Personal data is no longer a byproduct of the web. It is a structural resource, much like energy was yesterday: it shapes advertising, credit, insurance, security, politics, and now artificial intelligence. The problem isn't just with collection, but with the ability to connect scattered traces to create a usable profile. What is sold today is not 'your name', but your behavior: your habits, vulnerabilities, intentions, purchasing power, voting patterns, mobility, and acceptance of one offer over another.
The European Union has attempted to break this logic through standards and sanctions. The GDPR introduced a heavy framework, with individual rights and obligations for companies, followed by a control mechanism through national authorities. The numbers give an idea of the scale: since 2018, the total fines under the GDPR have exceeded 5.8 billion euros according to enforcement tracking databases. The emblematic example remains Ireland, where Meta was hit with a record fine of 1.2 billion euros in 2023 for data transfer issues between the EU and the United States. This European logic no longer stops at classic 'privacy': in April 2025, the European Commission also fined Meta 200 million euros under the Digital Markets Act, targeting the heart of the advertising model, specifically the combination of data across services. In other words, the battle is no longer just about morality ('respect for privacy'), but about economics ('who has the right to combine what, and to create what dominance').
However, European regulation has a limit: the digital life of users is cross-border. It’s easier to control what happens within the Union than once an infrastructure, a cloud, a marketing tool, or technical support extends beyond its perimeter. This is where the question becomes geopolitical: data is not just a matter of rights, but of sovereignty. It is no coincidence that China has implemented a structuring national law, the Personal Information Protection Law, which took effect on November 1, 2021. The Chinese logic is clear: regulate collection, control transfers, and integrate data into a national security doctrine. For companies, this means complex compliance; for the state, control over flows; for citizens, protection coexists with a strong public ability for oversight.
Between the two models, the United States embodies another reality: the absence of a single federal law comparable to the GDPR. Instead, the country moves in fragments, with California leading the way. The California Consumer Privacy Act came into effect in 2020 and was subsequently enhanced by the CPRA effective in 2023. But America increasingly resembles a mosaic: the IAPP reports a proliferation of 'comprehensive' laws at the state level, and several legal analyses estimate that by the beginning of 2026, around twenty consumer protection laws will be in effect across the states. For American citizens, this means rights that vary depending on where they live. For businesses, a maze of compliance. For platforms, a paradoxical advantage: in the absence of a federal standard, dominant architectures remain difficult to uproot.
India, on the other hand, has embarked on a path worthy of attention, as it represents a mass digital power. The Digital Personal Data Protection Act was adopted on August 11, 2023, and the Indian state took another step in November 2025 with the notification of associated rules and the establishment of the planned governance body. This timeline indicates one thing: even countries that have been slow to legislate are now accelerating, as without a data framework, there is neither trust in digital services nor the capacity to industrialize AI on a large scale.
And where does Morocco fit into all this? The country has a legal foundation with Law 09-08 (February 18, 2009) and a regulatory authority, the CNDP. This is often an underestimated point: in an economy where digital services and outsourcing are rising, 'data' credibility becomes an asset. But the Moroccan challenge is not just to have a law: it is to implement it within the real ecosystem, including online advertising, commercial prospecting, client databases, trackers, transfers, and hosting. In other words: transforming data protection from a legal text into an operational reflex in the economy.
Ultimately, the question 'do data escape citizens?' calls for a nuanced answer. In discourse, rights are advancing: consent, access, deletion, limitation, and correction. In reality, the data economy remains asymmetric: the user signs quickly, understands little, and extraction occurs continuously. The true shift lies elsewhere: in the ability of regulators to reduce the economic incentive to collect 'by default', and in the capacity of citizens to choose without being penalized. As long as refusing means losing a service, paying more, or being less visible, freedom remains theoretical.
The upcoming battle is therefore not only about 'privacy'. It is about market power. Personal data is valuable not just because it exists, but because it aggregates. And in a world dominated by a few platforms and AI, whoever controls the aggregation controls a part of economic reality.
