Is implied cookie consent valid in Saudi Arabia?

Not for analytics and advertising tags. Under the PDPL, the legal basis for those tags is normally the visitor's explicit, informed consent, given separately for each purpose and documented so it can be verified later. A notice that treats continued browsing as agreement records no choice for any purpose, and leaves the website with nothing to show.

The Implementing Regulation (Article 11) expects each purpose to be explained before or when consent is asked, a separate consent for each one, and a record of when and by what means it was given. Consent can be withdrawn at any time, and it cannot be made a condition of a service unless the service depends on that processing.

Proof matters because of the timetable. Once SDAIA formally notifies an organisation of an alleged violation, it has five days to respond, which is too short to rebuild a consent history from scratch.