Does the Saudi PDPL require cookie consent?

Not by name: Saudi Arabia has no law written specifically for cookies. But when a cookie or tracker can identify a visitor, what it collects is personal data under the PDPL, and analytics and advertising tags normally need the visitor's explicit, informed consent before they run. Cookies a site needs simply to work are a different case.

So a website that runs Google Analytics, Google Ads or Meta tags needs a banner that asks before those tags run, and a record of each answer. The Implementing Regulation (Article 11) expects consent for each purpose, explained before or when you ask, kept on record so you can show when and how it was given. Consent can be withdrawn at any time.

This is enforced. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement, and the categories it named include processing without a valid legal basis and marketing sent without consent.