Arqam360 data · updated 3 November 2026
Gulf Website Privacy Readiness Index 2026
60% of Saudi online stores (935 of 1,556, scanned in September 2026) show no consent banner while advertising or analytics tools load. Among UAE business websites it is 51% (279 of 547, October 2026).
Summary
- 60% of the Saudi online stores we scanned (935 of 1,556) show no consent banner while advertising or analytics tools load. Among UAE business websites the figure is 51% (279 of 547).
- Most sites load these tools before the visitor makes any choice: 68% of Saudi stores and 52% of UAE business websites.
- 48% of Saudi stores and 41% of UAE business websites run Google tags that send no Google Consent Mode v2 signal.
- 37% of Saudi stores and 47% of UAE business websites link no privacy policy from their homepage.
- The median readiness score is 45 out of a hundred in Saudi Arabia and 40 in the UAE.
Why this matters now
Saudi Arabia: the grace period of the Personal Data Protection Law (PDPL) ended on 14 September 2024. The Saudi Data and AI Authority (SDAIA) confirmed 48 enforcement decisions in its January 2026 announcement, and is taking public comments until 5 November 2026 on draft amendments to the law's Executive Regulations.
UAE: the federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) covers personal data processed in the UAE. The DIFC and ADGM free zones have their own data protection laws.
This page reports what websites do. It is not legal advice.
Saudi Arabia: 1,556 online stores
We scanned 1,556 Saudi online stores in September 2026. 60 blocked the scanner and carry no score; they stay in every denominator.
The most common tools are Google Analytics, on 59% of stores (920), and the Meta Pixel, on 29% (452).
By store platform (groups of 25 stores or more)
| Platform | Stores | No consent banner | Advertising or analytics tools load before any choice |
|---|---|---|---|
| Salla | 72 | 75% | 96% |
| Zid | 89 | 81% | 82% |
| Shopify | 114 | 66% | 84% |
| WordPress | 858 | 47% | 53% |
These figures describe how merchants have set up their stores, not the platforms themselves.
UAE: 547 business websites
We scanned 547 UAE business websites on .ae domains in October 2026. This is a sample of business websites, not of online stores. 117 blocked the scanner and carry no score; they stay in every denominator.
The most common tools are Google Tag Manager, on 47% of websites (259), and the Meta Pixel, on 18% (101).
Saudi Arabia and the UAE side by side
The two samples are different populations (Saudi online stores, UAE business websites), so read each column on its own rather than ranking the countries.
| Saudi online stores (1,556) | UAE business websites (547) | |
|---|---|---|
| No consent banner | 60% (935) | 51% (279) |
| Advertising or analytics tools load before any choice | 68% (1,065) | 52% (287) |
| Google tags with no Consent Mode v2 signal | 48% (751) | 41% (223) |
| No privacy policy link | 37% (580) | 47% (256) |
| Median readiness score | 45 | 40 |
What a business website should do first
- Open your homepage as a first-time visitor and check what loads before you click anything.
- Show a consent banner in Arabic and English, with Accept and Reject given equal weight.
- Hold advertising and analytics tools until the visitor chooses.
- Send Google Consent Mode v2 signals: denied by default, updated when the visitor chooses.
- Link your privacy policy and cookie policy from every page.
Method and limits
- A real browser loaded each homepage once, with no stored consent and no clicks, and recorded whether a consent banner appeared, which advertising and analytics tools loaded, whether they loaded before any choice, whether Google tags sent a Consent Mode v2 signal, and whether the homepage linked a privacy policy.
- Saudi Arabia: 1,556 online stores on .sa domains and Saudi store platforms, from Common Crawl and a curated list, aggregated on 7 September 2026. UAE: 547 business websites on .ae domains from Common Crawl, aggregated on 2 October 2026.
- Percentages use all sites scanned as the denominator, inconclusive sites included. "No consent banner" counts a site only if it also loads an advertising or analytics tool or a non-essential cookie. "No Consent Mode v2 signal" counts only sites that run Google tags.
- The UAE sample covers .ae domains from the start of the alphabet (domains beginning with a digit or the letter a). It is a slice, not a census.
- The scans ran from a single connection in France, not from inside the Gulf. A site that shows its banner only to Gulf visitors can be counted as having no banner, so the true rate may be somewhat lower.
- Homepage only and client-side only: no checkout, logged-in pages or server-side processing. A low score is a signal about consent on the homepage, not a legal finding. No site is named.
Questions
What is the Gulf Website Privacy Readiness Index?
A monthly scan by Arqam360 of how websites in Saudi Arabia and the UAE handle consent: whether they show a consent banner, what loads before the visitor chooses, and whether Google tags send Consent Mode v2 signals. The data is open under CC BY 4.0.
How many Saudi online stores show no consent banner?
60%: 935 of the 1,556 Saudi online stores scanned in September 2026 showed no consent banner while advertising or analytics tools loaded.
How many UAE websites show no consent banner?
51%: 279 of the 547 UAE business websites scanned in October 2026 showed no consent banner while advertising or analytics tools loaded.
How was the data collected?
A real browser loaded each homepage once as a first-time visitor, with no clicks, and recorded the consent banner, the tools that loaded and the Google Consent Mode v2 signal. Sites that blocked the scanner are counted as inconclusive.
Is a low score a legal finding?
No. The scan sees the homepage only, from outside the Gulf, and cannot see contracts, internal procedures or server-side processing. It is a signal about consent on the homepage.
Why are the Saudi and UAE samples different?
The Saudi sample is online stores; the UAE sample is business websites on .ae domains. Each figure is true of its own sample, so the two should not be ranked against each other.
Can I use these figures?
Yes. The data is licensed CC BY 4.0. Credit "Gulf Website Privacy Readiness Index, Arqam360" with a link to this page.
How often is the Index updated?
Monthly, on this same page. The date at the top shows the last update.
How can I check my own website?
Book a 20-minute site review with Taha, our privacy expert, or scan your site now on our website. The scan reports whether a consent banner appears and what loads before it.
Use and cite this data
Free to reuse under CC BY 4.0. Please credit "Gulf Website Privacy Readiness Index, Arqam360" and link to this page.
Arqam360. "Gulf Website Privacy Readiness Index 2026". Saudi Arabia, September 2026 edition; UAE, October 2026 edition. https://arqam360.com/gulf-privacy-readiness-index
Datasets
Embed the chart
Copy this code into your page. The chart is a static image and the credit links back here.