Are cookies personal data under the Saudi PDPL?

When they can identify a visitor, yes. Saudi Arabia has no law written for cookies, so the PDPL governs them: a cookie or tracker that identifies a visitor, directly or indirectly, collects personal data. The website then needs a legal basis before the tag runs, and for analytics and advertising tags that is normally explicit, informed consent.

The PDPL reaches past the border. It covers processing of personal data of people residing in the Kingdom by a party outside it, so a brand based abroad that tracks visitors in Saudi Arabia is inside it.

When an analytics or advertising platform processes visitor data outside Saudi Arabia, that counts as a transfer, which Article 29 and the Transfer Regulation govern. Keep each transfer to the minimum data needed.