How to Install a PDPL-Compliant Consent Banner on WordPress (Saudi 2026 Step-by-Step)

WordPress powers a meaningful share of Saudi business sites — content sites, brochure sites, agency portfolios, and WooCommerce stores. After SDAIA's 48 enforcement decisions in 2025 (with retail explicitly named and "marketing pixels firing before consent" cited as the most common violation), every WordPress site serving Saudi visitors needs a PDPL-compliant consent banner — not a Shopify-only problem. The good news: WordPress is the most permissive platform of all. Plugin install takes under five minutes, configuration is point-and-click, and the official WordPress.org plugin ecosystem means no theme code touching, no developer required. This guide walks the exact installation steps using Arqam360 as the reference (Google-certified CMP, MENA-native, free for the banner forever, listed on wordpress.org as arqam360-consent-privacy-pdplgdpr). Works with any WordPress site, with or without WooCommerce.

What Saudi PDPL Requires on a Cookie Banner

Saudi PDPL Article 6 requires explicit, informed, prior consent before processing personal data for non-essential purposes. In practical terms for a WordPress site: trackers cannot fire and cookies cannot be written until the visitor has actively granted permission. Opt-out consent (the kind some U.S. frameworks use) is not lawful under PDPL — the visitor must take an affirmative action, clicking "Accept" on a banner, before Google Analytics, Meta Pixel, or any other non-essential cookie/tag activates. The PDPL Implementing Regulations layer additional requirements: consent must be recorded with timestamp and scope, withdrawal must be as easy as granting, and the banner copy must clearly name the categories of data collected and the purposes. SDAIA enforcement decisions in 2025 included multiple cases against sites whose banners technically existed but failed these specific criteria.

• Banner appears on first page load, before any non-essential tracker fires
• Visitor must take an affirmative action (Accept / Reject / Customize) — implicit consent is not lawful under PDPL
• Visitor can withdraw consent as easily as granted — one-click via a settings link on every page
• Banner copy clearly names the categories of data collected (Analytics / Marketing / Preferences) and the purposes
• If the visitor rejects or closes the banner, no non-essential trackers fire on subsequent page loads
• Consent record stored with timestamp, scope, and visitor identifier for audit
• Banner available in Arabic with RTL layout for Saudi-resident visitors

Step-by-Step: Install a PDPL Banner on Your WordPress Site

This walkthrough assumes you run a Saudi WordPress site (with or without WooCommerce) and want a PDPL-compliant banner live in the next 5 minutes. We use the Arqam360 WordPress plugin as the reference because it's listed on wordpress.org (official plugin ecosystem — no zip uploads, no security concerns), implements Consent Mode v2 in full, and is free for the banner forever. The pattern applies to any Saudi-aware WordPress consent plugin.

Step 1: Install the Arqam360 Plugin from wordpress.org

In your WordPress admin, navigate to Plugins → Add New. Search for "Arqam360" or use the slug arqam360-consent-privacy-pdplgdpr directly. The plugin will show up authored by arqam360, version 2.0.5 or later. Click "Install Now" — WordPress downloads it from the official wordpress.org repository (no sideloading, no security risk). After install completes, click "Activate."

Step 2: Get Your API Key from arqam360.com

Unlike Shopify's auto-provisioning flow, the WordPress plugin requires you to create an Arqam360 account manually first. Visit arqam360.com → Sign up (no credit card; free tier covers the banner forever). Once your account is created, navigate to the dashboard → API Keys → copy your key. Back in WordPress admin, navigate to Arqam360 → Settings (top-level menu added by the plugin) → paste your API key → Save.

Step 3: Configure the Banner

Once the API key is connected, the plugin's Settings page becomes interactive. Choose: language (Arabic-RTL recommended for Saudi merchants — the plugin auto-detects WordPress's site language but you can override), position (bottom-bar or bottom-right corner — bottom-bar for content sites, bottom-right for WooCommerce so it doesn't block the cart button), color scheme (defaults inherit your theme accent color via CSS variables). Save settings — the banner is now live on your storefront.

Step 4: Verify on the Front End

Open your site in an incognito browser window so no consent cookie interferes. The banner should appear within 1-2 seconds of page load. Click around your site — banner stays. Hard-refresh — banner re-appears (no consent stored yet because we're in incognito). The banner styling should match your theme; if not, return to Step 3. If no banner appears at all, two common causes: (a) a caching plugin is serving the old non-banner page (purge cache, then refresh); (b) the API key wasn't saved (return to Settings, re-paste, re-save).

