Does a Salla Store Need a Cookie Banner? PDPL Consent Guide

If you run a store on Salla, cookie consent is part of how your store complies with Saudi Arabia's Personal Data Protection Law (PDPL). Analytics tools, marketing pixels and many third-party apps collect personal data through cookies and similar identifiers, and under the PDPL that processing needs a valid legal basis before it happens. For non-essential tracking, that basis is normally the visitor's consent.

Doing this properly takes more than a notice at the bottom of the page. Trackers have to wait for the visitor's choice, Google tags need Google Consent Mode v2 signals, each choice has to be recorded, and the banner has to work in Arabic, right to left. This guide answers the questions Salla merchants ask most, then shows where Arqam360 fits.

The rules apply to every Saudi store, not only Salla ones; what PDPL requires for cookies is set out in full in our pillar guide.

Looking for the app rather than the answers? Arqam360 for Salla covers what it does, pricing and how it installs.

Does a Salla store need a cookie banner under PDPL?

Yes, if the store runs non-essential trackers such as Google Analytics, Google Ads, Meta Pixel, TikTok Pixel or Snapchat Pixel, which most Salla stores do. The PDPL requires a valid legal basis before personal data is processed, and for these trackers that basis is normally consent, collected before they fire. A consent banner is how a store collects it.

When a customer visits your store, scripts from Google, Meta, Snapchat, TikTok and the apps you have installed set cookies that record behaviour, build audiences and power retargeting. Each of those is personal data processing. Cookies the store needs in order to work, such as the ones that keep the cart, are usually handled as essential; tracking and advertising cookies are the ones a banner has to hold back.

Without a working banner, the store is processing personal data without a basis, and that is one of the violation categories SDAIA named when it confirmed 48 enforcement decisions in January 2026. Administrative fines under the PDPL reach up to SAR 5 million, doubling to SAR 10 million for repeat violations. There is an advertising cost too: without Consent Mode v2, Google's tags cannot tell a visitor who consented from one who declined.

What does the PDPL require from a Salla store's consent banner?

The banner has to hold non-essential trackers back until the visitor chooses, let the visitor accept some categories and decline others, make rejecting as easy as accepting, explain in Arabic what is collected and why, and record each choice with a timestamp. A banner that only displays a notice while trackers run does not meet this.

In practice, that becomes six checks for a Salla store:

• Explicit opt-in consent before setting any non-essential cookies
• Clear disclosure of what data is collected and why, in Arabic
• Granular consent categories — visitors must be able to accept analytics but decline marketing
• Easy withdrawal — revoking consent must be as simple as granting it
• Consent records — you must store timestamped proof of each visitor's consent decision
• Privacy policy — published in Arabic, accessible from every page

Your privacy policy has to match what the banner does. For what a Salla store's policy should say and where it goes in the dashboard, see the privacy policy guide for Salla stores.

Do Salla stores need Google Consent Mode v2?

If the store uses Google Analytics or Google Ads, yes in practice. Google's own Consent Mode v2 requirement applies to traffic from the EEA and UK, not Saudi Arabia, but PDPL consent still has to reach Google's tags, and Consent Mode v2 is the mechanism Google provides for that. Without it, Google cannot model conversions for visitors who decline.

Consent Mode v2 uses four signals: analytics_storage, ad_storage, ad_user_data and ad_personalization. They start as denied and change when the visitor accepts. On a Salla storefront one timing detail matters: Salla loads its own Google Tag Manager container very early in the page, so no app can place a consent default ahead of it. What a consent app can do is set the denied default before your own page-load triggers and tags run, and update it the moment the visitor chooses. Check the order yourself in Google Tag Assistant rather than taking any vendor's word for it, ours included.

How do you add a cookie consent banner to a Salla store?

The simplest route is a consent app from the Salla App Store, which adds the banner to your storefront without theme edits. Whichever app you use, check three things after installing: trackers wait for consent, the banner reads correctly in Arabic, and Google Consent Mode v2 signals appear in Google Tag Assistant.

Arqam360's Salla app is built so the merchant never handles API keys or code snippets. It is in Salla's review and not yet listed in the Salla App Store; until it is, contact us about getting started. When it is listed, the steps are:

• Install the Arqam360 app for Salla
• Your Arqam360 account, API key and banner are provisioned automatically during installation
• The consent banner appears on your storefront with default settings
• Adjust the banner's colours, position and wording from the dashboard inside Salla
• Turn on Google Consent Mode v2 from the dashboard, with no GTM configuration
• Run a cookie scan from the dashboard to see which trackers your store loads

How do you stay PDPL compliant after the banner is live?

Treat consent as ongoing work. Every app you install on Salla can add trackers, so re-scan the store after installing apps and at regular intervals, keep your consent records, and update your privacy policy whenever your list of tools changes. If SDAIA asks for evidence, timestamped consent records are what you show.

Arqam360 re-scans verified domains weekly, so new trackers show up in the dashboard, and it stores each consent decision with a timestamp as your audit trail.

How do you measure consent on a Salla store?

Track how many visitors accept, and which categories they accept, broken down by device. The marketing-consent rate matters most, because it limits the audiences your ads can use. If the accept rate on mobile is much lower than on desktop, the banner's mobile layout is usually the first thing worth reviewing.

The Arqam360 dashboard shows consent rates by device, traffic source and time period, including how many visitors grant marketing consent. Test the banner on a phone screen as well as on desktop.

What Arqam360 adds on Salla

• A consent banner built for Arabic and right-to-left layout, not a translated European banner
• Optional script blocking: trackers are held back until consent is granted, for merchants who switch it on
• Timestamped consent records kept for audit purposes
• Google Consent Mode v2 with all four parameters
• A cookie scanner that detects and categorises the cookies on your store
• Consent analytics: accept rates and marketing-consent trends
• DSAR handling: manage data subject requests from the dashboard
• A policy generator for Arabic and English privacy policies