Cookie consent · Saudi Arabia

Cookie consent for websites in Saudi Arabia

Yes, in practice. Saudi Arabia has no cookie-specific law, but the PDPL treats what a cookie collects as personal data when it can identify a visitor. So analytics and advertising cookies need the visitor's consent before they run: asked for each purpose, recorded, and easy to withdraw. Cookies a site needs to work are a different case.

Scan your website free See plans

How Saudi online stores handle it today

60%

935 of 1,556 Saudi online stores run trackers with no consent banner at all.

68%

load tracking before the visitor can choose.

48%

751 run Google Analytics or Tag Manager without a Consent Mode v2 signal.

Arqam360 KSA E-Commerce Privacy Compliance Index, September 2026. Open data, CC BY 4.0. See the full index · DOI

What your cookie banner has to do

Six points, each from the law, its Implementing Regulation or Google.

Ask before analytics and ad cookies run
Nothing that identifies the visitor loads until they answer. Cookies the site needs to work can load.
PDPL; Implementing Regulation, Art. 11
One choice for each purpose
Analytics, advertising and personalisation each get their own consent, not one blanket yes.
Implementing Regulation, Art. 11
Explain each purpose before you ask
Say what each category does, in clear words, and publish a privacy policy in Arabic.
Implementing Regulation, Art. 11
Let visitors change their mind
Consent can be withdrawn at any time, so the settings stay reachable after the first answer.
Implementing Regulation, Art. 11
Keep a record of every answer
When the visitor chose, what they were shown, and which categories they accepted or refused.
Implementing Regulation, Art. 11
Pass the choice to Google
Consent Mode v2 is how Google Analytics and Google Ads tags learn the answer before they store anything.
Google Consent Mode v2

Why it matters now

The full penalty framework has applied since 14 September 2024. Fines reach SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation, and SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.

Saudi PDPL guide

How Arqam360 does it

Arabic first

A banner written in Arabic, not machine-translated, laid out right to left, with English beside it.

Tags wait for the answer

Google Consent Mode v2 signals stay denied until the visitor chooses, so Google and Meta tags hold back.

Every choice recorded

Each answer is kept with its date and time, so you can show who agreed and when.

Installs where you sell

An app on Zid, Shopify and WordPress, with the Salla app in Salla's review, or one line of code on any site. Or we install it for you.

Prices

Free	0 SAR	1 domain, 10,000 pageviews a month
Pro	109 SAR a month	3 domains, 100,000 pageviews a month
Managed	369 SAR a month per domain	We install it, test your Google and Meta tags and keep it running; one-time setup of 1,099 SAR per domain

See what your site loads before consent

A free scan lists the cookies and trackers your site sets, and which of them run before a visitor chooses.

Scan your website free

Questions

Is a cookie banner mandatory in Saudi Arabia?

Not by name. No Saudi law is written for cookies, but the PDPL applies to the personal data cookies collect. Analytics and advertising tags normally need the visitor's explicit, informed consent first, and a banner that asks and records the answer is how a website gets it.

Do essential cookies need consent?

They are a different case. The consent question is about cookies and tags that identify visitors for analytics or advertising. Cookies a site needs simply to work, such as a basket or a login, can be listed in the cookie policy so visitors see what they do.

Can I use Google Analytics without consent?

Normally not. Google Analytics sets cookies that identify a visitor's browser, so what it collects is personal data under the PDPL. Ask first, and pass the answer to Google with Consent Mode v2.

What should the banner record?

For each visitor: when they chose, what they were shown, which categories they accepted or refused, and whether they later changed or withdrew that choice. The Implementing Regulation expects consent to be documented so it can be verified later.

What are the fines?

Administrative fines of up to SAR 5,000,000, doubling to SAR 10,000,000 for a repeat violation. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement.