Cameroon

Cameroon's comprehensive personal-data statute is Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun, promulgated on 23 December 2024 and published on the Presidency's own gazette listing; it is Cameroon's first statute specifically dedicated to personal-data protection.

It applies to processing carried out by the State, decentralized territorial authorities, or any other natural or legal person, over the data of any person established, resident, or in transit in Cameroon, and reaches processing carried out abroad wherever Cameroonian law applies under international law or a ratified treaty.

Processing rests on one of a limited set of legal bases including consent, legal obligation, a public-interest mission, and health protection; consent must be free, informed, specific, unequivocal, and express, and processing a minor's data (under 18) additionally needs parental or legal-representative consent.

Sensitive categories, including health data, biometric data, judicial data, religious or political opinions, and banking transactions among others, are in principle prohibited from processing.

The law establishes a prior-authorization regime under which an organization must obtain the data protection authority's authorization before processing, keep a register of processing activities, and notify the authority of a breach without delay, informing affected persons where their rights are threatened; it also creates an independent public data protection authority, whose own organization and functioning is left to a presidential decree not yet issued as of 4 September 2026.

A cross-border transfer of personal data to a foreign country or an international organization needs the authority's prior authorization, conditioned on the destination offering an equivalent level of protection. The law opened an 18-month transitional period from its promulgation for existing processing operations to come into conformity, running to 23 June 2026.

Separately, and predating this comprehensive statute, Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun already criminalized a range of personal-data misuse within its own offences chapter: recording or transmitting private or confidential electronic data without the data subject's consent, intercepting personal data in transit between information systems, processing personal data in violation of the prior declaration or authorization formalities that preceded the 2024 law, collecting personal data by unlawful means to harm a person's privacy or reputation, and, at doubled penalties, putting online, storing, or diverting data revealing tribal origin, political or religious opinions, trade-union membership, or morals without the person's express agreement, as well as retaining data in nominative or encrypted form beyond the legal duration stated in the request for opinion or the prior declaration, or disclosing nominative data harming the victim's standing.

Open-web crawling of public pages carries no dedicated Cameroonian statute.

The applicable computer-misuse authority is Loi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, which criminalizes fraudulently accessing or remaining within all or part of an electronic-communications network or information system while causing a serious disruption or interruption of its functioning (article 68), and separately criminalizes accessing without right and in violation of security measures, all or part of a network, system, or terminal equipment in order to obtain information or data (article 69); no Cameroonian court decision construes how authorization is read for a public, unauthenticated page, and the law's own definition of unlawful access turns on the absence of a right or on a security-measure violation, so it does not by its terms exempt a public page reached without circumventing any technical measure.

No statute or case law addresses terms-of-service enforceability (browsewrap versus clickwrap), or whether login or acceptance of terms changes the legal picture; ordinary contract-formation principles under Cameroon's general civil law would be the applicable general law for a contract-formation question, but this is unsettled rather than a specific regime.

Copyright protects a database only as a compilation, never through a separate sui generis right: Loi n°2000/011 du 19 décembre 2000 relative au droit d'auteur et aux droits voisins defines a database as a collection of works, data, or other elements systematized so as to be searchable and processable by computer, and protects as an original composite work a collection of works, including collections of folklore expressions or of simple facts or data, such as encyclopedias, anthologies, and data compilations, reproduced on a machine-exploitable medium or otherwise, where the selection or arrangement of the material constitutes an original work; the underlying facts and data are not protected as such.

Personal-data reach over scraped public personal data is governed by Loi n°2024/017 du 23 décembre 2024, researched in full under the privacy topic; its scope provisions extend to processing by any natural or legal person over data of a person established, resident, or in transit in Cameroon, without a general publicly-available-data carve-out identified, and processing that reveals a sensitive category, including biometric data, is in principle prohibited.

No specific unfair-competition or misappropriation doctrine addresses scraping, and no case law or regulatory statement gives robots.txt legal weight or addresses AI-training-specific access rules.

Cameroon has enacted a broad child-online-protection charter rather than a narrow adult-content-verification or social-media-minor statute. Loi n°2023/009 du 25 juillet 2023 portant charte de protection des enfants en ligne au Cameroun defines a child as any person under 18 (article 3); at 18, a person may validly give online consent and is treated as able to appreciate the deviant or dangerous character of certain content.

The charter brings private-sector actors, internet access providers, content providers, information-system operators, social-network promoters, online-advertising professionals, and audiovisual-communication operators, into the same child-protection duties as public authorities (articles 11 to 14), requiring them to raise awareness among children of ineligible or dangerous sites.

General obligations require these actors to stop indexing content that harms a child's dignity and to report such content to the competent authorities; specific obligations require making available to minor users guides to good practice in cyberspace and to dangerous activities.

Enforcement combines administrative and criminal sanctions: a private actor found in breach is given formal notice by the telecommunications-regulation body to come into compliance within 15 days, and only after that deadline passes unmet can the regulator pronounce administrative sanctions, which are essentially financial; criminal sanctions, defined from article 28 onward, range from fines through imprisonment to prohibitions and temporary closures.

The charter's gazetted text is not publicly available in an accessible form; the provisions described here are as reported by professional legal commentary, and its commencement is not established.

Cameroon has no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no statute or case law addressing hyperlinking or framing liability specifically; each of those dimensions is a sourced absence rather than an unresolved question.

The relevant instrument is Loi n°2000/011 du 19 décembre 2000 relative au droit d'auteur et aux droits voisins, whose neighbouring-rights provisions protect only performers, producers of sound and video recordings, and audiovisual-communication enterprises, not print or online news publishers, so there is no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive article 15 creates.

The law permits, once a work has been published with the author's authorization, analyses, press reviews, and short quotations justified by the critical, pedagogical, scientific, or informational character of the work, provided they carry the mention "source" and the author's name where it appears in the source (article 29(1)(d)); it separately permits reproducing and making accessible to the public, for informational purposes and in short excerpts, literary or artistic works seen, heard, or recorded in the course of a current event, by photography, broadcast, or other means of public communication, on the occasion of a report on that event (article 30).

It further permits the press or a broadcaster to reproduce, in the original or in translation, political, social, economic, or religious current-affairs articles, political speeches, and speeches delivered in judicial proceedings, sermons, conferences, and addresses, unless the right of exploitation has been expressly reserved, always subject to clearly indicating the source and the author's name (article 31); this express-reservation proviso functions as an author-side opt-out for that specific exception, the closest Cameroonian law comes to a machine-readable reservation mechanism, though it long predates the concept of one and is not framed as machine-readable.

None of these exceptions is capped at a headline-length or short-extract threshold in the way some jurisdictions' quotation rights are, the article 31 exception is not confined to the press industry, and no reported Cameroonian decision applies any of these provisions to a systematic news aggregator as opposed to a traditional newspaper or broadcaster.

The law predates the concept of a machine-readable text-and-data-mining reservation, so no opt-out mechanism of that kind exists, and no statute or case law addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer.