor the absence of identifier until consent is granted. The cohabitation is documented and stable since late 2024.

What is the real risk of a CNDP fine in Morocco in 2026?

The risk has moved from theoretical to concrete since 2024. CNDP has multiplied inspections, particularly across e-commerce, lead generation, healthcare and financial services. The maximum statutory fine is 300,000 MAD per breach, plus a mandatory remediation obligation under a tight deadline, typically 30 days. Beyond the fine itself, the operational cost of an emergency compliance overhaul (audit, tracking rebuild, user notification) often exceeds the fine. Better to handle it preventively.

How long does a clean advanced Consent Mode v2 build take?

One to two working days on a site with web GTM already in place and a CMP chosen. Most of the time goes into the CMP-to-gtag mapping, Tag Assistant verification and reading the GA4 report at 24-48 hours. If you also operate a Server-Side GTM container, add one day to propagate consent_state on the server side. A from-scratch implementation (no GTM in place) takes 5 to 8 days depending on the complexity of the existing tracking.

Mid-2026 update: what has changed for Consent Mode v2 in Morocco?

Two developments define the first half of 2026. On the Moroccan side, the CNDP has stepped up enforcement of law 09-08, issuing formal notices to websites running non-compliant consent banners — no genuine refuse option, pre-ticked boxes. On Google's side, Consent Mode v2 is now required for any audience building or remarketing targeting the EEA, and recommended everywhere else, Morocco included. Our recommendation is unchanged: advanced mode paired with behavioral modeling remains the best trade-off between compliance and ad signal in Google Ads, and the gap in measured conversions between basic and advanced still sits at roughly 15 to 25% in favor of advanced.

Back to blog

/ 03 · consent-mode-v2-marocGDPRApril 6, 202612 min

GDPR · CONSENT MODE V2

Consent Mode v2 in Morocco: 09-08 compliance without losing Google Ads signal.

Law 09-08, CNDP, GDPR-equivalent: Morocco's privacy framework demands strict prior consent. Without Consent Mode v2 advanced, a Moroccan Google Ads account loses 30 to 50% of its conversions. This guide breaks down basic mode, advanced mode and Google modeling across 18 Webotic accounts in Q1 2026.

By Marouane MohachtouFounder & CEO

60-70%Advanced recoverymodeled conversions

30-50%Loss without CMv2Google Ads signal

300kMax 09-08 fineMAD · CNDP sanction

1-2Implementationdays · site with GTM

The Moroccan framework: law 09-08, CNDP and why GDPR-equivalent changes the game

Law 09-08 of February 18, 2009, administered by CNDP (the National Commission for the Protection of Personal Data), has framed personal data processing in Morocco for fifteen years. On paper, the text reads very close to the European GDPR: prior consent, explicit purpose, capped retention, right of access, right to erasure. In practice, enforcement on commercial websites stayed lenient until 2024. CNDP published a March 2024 deliberation that explicitly aligns its doctrine with the French CNIL position on non-essential cookies: freely given, informed, specific, demonstrable consent. Since then, inspections have multiplied, particularly across e-commerce sites, lead-gen platforms and healthcare operators. The maximum fine under law 09-08 reaches 300,000 MAD for a serious consent failure, with an additional obligation to remediate under a tight deadline. Any Moroccan site dropping Google Analytics, Meta Pixel, TikTok Pixel or a server-side tracking script without a compliant prior-consent banner is exposed today, regardless of revenue. The topic has moved from theoretical legal concern to operational risk in less than eighteen months.

Law 09-08 administered by CNDP, in force since 2009, tightened by the March 2024 deliberation.
Maximum fine: 300,000 MAD per breach, plus mandatory remediation under deadline.
Doctrine aligned with CNIL France since 2024: free, informed, specific, demonstrable consent.
Priority inspection targets for 2025-2026: e-commerce, lead generation, healthcare, financial services.

