Is Shopify's built-in cookie banner enough for the Saudi PDPL?
It depends on what your store runs. The PDPL asks for consent before analytics and advertising tags run, a choice for each purpose, and a record of each answer. Shopify's banner governs Shopify's own tools, including its cookies and Shopify Pixels; for pixels added manually or through apps, Shopify says you may need a third-party cookie banner or custom logic.
Shopify's automated settings set the banner up for visitors in the UK and the EEA (Shopify Help Center, Configuring customer privacy settings). A Saudi store that runs GA4, Google Ads or the Meta Pixel through apps or theme code should check what its visitors actually see, and which tags load before they answer.
The PDPL applies even when the store is run from outside the Kingdom: it covers processing of personal data of people residing in Saudi Arabia by a party outside it. Check the storefront, not the settings: open it in a private window, confirm a banner appears before you choose, and run a free scan.
Read the full Saudi PDPL guideHow Arqam360 handles this
Arqam360's Shopify app delivers its banner through a theme app embed, which Shopify leaves off until you switch it on under App embeds; until then, if Shopify's own banner is enabled, that is the one visitors see. The banner is Arabic on Arabic storefronts, passes each choice to Google Consent Mode v2, keeps a dated record, and bills through Shopify.
See how it worksSources
- 1.Personal Data Protection Law — official English text (SDAIA)
- 2.Implementing Regulation of the Personal Data Protection Law (SDAIA)
Last reviewed . Not legal advice.