White Friday and 11.11: the consent check for Gulf websites before peak ad spend (2026 data)

Sale season is when Gulf businesses spend the most on Google and Meta ads, and every paid click lands on a page that either asks the visitor first or tracks them straight away. In our September 2026 scan of 1,556 Saudi online stores, 1,065 (68%) loaded trackers before the visitor made any choice, and 935 (60%) showed no consent banner at all. In our October 2026 scan of 547 UAE business websites, 287 (52%) loaded trackers before a choice.

Both datasets are public under CC BY 4.0, so you can quote them with a link. This page sets out what the scans found, why it matters most in the week ad spend peaks, and a short check any marketing team can run before White Friday and Singles' Day (11.11).

Full Saudi data, method and charts: KSA E-Commerce Privacy Compliance Index.

And for the UAE: UAE Website Privacy Compliance Index.

What the scans found going into sale season

Most sites in both samples start tracking before they ask. In Saudi Arabia, most of those sites never ask at all.

Percentages are of all sites scanned in each country. The two samples differ: the Saudi index covers online stores, the UAE index covers business websites of every kind, most of them not shops. Read each figure on its own; don't rank the two countries.

Why it matters in the week ad spend peaks

• More visitors, more tracking without a choice: a site that tracks before asking does it on every visit, so the busiest week of the year is also the week it records the most visitors who were never asked.
• The Saudi law asks first: the Personal Data Protection Law has been fully enforceable since its grace period ended on 14 September 2024. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement, and marketing sent without consent is among the categories it named. Fines go up to SAR 5 million, or SAR 10 million for repeat violations.
• Google tags without the signal: 751 Saudi stores (48%) and 223 UAE business websites (41%) run Google Analytics or Tag Manager without a Consent Mode v2 signal. Since March 2024 Google has required that signal for visitors from the European Economic Area, so a Gulf business that advertises to European shoppers without it loses remarketing and personalised ads for that traffic.

A 10-minute check before the campaigns start

Run it on the landing pages your ads point to, not only the homepage.

• Open the page in a private window and don't touch the banner.
• Is there a banner at all, in Arabic and English, with a clear way to refuse?
• Open your browser's developer tools, go to the Network tab and reload: requests to Google Analytics, Google Ads or Meta should not appear before you answer the banner.
• Open Google Tag Assistant (tagassistant.google.com), connect the page and look at the Consent tab: all four Consent Mode signals should show a default state before any tag fires.
• Click Reject and check that the state changes to denied and the ad tags stay quiet.
• Make sure each visitor's choice is recorded, with the date, so you can show it if a customer or a regulator asks.
• Or run the page through our free scanner, which lists the trackers that load before consent and the Consent Mode status.

Scan your site for free.

Fix it before the traffic arrives

Put a consent banner in front of your Google and Meta tags, set Consent Mode to denied by default, and update it when the visitor answers. Store platforms and WordPress have apps and plugins that do both. On a custom site, the default has to sit in the page head, above Google Tag Manager. Then run the check above again on your top landing pages.

Step by step: Google Consent Mode v2 guide for MENA.

The Consent Mode figures in detail: Google Consent Mode v2 in Saudi Arabia and the UAE: the 2026 numbers.

Method and limits

Each site's homepage was loaded once in a real browser, without interacting with any banner, and the scanner recorded cookies, tracker requests and Consent Mode calls. The Saudi data was aggregated on 7 September 2026, the UAE data on 2 October 2026. Homepage only: trackers that load later, at checkout or after login, are not counted, so the real rates are likely higher. Client-side only: server-side tagging is invisible to the scan. These are measurements of what a website does, not legal findings about any company.

Sources