Two-Thirds of Saudi Online Stores Track Before Consent, Index Finds

Arqam360’s September 2026 index found that 68% of 1,556 Saudi e-commerce storefronts loaded tracking before visitors could consent or refuse, underscoring broad gaps in PDPL compliance more than two years after the grace period ended. The median storefront scored 45 out of 100, with 97% showing at least one major consent failure.

Why it matters: - Saudi Arabia’s Personal Data Protection Law is now being enforced, and storefront consent failures can expose merchants to fines of up to SAR 5 million, or SAR 10 million for repeat violations. - The findings suggest many Saudi online stores are still collecting data before consent, which raises compliance risk for merchants, platforms and agencies. - Marketing sent without consent is among the violation categories named by the Saudi Data and Artificial Intelligence Authority.

What happened: - Arqam360’s September 2026 KSA E-Commerce Privacy Compliance Index reviewed 1,556 Saudi e-commerce storefronts. - 1,065 storefronts, or 68%, loaded tracking before visitors had the chance to accept or refuse it. - The median storefront scored 45 out of 100 across the 1,496 storefronts that could be scored. - 379 storefronts, or 25%, scored 80 or above. - 664 storefronts, or 44%, scored below 40.

The details: - 935 storefronts, or 60%, ran trackers or non-essential cookies without any consent banner. - 751 storefronts, or 48%, ran Google Analytics or Google Tag Manager without sending a Google Consent Mode v2 signal. - Google Analytics appeared on 920 storefronts, or 59%. - Meta Pixel appeared on 452 storefronts, or 29%. - 1,507 storefronts, or 97%, showed at least one of three consent gaps: no banner detected, tracking before consent, or Google tags running without Consent Mode v2. - WordPress/WooCommerce storefronts and Shopify storefronts both had a median score of 47 out of 100. - Zid storefronts and Salla storefronts both had a median score of 29 out of 100. - The index scanned 858 WordPress/WooCommerce storefronts, 114 Shopify storefronts, 89 Zid storefronts and 72 Salla storefronts. - The sample was aggregated on 7 September 2026. - Sixty scans were inconclusive because the store blocked the scanner and did not receive a score. - The scan covered the homepage only and used a client-side browser. - The index could not see server-side processing, post-login or checkout behavior, or contracts and internal procedures.

Between the lines: - The results point to a practical implementation problem as much as a legal one. - Taha Farhane, founder of Arqam360, said many stores are not trying to hide tracking and instead followed setup instructions that did not account for consent requirements. - Farhane said the fix is usually a few hours of configuration, not a legal project. - The platform gap is notable because the strongest median scores came from WordPress/WooCommerce and Shopify, while Zid and Salla storefronts lagged. - The high share of stores with at least one consent gap suggests the issue is widespread rather than isolated.

What’s next: - Arqam360 is publishing the index so merchants, platforms and advisers can track whether compliance improves. - The full report in English and Arabic is available here. - The aggregate data are available as a free CSV, and the dataset is archived on Zenodo under DOI 10.5281/zenodo.23053713. - Arqam360 also offers a free public website scanner and PDPL privacy-policy generator at arqam360.com.

The bottom line: - Saudi e-commerce consent practices still lag the law, and the gap is broad enough to create both regulatory and operational risk across the market.