Cookie Consent in Saudi Arabia: PDPL and SDAIA Compliance Guide

How PDPL and SDAIA rules apply to cookies and consent banners in Saudi Arabia, plus GDPR/ePrivacy for EU visitors and a bilingual implementation checklist.

In short

Under Saudi Arabia's PDPL, supervised by SDAIA, non-essential cookies and trackers generally need clear notice and the visitor's free, informed consent before they run; strictly necessary cookies do not. For a Saudi audience this notice and the consent banner should be available in Arabic (RTL) as well as English, and cross-border transfers of related data need a documented legal basis. Cookietrace supports PDPL-style consent flows alongside GDPR/ePrivacy, CCPA, LGPD and KVKK, with bilingual Arabic/English banners, automated scanning, IAB TCF v2.2, Google Consent Mode v2 and timestamped, integrity-proofed consent records kept 3+ years. This is general information, not legal advice.

Cookietrace Privacy Engineering Team — Published 2026-09-15 · 8 min read

What does the Saudi PDPL require for cookies and tracking?

Saudi Arabia's Personal Data Protection Law (PDPL) and its Implementing Regulations, supervised by the Saudi Data & AI Authority (SDAIA), treat persistent identifiers such as cookies, mobile ad IDs and tracking pixels as personal data whenever they can be linked to an identifiable individual. Any website that sets non-essential cookies for a Saudi audience needs a documented lawful basis, a clear notice and, in most cases, prior consent before those cookies run.

Lawful basis and consent under PDPL

Strictly necessary cookies (session, security, load-balancing) generally do not need consent because they are required to deliver the service the visitor requested. Analytics, advertising and social-media cookies almost always require the visitor's free, specific and informed consent, collected before the cookie fires, with an equally easy way to withdraw it.

Consent must be an affirmative, unambiguous action — pre-ticked boxes or continued browsing are not valid consent
The visitor must be able to reject non-essential categories as easily as accepting them
Consent choices must be logged with a timestamp so they can be reproduced on request
Withdrawal must be as simple as giving consent, e.g. a persistent 'privacy settings' link

Notice and transparency obligations

PDPL requires a clear, accessible privacy notice describing what data is collected, the purpose, retention period, and third parties involved, in language the data subject understands. For a Saudi audience this means the notice and consent banner should be available in Arabic, not only in English.

Cross-border data transfer considerations

PDPL restricts transferring personal data — including consent logs and analytics data tied to Saudi visitors — outside the Kingdom unless an adequate level of protection is demonstrated or another legal transfer mechanism applies. Businesses using overseas analytics, advertising or CMP vendors should review this together with local counsel before relying on it, since requirements and guidance from SDAIA continue to evolve.

Bilingual Arabic and English banner requirements

Because MSA (Modern Standard Arabic) is the primary language for consumers in the Kingdom, a consent banner shown only in English does not meet the PDPL's transparency expectations for a Saudi audience. An effective banner presents the notice and choices in Arabic by default for Saudi visitors, with English available as a secondary option, and correctly renders right-to-left (RTL) layout.

How automated cookie scanning and categorisation works

A compliant setup starts with an automated scan of the site that discovers every cookie, tag and tracking pixel actually firing, then groups them into categories (necessary, functional, analytics, advertising) so the banner can offer real per-category choices rather than a single accept/reject toggle. Cookietrace runs this scan on a recurring schedule, since a new pixel added by a marketing team can silently break compliance between manual reviews.

Prior Blocking: stopping trackers before consent

With Cookietrace's Prior Blocking setting enabled, non-essential cookies and trackers detected by the scan — whether loaded via GTM or embedded directly in the page — are not executed until the visitor makes a choice; if the visitor rejects, they never run, and if they accept, only the accepted categories load.

Implementation checklist for Saudi-facing websites

Use this checklist as a starting point; it does not replace a legal review of your specific data flows.

Run an automated scan and categorise every cookie/tracker found
Publish an Arabic-first, RTL-aware privacy notice alongside the English version
Deploy a bilingual consent banner with granular accept/reject per category
Enable Prior Blocking so non-essential scripts wait for a decision
Keep timestamped, exportable consent records for at least 3 years
Review cross-border transfer arrangements with counsel if data leaves Saudi Arabia
If you also serve EU visitors, layer GDPR/ePrivacy consent logic on top

Frequently asked questions

Does the Saudi PDPL apply to cookies?

Yes. PDPL and its Implementing Regulations, overseen by SDAIA, treat cookies and similar identifiers as personal data when they can be linked to an identifiable person, so the usual notice and consent rules apply to non-essential cookies.

Do I need consent for analytics cookies in Saudi Arabia?

In most cases yes — analytics, advertising and social-media cookies are not strictly necessary to deliver the service, so they normally require the visitor's prior, informed consent.

Should the consent banner be in Arabic?

Yes. For a Saudi audience, showing the notice and consent choices in Arabic (and rendering the banner in RTL) better meets PDPL's transparency expectations than an English-only banner; offering both languages is good practice.

Can I send Saudi visitor data to an analytics tool hosted abroad?

PDPL restricts cross-border transfers unless an adequate level of protection is shown or another lawful transfer mechanism applies; review your specific vendor and data flow with local counsel.

Does Cookietrace store data in Saudi Arabia?

No. Cookietrace hosts data in the EU by default, with a Türkiye hosting option; it does not offer Saudi or Gulf data residency, so cross-border transfer requirements should be assessed separately.

How does Prior Blocking help with PDPL compliance?

With Prior Blocking enabled, non-essential cookies and trackers found by the scan do not run until the visitor chooses; if they reject, the scripts never fire, which supports a 'consent before tracking' approach.

Sources

Official sources cited in this guide.

Who should read it

Website owners, marketing teams and developers responsible for cookie consent, analytics tagging and privacy documentation.

Cookietrace

Written and reviewed by the Cookietrace Privacy Engineering Team. (8 min — regulations)