We loaded 2,103 Gulf websites in a real browser. Most never ask before they track.

Taha Farhane — Sat, 10 Oct 2026 10:56:54 +0000

Saudi Arabia's Personal Data Protection Law has been fully enforceable since September 2024, and its regulator, SDAIA, confirmed 48 enforcement decisions in its January 2026 announcement. Marketing sent without consent is one of the violation categories it named. The UAE has its own data protection law too.

So we asked a simple question: when you open a Gulf business website, does it ask before it tracks you?

How we measured

We loaded each homepage once in a real browser (Puppeteer) and recorded every cookie set and every third-party tracker loaded. For each site we checked three things:

whether any tracker fired before the visitor made a choice,
whether a consent banner appeared at all,
whether Google tags sent a Google Consent Mode v2 signal.

Sites that blocked the scanner were marked inconclusive.

Saudi Arabia: 1,556 online stores (September 2026)

935 (60%) run trackers and show no consent banner at all. The visitor is simply never asked.
1,065 (68%) start tracking before the visitor makes any choice.
751 (48%) run Google Analytics or Tag Manager with no Consent Mode v2 signal.
Google Analytics runs on 920 stores (59%), Meta Pixel on 452 (29%).

UAE: 547 business websites on .ae (October 2026)

279 (51%) run trackers with no consent banner.
287 (52%) track before any choice.
223 (41%) run Google tags with no Consent Mode signal.

The two samples are different populations (stores vs business websites, and the UAE list covers only part of the .ae namespace: every domain in it starts with a digit or the letter "a"), so we don't rank the countries. Each number stands on its own.

Why "no banner" is the headline

Most consent debates in Europe are about banner design: dark patterns, a missing "Reject all" button. In the Gulf the problem comes earlier. On most sites there is no banner to design. The visitor's first page view already sends data to Google and Meta.

Why it matters for the businesses themselves

Under Google Consent Mode v2, tags that run without a consent signal can lose measurement and ad features for traffic from regions where consent is required. Under the Saudi law, fines go up to SAR 5 million, SAR 10 million for repeat violations. A banner alone doesn't fix it either: the tags have to wait for the answer, and the business has to keep a record of the choice.

What the scan cannot see

Homepage only, client-side only: no checkout pages, no server-side processing, no contracts or internal procedures. A low score is a signal about consent at the storefront, not a legal finding. We name no site and publish no store-level results.

Check it yourself

Both datasets are open (CC BY 4.0) with DOIs:

Saudi: 10.5281/zenodo.23053713 · report: arqam360.com/ksa-compliance-index
UAE: 10.5281/zenodo.23109874 · report: arqam360.com/uae-compliance-index

Disclosure: I'm the founder of Arqam360, which makes consent software for Gulf businesses. That's why we built the scanner, and why we publish the data openly so anyone can check it. This article was written with an AI assistant from our data and method.

— Taha Farhane, Founder, Arqam360. Former lead auditor in technology, processes and data privacy.

DEV Community: Taha Farhane