Tabby Cookies and PDPL Consent
What Tabby's buy-now-pay-later widget stores on your store, why it counts as marketing, and when you are allowed to let it run.
Cookies we detect
Category: Marketing- tabby_*
- _tabby_*
Detection patterns are taken from our own cookie classifier and are limited to those confirmed in real scans. Patterns we have inferred from vendor documentation but not yet observed are deliberately not listed.
What Tabby sets
Tabby's widget writes cookies on your own domain, not Tabby's, which is what makes them easy to miss: they look first-party in the browser's cookie list. They carry the shopper's session with Tabby and the state of the approval flow, which lets Tabby attribute an eventual order back to the product page where the instalment message was shown.
Why it is classified as marketing, not necessary
The distinction that matters is not who the cookie belongs to, it is whether the shopper's chosen action can complete without it. A visitor browsing your catalogue has not asked for a Tabby instalment plan, so the widget's attribution cookies are not required to deliver anything they requested — they exist so Tabby can measure the funnel. That makes them non-essential, and non-essential means consent first. Once a shopper actively chooses Tabby at checkout, the payment session itself is a different question: at that point the cookie is carrying out the transaction they asked for.
What PDPL requires
Saudi Arabia's PDPL is consent-first, and SDAIA has issued 48 enforcement decisions naming retail explicitly, with marketing pixels firing before consent as the most-cited violation category. A Tabby widget that loads its script on page view rather than on interaction puts you in exactly that category. The fix is not to remove Tabby — it is to hold the widget until the visitor has agreed to marketing, or to load the price-display element without its tracking payload.
How Arqam360 handles it
The scanner identifies these by pattern and files them under marketing rather than leaving them uncategorised, so your cookie declaration is accurate without you researching the vendor. With script blocking enabled, the widget is held until the visitor agrees. Both the English and Arabic declaration name Tabby, which matters because a Saudi shopper reading a declaration that lists only Google and Meta can see it is incomplete.
See which of these are on your store right now, and which are firing before anyone consents.
Scan your site freeOther MENA trackers
Marketing
Tamara
Marketing
ArabClicks
Marketing
Lana Ads
Marketing
Tap Network
Necessary
Mada
Necessary
Amwal
Necessary
SMSA Express
Last updated: