Cookie consent · Oman

Cookie consent for websites in Oman

In our reading, yes. No Omani text mentions cookies, but the Personal Data Protection Law (Royal Decree No. 6/2022) lists electronic identifiers as personal data and, since its September 2026 amendment, requires explicit consent the controller can prove. Analytics and advertising cookies fit none of the exceptions, so they need the visitor's opt-in before they run.

Ask for your site review on WhatsApp Or by email Scan my site now

Already decided? Pay and start

What your cookie banner has to do

Five points from Oman's PDPL and its Executive Regulation.

Explicit opt-in before analytics and ad cookies
Nothing that relies on an identifier runs until the visitor accepts. A banner shown while the tags already run does not count.
Article 10, as amended
A clear request that names you
The consent request names the controller, the contact of the data protection officer and the purposes, in clear and understandable words.
Article 10
Consent you can prove
The controller carries the burden of proof, so each choice is recorded with its date. A recorded click is a permitted form of consent.
Executive Regulation, Article 4
Consent for transfers abroad
Analytics and advertising platforms outside Oman receive the data, which is a transfer that needs explicit consent and a risk assessment.
Executive Regulation, Articles 37 to 39
A published privacy policy and officer
Publish a privacy policy in a visible place before processing, and the name and contact of your data protection officer.
Executive Regulation, Articles 21 and 36

Where the law stands

The law has applied since February 2023 and its grace period ended on 5 February 2026. Since 7 September 2026 it also reaches websites run from outside Oman that collect data from people in Oman. The Ministry of Transport, Communications and Information Technology enforces it, and court fines run from OMR 500 to 2,000 for consent breaches up to OMR 100,000 to 500,000 for unlawful transfers abroad.

Oman PDPL guide

How Arqam360 does it

Arabic and English

A banner written in Arabic, not machine-translated, laid out right to left, with English beside it.

Tools wait for the answer

Google Consent Mode v2 signals stay denied until the visitor chooses, so Google and Meta tools hold back.

Every choice recorded

Each answer is kept with its date and time, so you can show who agreed and when.

Installs where you build

An app on Shopify and WordPress, or one line of code on any site. Or we install it for you.

Prices

Policy Pack	$149	Your privacy and cookie policies, written from a scan of your website
1-year pack	$1,499	We install the banner, test your Google and Meta tags and keep it running, for 1 website
3-year pack	$2,799	The same for 3 years, at a price fixed for 3 years

See what your site loads before consent

A free scan lists the cookies and tools your site sets, and which of them run before a visitor chooses.

Scan my site now

Questions

Do I need a cookie banner for a website with visitors in Oman?

In our reading, yes, for analytics and advertising cookies: they rely on electronic identifiers, which the law lists as personal data, and processing needs explicit consent. The Ministry has issued no guidance on cookies.

What are the fines?

Court fines from OMR 500 to 2,000 for consent breaches, OMR 15,000 to 20,000 for failing to notify a breach and OMR 100,000 to 500,000 for unlawful transfers abroad. The Ministry can add up to OMR 2,000 per violation.

Does the law apply if my company is not in Oman?

Yes, since 7 September 2026: it covers the personal data of people in Oman wherever the processing happens.

Who enforces it?

The Ministry of Transport, Communications and Information Technology. Oman has no separate data protection authority.

How fast must a breach be reported?

Within 72 hours to the Ministry where it risks people's rights, and to those people within 72 hours where the harm may be serious.