The 2014 data law and the amended electronic communications law
The personal data law adopted on 26 June 2014 (the Ministry of Justice copy leaves its number blank, Loi n°14-…/AU) sets up a Commission nationale de l’informatique et des libertés in Article 19. Article 64(e) makes it an offence to collect personal data by fraudulent, unfair or unlawful means, and Article 65 sets five to ten years in prison, a fine of 10,000,000 to 35,000,000 francs, or either one.
Law 14-031/AU of 17 March 2014 on electronic communications, as amended by Law 23-024/AU (adopted 26 December 2023, promulgated 26 January 2024), is in French, and so is licence decree 15-093/PR. Both copies are scans: we read them by machine OCR, and checked key pages of the law by eye, the Article 4 definitions among them. A word search finds no VPN or proxy in either, though OCR can miss a word. Article 23 requires an ANRTIC authorisation from operators that run a network and sell internet access to the public. Article 85 punishes fraudulent use of a public network with six months to two years in prison and a fine of 1,400,000 to 6,850,000 francs.
Article 64 of the data law also points to computer offences in the penal code. A word search of the 1995 code on WIPO Lex finds none. We could not open a later code and did not find a separate cybercrime law, so either may exist. The Comorian texts we read set no registration, licence or ban for people who use a proxy or VPN.
Not legal advice. Rulings on scraping elsewhere, 2022 to 2026, are in our court-case guide.