Step 5: Verify Google Consent Mode v2 (Critical)

Most installations skip this step — and it's the step SDAIA enforcement decisions focus on. Install the Google Tag Assistant Companion (free Chrome extension). With the extension active, refresh your site in incognito. The extension should show gtag('consent', 'default') firing FIRST with all four parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) set to 'denied'. Click "Accept" on the banner. You should now see gtag('consent', 'update') fire with the parameters set to 'granted'. If the default doesn't fire before any GA4 or Google Ads tag, your install is broken — typically a plugin load-order issue (see Gotcha 3 below).

Five WordPress-Specific Gotchas

WordPress is more permissive than Shopify but also more error-prone because every WordPress site is a unique combination of theme + plugins + page builders + caching layers. Each gotcha below is solvable, but we see roughly half of Saudi WordPress sites hit at least one. Run through this list before declaring victory.

Gotcha 1 — Caching plugins serve stale pages. WordPress caching plugins (WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed Cache, Cloudflare via APO) cache the HTML output of your site. If you install Arqam360 and the banner doesn't appear, the cache is probably serving the pre-banner HTML to visitors. Fix: purge the entire cache from the caching plugin's settings, then hard-refresh on your test browser. If you have Cloudflare in front, also purge the Cloudflare cache for your domain. The banner appears for new sessions only after the cache is fully cleared.

Gotcha 2 — Page builder plugins (Elementor, Divi, Beaver Builder) sometimes load their own analytics. Elementor's "Site Settings → General → Theme Style" section, for example, can inject Google Analytics outside the standard wp_head action. If your site uses Elementor, check Elementor → Settings → Integrations and make sure GA isn't double-injected (once via Elementor and once via Arqam360's wrapper). Same with Divi's theme options. The fix: keep Google Analytics in ONE place (either Elementor/Divi OR a dedicated plugin like Site Kit), then wire Consent Mode v2 to whichever location.

Gotcha 3 — Plugin load order matters for gtag default-denied. WordPress plugins load in alphabetical order by default, but the Arqam360 plugin needs to fire its gtag default-denied call BEFORE any tracking plugin loads its tags. The plugin handles this via a high-priority action on wp_head (priority 1), but conflicting plugins that hook at priority 0 or earlier could win the race. If Tag Assistant shows GA4 firing before the consent default (Step 5 above), the fix is in Settings → Arqam360 → Advanced → "Force early load (priority 0)" toggle. Enable it.

Gotcha 4 — WooCommerce checkout pages use a separate template. WooCommerce's checkout flow runs on a dedicated template that some lightweight themes hijack (e.g., some checkout-optimization plugins replace the template entirely). The Arqam360 banner appears on the storefront and product pages by default, but verify the banner also appears on /checkout/ and /cart/ pages. If it disappears on those pages, the optimization plugin is removing the wp_head hook our plugin uses — contact the plugin author or override the template.

Gotcha 5 — WordPress multisite networks need per-site activation. If you run a multisite network with multiple Saudi sites under one WordPress installation, the Arqam360 plugin must be network-activated AND configured per site (each site has its own API key, banner config, and consent records). The Network Admin → Plugins → Network Activate step is necessary but not sufficient — visit each site's individual admin and configure its API key separately.

PDPL Compliance Checklist for Your WordPress Site

Beyond the banner installation, full PDPL compliance requires several more pieces. This checklist covers the essentials for a WordPress site (with or without WooCommerce). Tick each box; gaps are audit exposure.

• PDPL-compliant consent banner installed and verified across Steps 1-5 above
• Privacy policy published that explicitly names PDPL and SDAIA — not a generic GDPR template translated
• Data Subject Access Request (DSAR) channel published with a 30-day response commitment per PDPL Implementing Regulations
• Data Protection Officer (DPO) appointed if you process sensitive data at scale or systematically monitor visitor behavior
• Registered on SDAIA's National Data Governance Platform (NDGP) if you're a public entity, process sensitive personal data, or your primary business is data processing
• Cross-border data transfer documented if any vendor (your hosting provider, Meta, Google, Cloudflare) processes Saudi-resident data outside Saudi Arabia
• Consent records stored with timestamp + scope + visitor identifier for audit (Arqam360 stores 90-day rolling logs)
• Visible link to a withdraw-consent UI on every page (most themes support this via the footer widget area)

Frequently Asked Questions

Authoritative Sources

Next Steps

Once your WordPress site has a verified PDPL banner running, two follow-up actions multiply the value. First: run the free Arqam360 scanner against your site to confirm no trackers fire pre-consent and to surface any cookies the 113-pattern classifier might have missed (rare but possible with heavily-customized WordPress installations). Second: read the Cluster A cornerstone "Saudi PDPL: The Complete Merchant Guide 2026" — the banner is one piece of a larger compliance picture that includes privacy policy specifics, DSAR workflow design, DPO appointment criteria, and NDGP registration steps. WordPress's openness is its strength and its risk: you can do compliance well or you can do it badly; the discipline matters more than the platform.