If the ticket sales launch for the Africa Cup of Nations, taking place from December 21, 2025, to January 18, 2026, in Morocco, was marred by technical issues that made it difficult to use the YALLA app for creating a Fan ID, this same platform raises questions on another front. At its launch, the app did not include a mandatory mention regarding the protection of personal data. In recent hours, numerous internet users have reported technical problems accessing the YALLA app and difficulties creating a Fan ID as a result. While the failure of the NFC scan function is likely due to heavy traffic on the platform, another issue has emerged, the very use of this tool, which requires scanning an identity card or other personal document to complete registration. When it was launched, the app did not include a legal notice on the protection of users' personal data, despite such a statement being mandatory under Law 09.08. Enacted in 2009, this law includes a section on the «quality of data and prior consent of the concerned person». Article 3 specifies that «personal data must be: a) processed fairly and lawfully; b) collected for specified, explicit, and legitimate purposes, and not further processed in a way incompatible with those purposes; c) adequate, relevant, and not excessive in relation to the purposes for which they are collected and subsequently processed; and d) accurate and, where necessary, kept up to date». The same article adds that «all reasonable measures must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they are collected and processed, are erased or rectified». It also stipulates that such information must be «kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which they are collected or processed». The law further requires the data controller to «ensure compliance» with these provisions regarding the storage and processing of information, under the supervision of the National Commission for the Control of the Protection of Personal Data (CNDP). Compliance Measures to Cover All Sectors On its official portal, the CNDP stresses that such online practices must comply with the law. «Any website manager who collects and processes personal data is required by Law 09.08 to notify the CNDP of the processing carried out on said site», the institution emphasizes. Contacted by Yabiladi on Tuesday, a source close to the matter confirmed that the issue of the YALLA app's compliance with legal provisions would be resolved «imminently». The Royal Moroccan Football Federation (FRMF), which launched the app, did not respond to our phone inquiries. For now, only the app's page on Google Play includes a note on data security, which does not specify the app's own responsibility. The issue is particularly pressing given that the CNDP has accelerated its compliance program in recent months. Several companies and institutions have already been urged to comply with the provisions of Law 09.08 concerning personal data processing, part of a broader, ongoing process launched a year ago to extend compliance across all sectors.