Consent Mode v2 explained: the four signals that steer your Google tags

Consent Mode v2 is an orchestration layer developed by Google that adapts how Google tags (Analytics, Ads, Floodlight, Campaign Manager) behave based on the user's consent state. Concretely, your GTM container forwards four boolean signals to Google, updated in real time by the CMP. The first signal, analytics_storage, allows or blocks the GA4 cookie. The second, ad_storage, allows or blocks the advertising cookie used for Google Ads remarketing and conversion measurement. The two signals added by v2, ad_user_data and ad_personalization, have been mandatory since March 2024 for any EEA or UK delivery — and effectively mandatory everywhere else if you want to preserve remarketing and algorithmic optimization. The ad_user_data signal authorizes the sharing with Google of the identifiers needed for post-click measurement; ad_personalization authorizes the use of that data for remarketing and similar audiences. Without these two signals at granted, your Performance Max campaigns and Customer Match audiences lose their main optimization lever. This is precisely where a Moroccan Google Ads account's performance is won or lost in 2026.

analytics_storage: drives the GA4 cookie. Denied = measurable user journey lost.
ad_storage: drives the Google Ads cookie. Denied = post-click measurement lost.
ad_user_data: authorizes identifier sharing for post-click measurement.
ad_personalization: authorizes remarketing, Customer Match and similar audiences.

Basic mode vs advanced mode: the 60-point recovery gap

Two implementation modes coexist within Consent Mode v2, and the difference is neither cosmetic nor purely legal: it weighs 60 percentage points of recovery on denied conversions. In basic mode, Google tags are fully blocked until the user consents. No data is sent to Google, not even an anonymous ping. Compliance is maximal, but the analytical cost is brutal: 0% recovery on the denying fraction. If 45% of your Moroccan visitors refuse cookies — the median rate Webotic observed in Q1 2026 — you lose 45% of your conversion signal outright. In advanced mode, Google tags load from the first hit but without an identifying cookie. As long as consent is not granted, they send anonymized pings to Google: no user identifier, no stored IP, no fingerprint. These pings let Google statistically model the missing conversions based on patterns observed across consenting users. Google's official documentation states 60 to 70% recovery on denied conversions under normal conditions — figures confirmed across the 18 Moroccan accounts Webotic migrated to advanced between January and April 2026. CNDP has not yet ruled specifically on cookieless pings, but the legal consensus on the ground treats them as compatible with law 09-08 as long as no personal identifier is transmitted.

Basic: 0% recovery on the denying fraction. Maximum compliance, raw analytical cost.
Advanced: 60-70% recovery via Google modeling. Cookieless pings, no identifier.
Webotic recommendation: advanced for any account spending more than 5,000 MAD/month on Google Ads.
Modeling activates after ~1,000 conversions across 7 days per campaign. Below that, the gain is partial.

Cookiebot, OneTrust or Axeptio: picking a Google-certified CMP Partner

The CMP (Consent Management Platform) choice drives both implementation quality and legal robustness. Google maintains a public list of certified CMP Partners: only these solutions correctly forward the four Consent Mode v2 signals and pass automatic validation on the Google Ads side. Three options dominate the Moroccan market in 2026. Cookiebot by Usercentrics remains the robust default: from 9 EUR/month for a site up to 100 subpages, scaling to 39 EUR/month for the SMB pack, natively bundles a cookie scanner, handles French/Arabic/English multilingual UI and produces an audit log that meets CNDP requirements. OneTrust targets enterprise and multi-domain accounts: pricing on quote from 1,200 EUR/year for a Moroccan SMB, only justifies its cost beyond five domains or for groups with an in-house legal team. Axeptio, French-founded, offers the best UX in French language with a less aggressive banner design than its competitors: from 15 EUR/month, particularly fit for consumer-facing Moroccan sites where acceptance rate is sensitive to design. CookieYes rounds out the small-budget end: free up to 25,000 visitors/month, sufficient for a brochureware site, more limited on Arabic and audit logging. The pragmatic rule: Cookiebot for 90% of Moroccan SMBs, OneTrust for multi-brand groups, Axeptio for design-sensitive B2C sites, CookieYes for early-stage brochureware.

Cookiebot: 9 to 39 EUR/month, multilingual fr/ar/en, CNDP-ready audit log, default pick.
OneTrust: 1,200 EUR/year and up, justified beyond 5 domains or with in-house legal.
Axeptio: 15 EUR/month, best French-language UX, sensitive to B2C acceptance rate.
CookieYes: free up to 25,000 visitors, sufficient for an early brochureware site.

