More Than Two-Thirds of Saudi Online Stores Load Tracking Before Visitors Consent, Index of 1,556 Storefronts Finds

Arqam360's index puts the median Saudi storefront at 45 out of 100 on consent basics, two years after the PDPL grace period ended

DUBAI, UNITED ARAB EMIRATES, September 30, 2026 /EINPresswire.com/ -- 1,065 of 1,556 Saudi e-commerce storefronts (68%) loaded tracking before the visitor had a chance to accept or refuse it, according to the September 2026 edition of the KSA E-Commerce Privacy Compliance Index, published by Arqam360. The median store scored 45 out of 100 across the 1,496 storefronts that could be scored; 379 of them (25%) scored 80 or more, and 664 (44%) scored below 40.

The index found that 935 of the 1,556 storefronts scanned (60%) ran trackers or non-essential cookies with no consent banner at all. 751 (48%) ran Google Analytics or Google Tag Manager without sending a Google Consent Mode v2 signal, the mechanism Google provides for passing a visitor's consent choice to its advertising and analytics tools. Google Analytics was detected on 920 storefronts (59%) and Meta Pixel on 452 (29%). In total, 1,507 of the 1,556 storefronts (97%) showed at least one of three consent gaps: no consent banner detected, tracking before consent, or Google tags running without Consent Mode v2.

Results varied by the platform a store runs on. Stores on WordPress/WooCommerce (858 scanned) and Shopify (114 scanned) both had a median score of 47 out of 100. Stores on Zid (89 scanned) and Salla (72 scanned) both had a median of 29.

The findings arrive as enforcement of Saudi Arabia's Personal Data Protection Law (PDPL) is under way. The law's grace period ended on 14 September 2024, and the Saudi Data and Artificial Intelligence Authority (SDAIA) confirmed 48 enforcement decisions in its January 2026 announcement. Administrative fines under the PDPL reach SAR 5 million, doubling to SAR 10 million for repeat violations. Marketing sent without consent is among the violation categories SDAIA has named.

"Most of these stores are not hiding anything. They installed Google and Meta tags the way the setup guides told them to, and nobody told them the tags now have to wait for the visitor's answer," said Taha Farhane, founder of Arqam360. "The fix is a few hours of configuration, not a legal project. We publish the index so merchants, platforms and advisers can see where the market stands and measure whether it moves."

Methodology. Between May and September 2026, Arqam360 assembled a sample of Saudi storefronts from Common Crawl's public URL index (.sa domains and stores hosted on Salla and Zid), kept those that showed signs of a working shop, and added a hand-curated list of known Saudi stores. A real browser (Puppeteer) loaded each store's homepage and recorded cookies, trackers, the consent banner and Google Consent Mode v2 status; each store was scored from 0 to 100 against PDPL and GDPR consent criteria. The September 2026 edition covers 1,556 storefronts, aggregated on 7 September 2026. 60 scans were inconclusive (the index marks a scan inconclusive when the store blocks the scanner) and carry no score, so the score figures (median, distribution) cover the 1,496 scored storefronts; every finding and tracker percentage above uses all 1,556 storefronts as its denominator. The scan covers the homepage only, from the client side. It cannot see server-side processing, what happens after login or checkout, or a store's contracts and internal procedures, so a low score is a signal about consent at the storefront, not a legal finding.

The full report, in English and Arabic, and the aggregate data as a CSV are free at https://arqam360.com/ksa-compliance-index, with no email required. The dataset is archived on Zenodo under DOI 10.5281/zenodo.23053713.

About Arqam360
Arqam360 is a consent management platform built for e-commerce in the Middle East and North Africa. It gives online stores a bilingual Arabic and English consent banner, Google Consent Mode v2 signalling, and consent records for Saudi Arabia's PDPL, the UAE's PDPA and the EU's GDPR. Arqam360 is available on the Shopify App Store, the Zid App Store and wordpress.org, and offers a free public website scanner and PDPL privacy-policy generator at arqam360.com.

Taha
Arqam360
admin@arqam360.com
Visit us on social media:
LinkedIn
YouTube
X