Do Saudi websites need the IAB TCF?
No Saudi law requires it. The IAB Transparency and Consent Framework is an advertising-industry standard run by IAB Europe and built around the GDPR. A Saudi website needs it in practice only if it serves personalised ads through Google AdSense, Ad Manager or AdMob to users in the EEA, the UK or Switzerland.
For those users, Google requires a CMP that integrates with the TCF and has passed its certification. What the PDPL asks for Saudi visitors is different: consent before analytics and advertising tags run, a separate choice for each purpose, a record of each answer, and a way to withdraw that is as easy as giving consent (Implementing Regulation, Articles 11 and 12).
A TCF signal does not replace any of those. The current version is TCF v2.3, according to IAB Europe. Advertisers that run Google Ads and GA4 pass the visitor’s choice to Google tags through Consent Mode v2, which is a separate mechanism from the TCF.
Read the full Saudi PDPL guideSources
- 1.Personal Data Protection Law — official English text (SDAIA)
- 2.Implementing Regulation of the Personal Data Protection Law (SDAIA)
- 3.IAB Europe — Transparency & Consent Framework (TCF) v2.3
- 4.Google AdSense Help — Google consent management requirements for serving ads in the EEA, the UK, and Switzerland (for publishers)
Last reviewed . Not legal advice.