Step-by-step implementation: CMP, web GTM, server-side GTM, verification

A clean advanced Consent Mode v2 implementation unfolds in four steps on a site with GTM already in place, totaling one to two working days for a tidy build. Step 1, install the CMP via the vendor's official GTM template. Configure copy in French and in Moroccan Arabic darija if the audience is bilingual. Define cookie categories (essential, analytics, marketing, functional) with clear descriptions that match the 2024 CNDP deliberation. The banner copy must explicitly name the data recipients (Google, Meta, TikTok) — that is the exact point CNDP reinforced in 2024. Step 2, create a Consent Initialization tag in GTM that fires first and sets the default state: all signals at denied. Activate advanced mode through the url_passthrough and ads_data_redaction parameters depending on your strategy. Step 3, map the CMP events (onConsent, onPreferenceChange) to the gtag('consent', 'update', ...) signal updates. This is the step that demands the most care: an incorrect mapping produces either over-consent (illegal) or under-consent (signal loss). Step 4, verify in Google Tag Assistant that signals do move from denied to granted on acceptance, and that advanced mode emits cookieless pings on rejection. Complete the check in GA4 > Admin > Data Streams > Consent: the report should surface acceptance rate by country and device within 24 to 48 hours. If you also run a Server-Side GTM container (recommended to recover an extra 25 to 35% of signal), consent signals are forwarded to the server container via the consent_state parameter, which honors them before any outbound call to Google or Meta.

Step 1 — CMP: official GTM template, fr/ar copy, explicit categories, named recipients.
Step 2 — Consent Initialization: top-priority tag, all signals denied by default, advanced mode.
Step 3 — Mapping CMP → gtag consent update. The step most exposed to error.
Step 4 — Verify in Tag Assistant + GA4 Consent Report. Observation window: 24-48 hours.

Pairing with Server-Side GTM and Meta CAPI: the stack that recovers 88 to 92%

Advanced Consent Mode v2 alone is not the full stack. Across the 18 Webotic accounts tracked in Q1 2026, the Consent Mode v2 + Server-Side GTM + Meta CAPI pairing produces a measured 88 to 92% recovery of total conversion signal, versus 50 to 60% with a classic client-side setup without CMv2. The stacking logic is straightforward. Consent Mode v2 advanced handles the consent layer: 60-70% recovery via Google modeling on the denying fraction. Server-Side GTM, hosted on a first-party subdomain (e.g. data.webotic.ma), handles the browser layer: it bypasses ad-blockers, Safari ITP capping third-party cookies at 7 days, and iOS ATT restrictions that hit 15 to 20% of Moroccan mobile traffic. Server-side recovery on the consenting fraction reaches 25 to 35% on top of client-side alone. Meta CAPI, fired by the server container, completes the stack on the Meta side: it sends conversions through the server API with hashed first-party data (email, phone, dedupe event ID), recovering on average 35% of post-ATT iOS conversions the browser pixel no longer sees. The whole stack stays fully compatible with law 09-08 as long as first-party data collection (email, phone) takes place after explicit consent, and Consent Mode signals actually steer the server container via the consent_state parameter. A Rabat-area e-commerce account tracked by Webotic moved from 2.8x to 4.1x Google Ads ROAS in 90 days after switching to this full stack, with no change in budget or creative.

Consent Mode v2 advanced: +60-70% on the denying fraction.
Server-Side GTM: +25-35% on the consenting fraction (ad-blockers, ITP, ATT).
Meta CAPI: +35% on post-ATT iOS conversions on the Meta side.
Cumulated measured recovery: 88-92% of total signal, versus 50-60% client-side only.

Measuring real impact: Smart Bidding, Performance Max, attribution

The real impact of a solid Consent Mode v2 advanced implementation is not read in the consent report. It is read in the performance of the bidding algorithms. Across the 18 Webotic accounts in Q1 2026, before/after metrics held steady: reported conversions up 32 to 41% on average by week three, CPA down 18 to 26% thanks to improved signal feeding Smart Bidding, modeled conversion rate at 12 to 18% of total — exactly the gap created by cookie refusals. Impact is sharpest on Performance Max and Smart Shopping, whose algorithms depend heavily on conversion signal volume. A PMax campaign moving from 4 conversions/day to 7 conversions/day (combined effect of additional real conversions plus injected modeled conversions) exits the learning phase faster and stabilizes its CPA 30 to 45% lower. On the audience side, Google Ads remarketing recovers 65 to 75% of its baseline volume via modeled audiences, versus 0% in strict basic. On attribution, GA4 surfaces a dedicated modeled conversions column in its Acquisition > Traffic Acquisition report, which should be monitored weekly during the first eight weeks: if it stays at 0%, the implementation has a technical defect (basic mode instead of advanced, or cookieless pings being blocked). If it exceeds 25% of total, it usually signals an overly aggressive banner that over-triggers refusals.

