What a cookie policy must say under Saudi PDPL

A cookie policy tells visitors which cookies and similar tools your site sets: each cookie, who sets it, its purpose, how long it lasts, and how to withdraw consent. A Saudi site running analytics or advertising tags needs one in practice, because PDPL requires explicit, informed consent with each purpose explained. It complements your consent banner rather than replacing it.

A privacy policy covers all the personal data your business collects, from accounts and orders to messages, and the rights people have over it. A cookie policy details one part of that: what your website collects through cookies and similar tools. It is part of your privacy policy, not a replacement for it, and can sit on its own page linked from your banner and your privacy policy.

Five things: the cookie name, who sets it, its category (necessary, analytics, marketing or preferences), its purpose, and how long it lasts. Also name the third parties that receive the data and where it is processed, because an analytics or advertising platform processing your visitors' data outside Saudi Arabia counts as a transfer out of the Kingdom. Build the list from a real scan of your site, not from memory.

Whenever the cookies on your site change, for example when you add an app, a tracking tag or an ad platform, and put the date of the last update at the top. Good practice is to rescan your site after each such change and compare the result with your list. If you add a new purpose, ask for consent to it, since consent is given separately for each purpose.

PDPL requires consent to be informed, with each purpose explained before or when you ask, and that only works if visitors understand what they read. So publish the policy in the language your visitors read: Arabic for an Arabic-reading audience in Saudi Arabia, with English alongside if your site serves both.

No. The policy explains; the banner asks. The banner has to ask for consent before analytics and advertising tags run and record the answer, and publishing a page that says the site uses cookies is not enough. Link the policy from the banner itself so visitors can reach it before they choose.