Cookie consent · Kuwait

Cookie consent for websites in Kuwait

Yes, in practice. Kuwait has no single data protection law and none of its texts names cookies, but the Electronic Transactions Law (Law No. 20 of 2014) prohibits collecting or processing information about a person without their consent. Cookies that identify a visitor, such as analytics and advertising cookies, therefore wait for the visitor's answer.

Ask for your site review on WhatsApp Or by email Scan my site now

Already decided? Pay and start

What your cookie banner has to do

Five points from Kuwait's rules.

Ask before analytics and ad cookies run
Nothing that identifies a visitor loads until they answer. A banner that appears while the tools already run does not count.
Law No. 20 of 2014
Disclose each purpose in full
CITRA's 2024 regulation asks for consent given with full disclosure of the conditions attached, not a bare notice that data is collected.
Regulation No. 26 of 2024
A way to change or delete
Tell visitors how to ask for their data to be modified or deleted, and keep the banner settings reachable after the first answer.
Law No. 20 of 2014
Accurate and protected data
Personal data must be verified, kept current and protected by real security controls.
Law No. 20 of 2014
A record of each choice
With no regulator to mediate, a dated record of what each visitor accepted or refused is the evidence you have.
Law No. 20 of 2014

Where the law stands

Kuwait has no national data protection authority. CITRA enforces its Data Protection Regulation No. 26 of 2024 against licensed service providers, who must report a breach within 24 hours. For every other business, enforcement runs through prosecutors: unlawful collection carries up to three years' imprisonment and a fine of not less than KWD 5,000 under the Electronic Transactions Law.

Kuwait data protection guide

How Arqam360 does it

Arabic and English

A banner written in Arabic, not machine-translated, laid out right to left, with English beside it.

Tools wait for the answer

Google Consent Mode v2 signals stay denied until the visitor chooses, so Google and Meta tools hold back.

Every choice recorded

Each answer is kept with its date and time, so you can show who agreed and when.

Installs where you build

An app on Shopify and WordPress, or one line of code on any site. Or we install it for you.

Prices

Policy Pack	$149	Your privacy and cookie policies, written from a scan of your website
1-year pack	$1,499	We install the banner, test your Google and Meta tags and keep it running, for 1 website
3-year pack	$2,799	The same for 3 years, at a price fixed for 3 years

See what your site loads before consent

A free scan lists the cookies and tools your site sets, and which of them run before a visitor chooses.

Scan my site now

Questions

Do I need a cookie banner for a Kuwaiti website?

If your site sets cookies that identify visitors, such as analytics and advertising cookies, you need their consent before those cookies load. None of Kuwait's texts names cookies, but collecting information about a person without their consent is prohibited.

What are the penalties?

Up to three years' imprisonment and a fine of not less than KWD 5,000 under the Electronic Transactions Law, and up to ten years and KWD 5,000 to KWD 20,000 under the Cybercrime Law for unauthorised access to data.

Does the CITRA regulation apply to my online store?

That is contested. It is addressed to CITRA-licensed service providers, but its own definition reaches anyone running a website that collects personal data. The Electronic Transactions Law's consent rule applies either way.

Who enforces it?

CITRA, for the licensed service providers its regulation covers. For everyone else, prosecutors and the criminal courts.

How fast must a breach be reported?

Within 24 hours to CITRA, for licensed service providers.