Does DIFC data protection law require cookie consent?

It sets explicit rules for it. Regulation 9 of the DIFC Data Protection Regulations treats cookies used for personalisation, analytics or advertising as behavioural advertising: visitors get notice and a chance to refuse on first collection, defaults collect the minimum, buttons are colour-neutral, and pre-ticked boxes, silence or inactivity are not consent.

Where you rely on consent, it must come from a clear affirmative act, such as ticking an unticked box, and you must be able to demonstrate it.

The Commissioner has applied this to a real banner. Decision Notice 1/2024, issued to Careem Group under Regulation 9, criticised its cookies banner for lacking colour-neutral buttons. In our reading, a bright Accept button beside a faint Reject link is the pattern Regulation 9.2.3(a) rules out.