Saudi Arabia PDPL cookie requirements for websites

Websites with visitors in Saudi Arabia need consent before setting tracking or advertising cookies under the Personal Data Protection Law (PDPL), which has been fully enforceable since 14 September 2024. Since 2023, the amended law also allows legitimate interest as a basis, but never for sensitive data, and consent remains the safe basis for analytics and advertising cookies. Enforcement sits with the Saudi Data and Artificial Intelligence Authority (SDAIA), with administrative fines of up to SAR 5 million, doubled for repeat violations.

The PDPL and how it applies to cookies

Saudi Arabia's Personal Data Protection Law (PDPL) came into force on 14 September 2023, with a one-year grace period that ended on 14 September 2024. Since then the law has been fully enforceable, and SDAIA has already begun issuing penalties.

The PDPL does not mention cookies by name. It does not need to. Cookies that collect or process personal data - IP addresses, device identifiers, browsing behaviour, location data - fall squarely within its scope. If your website sets tracking or advertising cookies for visitors in Saudi Arabia, you need cookie consent before those cookies load.

This matters even if your business is based outside the Kingdom. The PDPL has extraterritorial reach, applying to any organisation that processes the personal data of individuals residing in Saudi Arabia.

SDAIA enforces the PDPL

SDAIA is the competent authority under the PDPL. Most cases go to its Committees for Reviewing Violations of the Personal Data Protection Law, which can issue warnings, impose fines and order publication of final penalties. As of mid-January 2026, SDAIA had announced 48 enforcement decisions by these committees, according to a Clyde & Co analysis of March 2026. Press reports on the announcement list unlawful data collection and disclosure, missing security measures, and marketing messages sent without prior consent.

The message is clear: enforcement is real, not theoretical.

Consent and the other legal bases under the PDPL

Consent was the main legal basis in the original PDPL. The amendments made by Royal Decree No. M147 of 27 March 2023 added a basis for the controller's legitimate interests, provided the processing does not prejudice the data subject's rights or interests and does not involve sensitive data. The PDPL is therefore closer to the GDPR than it was, though legitimate interest is narrower and its controls sit in the implementing regulations.

For consent to be valid under the PDPL, it must be:

• Freely given, without coercion or bundling

• Specific to the stated purpose of processing

• Informed, meaning the data subject understands what data is collected and why

• Revocable at any time through a mechanism at least as easy as the one used to give consent

Article 6 lists the cases where consent is not required, such as processing needed for an agreement with the data subject, processing required by another law, and now the controller's legitimate interest. Whether analytics cookies could rest on legitimate interest has not been tested. For advertising and cross-site tracking cookies such as _fbp, and for analytics such as _ga, consent remains the safe basis.

What cookie consent looks like in practice

A cookie banner for Saudi visitors should do four things.

First, it must block non-essential cookies until the visitor actively consents. Pre-ticked boxes or implied consent through continued browsing do not satisfy the PDPL's requirements. Second, it must clearly explain what categories of cookies your site uses and their purposes. Third, it must allow visitors to reject non-essential cookies while still accessing the site - cookie walls that force acceptance are not compatible with freely given consent. Fourth, it must provide an equally simple way to withdraw consent later.

The PDPL has no ePrivacy-style exemption for strictly necessary cookies. A session cookie such as PHPSESSID, or a cookie that remembers the language a visitor chose, either processes no personal data or rests on another basis, such as the service the visitor asked for or legitimate interest, so it does not need a consent prompt.

Recording and storing consent

The PDPL expects you to show how you meet it during audits. This means keeping records of when each visitor consented, what they consented to, and which version of your cookie policy was active at the time. A consent management platform that logs these details automatically removes much of the administrative burden.

Penalties for non-compliance

Since the 2023 amendments, the PDPL has one criminal offence and a general administrative penalty.

Breaching the transfer rules is no longer a criminal offence. The committees can also order final penalties to be published.

PDPL and GDPR: the differences for cookies

If you already follow the GDPR, you have a head start - but the PDPL is not identical. The table below highlights differences that affect cookie handling.

The biggest practical difference is the absence of a separate ePrivacy-style instrument in Saudi Arabia. The PDPL's general consent requirement covers cookies, but there is less granular guidance on cookie categories compared to what European DPAs provide. When in doubt, apply the stricter standard.

PDPL cookie checklist for Saudi Arabia

Use this checklist to audit your site's cookie practices against PDPL requirements.

1. Audit your cookies - Run a cookie scan to identify every cookie your site sets, including those placed by third-party scripts

2. Categorise cookies - Separate strictly necessary cookies from analytics, marketing, and functional cookies

3. Set up prior consent - Block non-essential cookies until visitors give explicit consent through your cookie banner

4. Provide clear information - Your cookie policy should list each cookie by name, purpose, provider, and retention period

5. Enable easy withdrawal - Visitors must be able to change their preferences at any time without difficulty

6. Log consent records - Store timestamped evidence of each consent decision for audit purposes

7. Review cross-border transfers - If cookie data is processed outside Saudi Arabia, check it against the PDPL's transfer requirements

8. Use geo-detection - Show Saudi visitors the banner the PDPL calls for while using appropriate rules for visitors from other jurisdictions

Cookies and the wider Middle Eastern privacy picture

Saudi Arabia's PDPL is part of a broader shift across the Middle East towards formal data protection regulation. Egypt enacted its Personal Data Protection Law in 2020, and its executive regulations were issued in November 2025. Iran regulates data through ICT-sector rules rather than a comprehensive privacy law. Iraq lacks dedicated data protection legislation but has constitutional privacy provisions. Israel has had privacy protection legislation since 1981, with significant amendments strengthening data subject rights, and the UAE has its own Personal Data Protection Law.

For websites serving audiences across the region, a geo-targeted consent strategy is the most practical approach. Configure different consent rules based on visitor location rather than applying a single global standard, and use the global compliance hub to compare the countries.

The Turkish KVKK is another regional law worth comparing, given Turkey's geographic proximity and trade links with Gulf states.

Questions about the PDPL and cookies

Know exactly what your website stores

Most sites set more cookies than their owners expect. Run a free scan, see the full picture, and let Kukie.io handle categorisation, consent collection and a record of each choice.

Start free