Reported conversions: +32-41% by week 3 post-switch.
Smart Bidding CPA: -18-26% from richer optimization signal.
Modeled remarketing audiences: 65-75% of baseline volume recovered.
GA4 Consent Report: monitor weekly for 8 weeks, flag if modeling at 0% or above 25%.

FREQUENTLY ASKED QUESTIONS

Basic mode or advanced mode in Morocco: which one to pick?: Advanced mode in 95% of cases. Law 09-08 does not distinguish the two modes: compliance hinges on the absence of an identifying cookie until consent is granted, which both modes honor. Advanced mode layers in cookieless pings that contain no personal identifier, and lets Google model 60 to 70% of denied conversions. Basic mode is only relevant if your legal team mandates zero traffic to Google before consent — a defensible position, but one that costs heavily in signal.
Is Moroccan law 09-08 equivalent to European GDPR?: On substance, yes — about 90%. The two texts share the same principles: prior consent, explicit purpose, capped retention, rights of access and deletion. On enforcement, law 09-08 was applied more loosely for years. Since the CNDP March 2024 deliberation, Moroccan doctrine explicitly aligns on the French CNIL line. For a Moroccan site also serving EU visitors, aiming for GDPR compliance automatically guarantees 09-08 compliance.
Cookiebot or OneTrust: which CMP for a Moroccan SMB?: Cookiebot in 90% of cases. Pricing starts at 9 EUR/month for a small site, scales to 39 EUR for a full SMB pack, and includes automatic cookie scanning, French/Arabic multilingual UI and a CNDP-ready audit log. OneTrust only justifies itself beyond five domains, or for groups with an in-house legal team able to exploit its advanced governance features. Above that line, the cost gap is not absorbed by operational gains.
How do you measure the real impact of Consent Mode v2 on Google Ads?: Three indicators to track over the first eight weeks. First, the modeled conversions column in GA4 Consent Report: it should account for 12 to 18% of total. Second, the Google Ads CPA on Smart Bidding campaigns: expected drop of 18 to 26% at constant budget. Third, the volume of remarketing audiences: expected recovery to 65 to 75% of pre-GDPR levels. If any of these three indicators stays flat after six weeks, the CMP-to-gtag mapping is at fault.
Is Consent Mode v2 compatible with Meta CAPI?: Yes — and it is in fact the stack Webotic recommends. Consent Mode v2 steers Google tags. Meta CAPI, fired server-side from a Server-Side GTM container, handles Meta tracking with its own consent signals (Meta CAPI accepts an opt_out field per event). Both layers share the same CMP banner that drives consent states, and both honor the absence of identifier until consent is granted. The cohabitation is documented and stable since late 2024.
What is the real risk of a CNDP fine in Morocco in 2026?: The risk has moved from theoretical to concrete since 2024. CNDP has multiplied inspections, particularly across e-commerce, lead generation, healthcare and financial services. The maximum statutory fine is 300,000 MAD per breach, plus a mandatory remediation obligation under a tight deadline, typically 30 days. Beyond the fine itself, the operational cost of an emergency compliance overhaul (audit, tracking rebuild, user notification) often exceeds the fine. Better to handle it preventively.
How long does a clean advanced Consent Mode v2 build take?: One to two working days on a site with web GTM already in place and a CMP chosen. Most of the time goes into the CMP-to-gtag mapping, Tag Assistant verification and reading the GA4 report at 24-48 hours. If you also operate a Server-Side GTM container, add one day to propagate consent_state on the server side. A from-scratch implementation (no GTM in place) takes 5 to 8 days depending on the complexity of the existing tracking.
Mid-2026 update: what has changed for Consent Mode v2 in Morocco?: Two developments define the first half of 2026. On the Moroccan side, the CNDP has stepped up enforcement of law 09-08, issuing formal notices to websites running non-compliant consent banners — no genuine refuse option, pre-ticked boxes. On Google's side, Consent Mode v2 is now required for any audience building or remarketing targeting the EEA, and recommended everywhere else, Morocco included. Our recommendation is unchanged: advanced mode paired with behavioral modeling remains the best trade-off between compliance and ad signal in Google Ads, and the gap in measured conversions between basic and advanced still sits at roughly 15 to 25% in favor of advanced.