How to Install a PDPL-Compliant Consent Banner on Shopify (Saudi 2026 Step-by-Step)

SDAIA issued 48 enforcement decisions against PDPL violators during 2025 — and SDAIA explicitly named retail among the most-affected sectors, with "marketing pixels firing before consent" cited as the single most common violation category. If you sell on Shopify in Saudi Arabia, you are a retail merchant running Google Ads + Meta + analytics tags that typically fire on first page load. Statistically, your store is exposed. The good news: Shopify is one of the easier platforms to fix. Customer Privacy API is mature, App Store integrations handle most of the work, and the fix takes under five minutes per store. This guide walks the exact installation steps for a PDPL-compliant consent banner on Shopify, using Arqam360 as the reference (Google-certified CMP, MENA-native, free for the banner forever). The same pattern applies to any Saudi-aware CMP — only the App Store entry changes.

What Saudi PDPL Requires on a Cookie Banner

Saudi PDPL Article 6 requires explicit, informed, prior consent before processing personal data for non-essential purposes. In practical e-commerce terms: trackers cannot fire and cookies cannot be written until the visitor has actively granted permission. Opt-out consent (the kind some U.S. privacy frameworks use) is not lawful under PDPL. The visitor must take an affirmative action — clicking "Accept" on a banner — before Google Analytics, Meta Pixel, TikTok pixel, or any other non-essential cookie/tag activates. The PDPL Implementing Regulations layer on additional requirements: the consent must be recorded with timestamp and scope; the visitor must be able to withdraw consent as easily as they granted it; and the banner copy must clearly explain the categories of data being collected and the purposes. SDAIA's 48 enforcement decisions in 2025 included multiple cases against companies whose banners technically existed but did not meet these specific criteria.

• Banner appears on first page load, before any non-essential tracker fires
• Visitor must take an affirmative action (Accept / Reject / Customize) — implicit consent is not lawful under PDPL
• Visitor can withdraw consent as easily as they granted it — one-click, no friction
• Banner copy clearly names the categories of data collected (Analytics / Marketing / Preferences) and the purposes
• If the visitor rejects or closes the banner, no non-essential trackers fire on subsequent page loads
• Consent record stored with timestamp, scope, and visitor identifier for audit purposes
• Banner available in Arabic with RTL layout for Saudi-resident visitors

Step-by-Step: Install a PDPL Banner on Your Shopify Store

This walkthrough assumes you have a Saudi Shopify store and want a PDPL-compliant banner live within the next 5 minutes. We use the Arqam360 Shopify app as the reference because it implements Google Consent Mode v2 in full, is MENA-native (Arabic-RTL by default, MENA-specific cookie patterns), free for the banner forever, and installs with one click from the Shopify App Store. The same five-step pattern applies to other Saudi-aware CMPs.

Step 1: Find Arqam360 in the Shopify App Store

Open your Shopify admin → Apps → Shopify App Store. Search "Arqam360" or visit apps.shopify.com/arqam360 directly. The listing shows the free tier (banner forever, no card required) and paid plans (Starter, Pro, Managed). For a single Saudi store with up to 10,000 monthly pageviews, the Free plan is sufficient for PDPL compliance. Click "Add app".

Step 2: Install + Grant Scopes

Shopify will display the scopes the app requests: read_themes (to detect your theme for styling), write_script_tags (for banner injection on the storefront), read_customers (for DSAR fulfillment if you upgrade to a paid plan). Approve. The app provisions your Arqam360 account automatically using your Shopify store email — no separate signup needed. You'll be redirected to the Arqam360 dashboard inside Shopify admin.

Step 3: Configure the Banner

On the first dashboard view, choose: language (Arabic-RTL by default for Saudi merchants; English available; auto-detect on by default), position (bottom-right recommended for mobile thumb access; bottom-bar option also works), color scheme (defaults inherit your Shopify theme accent color; can be customized). Click "Activate" to publish the banner to your storefront.

Step 4: Verify on the Storefront

Open your storefront in an incognito browser window (so no existing consent cookie interferes). The banner should appear within 1-2 seconds of page load. Click around your store — the banner stays. Hard-refresh (Cmd+Shift+R) — the banner re-appears (no consent stored yet because we're in incognito). The banner styling should match your Shopify theme; if it doesn't, return to Step 3 and adjust. If no banner appears at all, your theme might be caching aggressively — wait 5 minutes for Shopify's theme cache to expire, then refresh again.

Step 5: Verify Google Consent Mode v2 (Critical)

This is the step most installations skip — and it's the step SDAIA enforcement decisions focus on. Install the Google Tag Assistant Companion (free Chrome extension). With the extension active, refresh your storefront in incognito. The extension should show gtag('consent', 'default') firing FIRST with all four parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) set to 'denied'. Click "Accept" on the banner. You should now see gtag('consent', 'update') fire with the matching parameters set to 'granted'. If the consent default doesn't fire before any GA4 or Google Ads tag, your install is broken — typically a theme load-order issue. Arqam360's standard install handles this automatically; manual fixes for custom themes are documented in the Arqam360 help docs.

