Does server-side tracking need consent under the PDPL?
Yes. Moving tracking from the browser to your server, through tools such as server-side Google Tag Manager or the Meta Conversions API, does not change the legal basis. The PDPL requires consent for processing personal data wherever it happens, and for analytics and advertising that is normally explicit, informed consent for each purpose.
What changes is where consent is enforced. The visitor's consent state has to travel from the browser to the server with every event, and the server uses it to decide which platforms receive what. Without that, the server sends data the visitor never agreed to, and the violation is harder to see because it happens outside the browser.
The other PDPL duties follow the data. An advertising platform processing visitor data outside Saudi Arabia counts as a transfer under Article 29 and the Transfer Regulation, and you stay responsible for what the vendors you send it to process for you.
Read the full Saudi PDPL guideHow Arqam360 handles this
Arqam360's server-side events enforce consent at the forwarding layer. When a visitor has granted marketing consent, the hashed email, phone and IP are included in the events; when consent has not been granted, nothing about that visitor is sent to Meta, TikTok, Snap or LinkedIn.
See how it worksSources
- 1.Personal Data Protection Law — official English text (SDAIA)
- 2.Implementing Regulation of the Personal Data Protection Law (SDAIA)
Last reviewed . Not legal advice.