Do essential cookies need consent in Saudi Arabia?

Not necessarily. The PDPL has no cookie exemption, but consent is not its only legal basis. A cookie a visitor needs for what they asked for, such as a basket, a login or checkout, may rest on carrying out an agreement they are party to, and security or fraud cookies on legitimate interest.

Article 6 of the PDPL lists the cases where processing does not need consent, including implementing an agreement to which the data subject is a party, and the controller's legitimate interest, provided no sensitive data is processed. The Implementing Regulation (Article 16) names fraud detection and network and information security as legitimate interests, and requires a documented assessment before you rely on one.

Analytics and advertising cookies are not essential in this sense: they normally need the visitor's explicit, informed consent before they run. Essential cookies still belong in your cookie policy, so visitors can see what each one does, and they are still personal data when they can identify a visitor.