Five Shopify-Specific Gotchas (Catches Most Saudi Merchants)

Each of the gotchas below is solvable but easy to miss. We see roughly half of Saudi Shopify merchants we scan hit at least one of these. If you've completed Steps 1-5 and the banner appears to work, run through this checklist before declaring victory.

Gotcha 1 — Customer Privacy API vs gtag, both required. Shopify exposes the Customer Privacy API for storefront-side consent (Shopify's own integrated analytics reads from this). Arqam360 and any correctly-built CMP call BOTH the Customer Privacy API AND gtag('consent', 'update', ...) on visitor accept. If your CMP only calls one or the other, you have a silent gap — either Shopify's analytics ignores consent, or Google's tags do.

Gotcha 2 — Shopify's automatic GA4 integration fires independently. If you have GA4 connected via Shopify's Google Channel integration (not via your own GTM container), the GA4 events sometimes fire before the consent default propagates. Two ways to handle: (a) disable Shopify's native GA4 integration and re-wire GA4 via your own GTM container where consent control is explicit and verifiable; or (b) ensure your CMP fires the consent default in the document head BEFORE Shopify's auto-injected GA4 script. Arqam360 does (b) by default but the order can break if a custom theme injects scripts in non-standard ways.

Gotcha 3 — Checkout pages run on a separate Shopify-managed subdomain. Your storefront might be yourbrand.com but checkout typically runs on checkout.shopify.com or a Shopify-Plus-managed subdomain. Trackers that fire on checkout pages (Shopify's native checkout pixel, Meta's CAPI extension, Google Ads conversion tracking) need to receive the consent state too. Saudi merchants on Shopify Plus get more flexibility here; standard Shopify plans rely on the Customer Privacy API propagating to checkout, which Arqam360 handles automatically. Verify: open DevTools on the cart page, click "Continue to Checkout", and watch the Network tab on the resulting checkout page — no tracker requests should fire if consent was denied.

Gotcha 4 — Theme caching can delay banner visibility. Shopify's theme cache is aggressive (especially on the Online Store 2.0 themes). If you change banner configuration in the Arqam360 dashboard and the change doesn't appear on the storefront, hard-refresh (Cmd+Shift+R), wait 5-10 minutes for cache to expire, or use the Shopify theme editor's "View live" link which bypasses some caching layers. Most merchants don't realize this and assume the configuration didn't save.

Gotcha 5 — Multi-language stores need explicit verification. If your Shopify store has both Arabic and English versions (often using Shopify's native Markets feature), ensure the banner detects the visitor's language correctly. Arqam360 auto-detects via the Shopify locale, but custom theme work or Markets routing can interfere. Test both: visit /ar/ and confirm Arabic banner; visit /en/ and confirm English banner. If one shows the wrong language, the theme is overriding the locale signal — fix the theme, not the CMP.

PDPL Compliance Checklist for Your Shopify Store

Beyond the banner installation, full PDPL compliance for a Saudi Shopify store requires several more pieces. This checklist covers the essentials — tick each box; gaps are audit exposure. Compliance is the union of all these items, not just the banner.

• PDPL-compliant consent banner installed and verified across Steps 1-5 above
• Privacy policy published that explicitly names PDPL and SDAIA — not a generic GDPR template translated to Arabic
• Data Subject Access Request (DSAR) channel published with a 30-day response commitment per PDPL Implementing Regulations
• Data Protection Officer (DPO) appointed if your store processes sensitive data at scale or systematically monitors visitor behavior
• Registered on SDAIA's National Data Governance Platform (NDGP) if you are a public entity, process sensitive personal data, or your primary business is data processing
• Cross-border data transfer documented if any vendor (Shopify itself, Meta, Google) processes Saudi-resident data outside Saudi Arabia
• Consent records stored with timestamp + scope + visitor identifier for audit purposes (Arqam360 stores 90-day rolling logs automatically)
• Visible link to a withdraw-consent UI on every page (cookie settings link in footer at minimum)

Frequently Asked Questions

Authoritative Sources

Next Steps

Once your Shopify store has a verified PDPL banner running, two follow-up actions compound the value. First: run the free Arqam360 scanner against your storefront to confirm no trackers fire pre-consent and to discover any cookies the 113-pattern classifier might have missed for your specific theme. Second: read the Cluster A cornerstone "Saudi PDPL: The Complete Merchant Guide 2026" to understand the broader compliance picture beyond the banner — privacy policy specifics, DSAR workflow design, DPO appointment criteria, and NDGP registration steps. The banner is the technical foundation; everything else is operational discipline. Saudi merchants who treat compliance as a discipline rather than a checkbox routinely score 80+ on our compliance index; the 81% who treat it as a one-time task score below 50.