Cookie consent · United Arab Emirates

Cookie consent for websites in the UAE

Yes, for analytics and advertising cookies. The UAE PDPL (Federal Decree-Law No. 45 of 2021) has no cookie provision, but a cookie that can identify a visitor collects personal data, which needs consent unless one of the law's exceptions applies. So a UAE website asks before those cookies run, records each choice and lets visitors withdraw it.

Scan your website free See plans

How UAE business websites handle it today

51%

279 of the 547 UAE business websites we scanned track visitors with no consent banner.

52%

load tracking before the visitor can choose.

41%

run Google Analytics or Tag Manager without a Consent Mode v2 signal.

Arqam360 UAE Website Privacy Compliance Index, October 2026: 547 .ae business websites. Open data, CC BY 4.0. See the full index · DOI

What your cookie banner has to do

Six points, from the federal law, the DIFC regulations and Google.

Ask before analytics and ad cookies run
Nothing that identifies the visitor loads until they answer, unless one of the law’s exceptions applies.
Federal Decree-Law No. 45 of 2021
Clear, specific, informed consent
Explain each category in plain words, so the visitor knows what they agree to.
Federal Decree-Law No. 45 of 2021
A real way to refuse
The banner offers a real way to say no, alongside the way to say yes.
Federal Decree-Law No. 45 of 2021
Withdrawal at any time
The settings stay reachable after the first answer, so consent can be withdrawn.
Federal Decree-Law No. 45 of 2021
A record of each choice
Keep when the visitor chose and what they accepted or refused.
Federal Decree-Law No. 45 of 2021
In the DIFC: neutral buttons, nothing pre-ticked
Regulation 9 rules out pre-ticked boxes and treats silence or inactivity as no consent; the Commissioner has criticised a banner without colour-neutral buttons.
DIFC Data Protection Regulations, Reg. 9

Where the law stands

The UAE PDPL has been in force since 2 January 2022, with the UAE Data Office as the authority. It sets no fine amounts: Article 26 leaves penalties to a Cabinet decision, which had not been published as of September 2026. Companies in the DIFC or ADGM follow those free zones' own laws.

UAE PDPL guide

How Arqam360 does it

Arabic and English

A banner written in Arabic, not machine-translated, laid out right to left, with English beside it.

Tags wait for the answer

Google Consent Mode v2 signals stay denied until the visitor chooses, so Google and Meta tags hold back.

Every choice recorded

Each answer is kept with its date and time, so you can show who agreed and when.

Installs where you build

An app on Shopify and WordPress, or one line of code on any site. Or we install it for you.

Prices

Free	0 AED	1 domain, 10,000 pageviews a month
Pro	109 AED a month	3 domains, 100,000 pageviews a month
Managed	369 AED a month per domain	We install it, test your Google and Meta tags and keep it running; one-time setup of 1,099 AED per domain

See what your site loads before consent

A free scan lists the cookies and trackers your site sets, and which of them run before a visitor chooses.

Scan your website free

Questions

Is a cookie banner mandatory in the UAE?

The UAE PDPL has no provision written for cookies. But a cookie or tracker that can identify a visitor collects personal data, and processing personal data needs consent unless one of the law's exceptions applies. For analytics and advertising tags, a banner that asks first is the practical way to have that basis.

Does the UAE PDPL apply to a website run from abroad?

It applies to organisations in the UAE that process personal data, and to organisations outside the UAE that process the personal data of people inside it, for example through analytics on their site.

What about the DIFC and ADGM?

Companies established in the DIFC or ADGM follow those free zones' own data protection laws. In the DIFC, Regulation 9 spells out what a cookie banner must do: notice and a chance to refuse, minimal defaults, colour-neutral buttons, and no pre-ticked boxes.

What are the fines?

The federal law sets no fine amounts. Article 26 leaves violations and administrative penalties to a Cabinet decision, and none had been published as of September 2026.

What should the banner record?

For each visitor: when they chose, what they were shown, which categories they accepted or refused, and whether they later withdrew consent.