Cookie Consent in Saudi Arabia: PDPL and SDAIA Compliance Guide

How PDPL and SDAIA rules apply to cookies and consent banners in Saudi Arabia, plus GDPR/ePrivacy for EU visitors and a bilingual implementation checklist.

What does the Saudi PDPL require for cookies and tracking?

Saudi Arabia's Personal Data Protection Law (PDPL) and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA), treat persistent identifiers such as cookies, mobile ad IDs and tracking pixels as personal data whenever they can be linked to an identifiable individual. Any website that sets non-essential cookies for a Saudi audience needs a documented lawful basis, a clear notice and, in most cases, prior consent before those cookies run.

Lawful basis and consent under PDPL

Strictly necessary cookies (session, security, load-balancing) generally do not need consent because they are required to deliver the service the visitor requested. Analytics, advertising and social-media cookies almost always require the visitor's free, specific and informed consent, collected before the cookie fires, with an equally easy way to withdraw it.

• Consent must be an affirmative, unambiguous action — pre-ticked boxes or continued browsing are not valid consent
• The visitor must be able to reject non-essential categories as easily as accepting them
• Consent choices must be logged with a timestamp so they can be reproduced on request
• Withdrawal must be as simple as giving consent, e.g. a persistent 'privacy settings' link

Notice and transparency obligations

PDPL requires a clear, accessible privacy notice describing what data is collected, the purpose, retention period, and third parties involved, in language the data subject understands. For a Saudi audience this means the notice and consent banner should be available in Arabic, not only in English.

Cross-border data transfer considerations

PDPL restricts transferring personal data — including consent logs and analytics data tied to Saudi visitors — outside the Kingdom unless an adequate level of protection is demonstrated or another legal transfer mechanism applies. Businesses using overseas analytics, advertising or CMP vendors should review this together with local counsel before relying on it, since requirements and guidance from SDAIA continue to evolve.

Bilingual Arabic and English banner requirements

Because MSA (Modern Standard Arabic) is the primary language for consumers in the Kingdom, a consent banner shown only in English does not meet the PDPL's transparency expectations for a Saudi audience. An effective banner presents the notice and choices in Arabic by default for Saudi visitors, with English available as a secondary option, and correctly renders right-to-left (RTL) layout.

How automated cookie scanning and categorisation works

A compliant setup starts with an automated scan of the site that discovers every cookie, tag and tracking pixel actually firing, then groups them into categories (necessary, functional, analytics, advertising) so the banner can offer real per-category choices rather than a single accept/reject toggle. CookieTrace runs this scan on a recurring schedule, since a new pixel added by a marketing team can silently break compliance between manual reviews.

Prior Blocking: stopping trackers before consent

With CookieTrace's Prior Blocking setting enabled, non-essential cookies and trackers detected by the scan — whether loaded via GTM or embedded directly in the page — are not executed until the visitor makes a choice; if the visitor rejects, they never run, and if they accept, only the accepted categories load.

Implementation checklist for Saudi-facing websites

Use this checklist as a starting point; it does not replace a legal review of your specific data flows.

• Run an automated scan and categorise every cookie/tracker found
• Publish an Arabic-first, RTL-aware privacy notice alongside the English version
• Deploy a bilingual consent banner with granular accept/reject per category
• Enable Prior Blocking so non-essential scripts wait for a decision
• Keep timestamped, exportable consent records for at least 3 years
• Review cross-border transfer arrangements with counsel if data leaves Saudi Arabia
• If you also serve EU visitors, layer GDPR/ePrivacy consent logic on top