How to Install a PDPL Cookie Banner on WordPress: Step-by-Step (2026)

The best cookie consent plugin for a WordPress site in Saudi Arabia or the UAE shows an Arabic, right-to-left banner, loads in the page head, passes each visitor's choice to Google Consent Mode v2, and saves a dated record of every choice. The Arqam360 plugin on wordpress.org (listed as arqam360-consent-privacy-pdplgdpr) is built for that, and this guide installs it. WordPress runs many Saudi business sites, from company sites to WooCommerce stores. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement, and the violation categories named in summaries of it include processing without a valid legal basis and marketing sent without consent. So a WordPress site that loads analytics or advertising tags for Saudi visitors needs to ask first. This guide is the step-by-step: installing the plugin, configuring the banner, and checking Google Consent Mode v2, with or without WooCommerce.

This post is the installation walkthrough. For the rules behind it, read the Saudi PDPL cookie guide.

Looking for the plugin rather than the steps? Arqam360 for WordPress covers what it does, its settings and pricing.

To compare it with the other cookie consent tools sold to businesses in Saudi Arabia and the UAE, see the best cookie consent tools for Saudi Arabia and the UAE.

What Saudi PDPL Requires on a Cookie Banner

Saudi PDPL Article 6 requires explicit, informed, prior consent before processing personal data for non-essential purposes. In practical terms for a WordPress site: trackers cannot fire and cookies cannot be written until the visitor has actively granted permission. Opt-out consent (the kind some U.S. frameworks use) is not lawful under PDPL — the visitor must take an affirmative action, clicking "Accept" on a banner, before Google Analytics, Meta Pixel, or any other non-essential cookie/tag activates. The PDPL Implementing Regulations layer additional requirements: consent must be recorded with timestamp and scope, withdrawal must be as easy as granting, and the banner copy must clearly name the categories of data collected and the purposes.

• Banner appears on first page load, before any non-essential tracker fires
• Visitor must take an affirmative action (Accept / Reject / Customize) — implicit consent is not lawful under PDPL
• Visitor can withdraw consent as easily as granted — one-click via a settings link on every page
• Banner copy clearly names the categories of data collected (Analytics / Marketing / Preferences) and the purposes
• If the visitor rejects or closes the banner, no non-essential trackers fire on subsequent page loads
• Consent record stored with timestamp, scope, and visitor identifier for audit
• Banner available in Arabic with RTL layout for Saudi-resident visitors

Step-by-Step: Install a PDPL Banner on Your WordPress Site

This walkthrough assumes you run a Saudi WordPress site (with or without WooCommerce) and want a PDPL-compliant banner live in the next 5 minutes. We use the Arqam360 WordPress plugin as the reference because it's listed on wordpress.org (official plugin ecosystem — no zip uploads, no security concerns), implements Consent Mode v2 in full, and is free for the banner forever. The pattern applies to any Saudi-aware WordPress consent plugin.

Step 1: Install the Arqam360 Plugin from wordpress.org

In your WordPress admin, go to Plugins → Add New. Search for "Arqam360" (the WordPress.org slug is arqam360-consent-privacy-pdplgdpr); the plugin is published by arqam360. Click "Install Now", then "Activate". The plugin adds an Arqam360 menu to wp-admin with two pages: Dashboard and Settings.

Step 2: Get your two credentials from arqam360.com

WordPress has no app-store sign-in, so you create the Arqam360 account yourself: sign up at arqam360.com (no card; the banner runs on the free plan). In the dashboard open API Keys and copy two values: the Widget Key, which starts with ciq_live_ and loads the banner, and the Site Token, which starts with ciq_sk_live_ and opens your Arqam360 dashboard inside wp-admin. The Site Token is shown once, when you create it. Back in WordPress, go to Arqam360 → Settings, paste each into its own field and save. The Widget Key is public by design — it appears in your page source — while the Site Token is never written to your pages; the plugin refuses a credential pasted into the wrong field.

Step 3: Configure the Banner

The Settings page has a few choices. Widget loading: split (the default — a small script sets the consent default at once, then the banner loads in the background) or combined (one larger file, same behaviour). Compliance: Enforce script blocking holds known tracker scripts until consent (off by default; test your site after turning it on), Auto-detect regulatory regime applies the visitor's country rules, and Respect Global Privacy Control is on unless you switch it off. Advanced: the banner language follows each visitor's browser unless you pin it to Arabic or English. The banner's colours, position and text are set in the Arqam360 dashboard, under the Widget tab. Save, and the banner is live.

Step 4: Verify on the Front End

Open your site in a private window so no stored consent interferes. The banner should appear before you make a choice. Click around your site: it stays until you decide. If no banner appears, check two things: that the Widget Key is saved in Arqam360 → Settings, and that no cache in front of WordPress (Cloudflare, for example) is still serving an old page. Saving the plugin's settings already purges the page cache of WP Engine, WP Rocket, W3 Total Cache, WP Super Cache, SiteGround Optimizer, LiteSpeed and Cache Enabler.

Step 5: Verify Google Consent Mode v2 (Critical)

Most installations skip this step — and it's the step that shows whether Google tags actually wait. Install the Google Tag Assistant Companion (free Chrome extension). With the extension active, refresh your site in incognito. The extension should show gtag('consent', 'default') firing FIRST with all four parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) set to 'denied'. Click "Accept" on the banner. You should now see gtag('consent', 'update') fire with the parameters set to 'granted'. If the default doesn't fire before any GA4 or Google Ads tag, your install is broken — typically a plugin load-order issue (see Gotcha 3 below).

Five WordPress-Specific Gotchas

WordPress is more permissive than Shopify but also more error-prone because every WordPress site is a unique combination of theme + plugins + page builders + caching layers. Each gotcha below is solvable, but we see roughly half of Saudi WordPress sites hit at least one. Run through this list before declaring victory.

Gotcha 1 — A cache in front of the site serves stale pages. Saving the plugin's settings purges the page cache of WP Engine, WP Rocket, W3 Total Cache, WP Super Cache, SiteGround Optimizer, LiteSpeed and Cache Enabler. A cache the plugin cannot reach — Cloudflare APO, another CDN, a host-level cache not in that list — keeps serving the pre-banner HTML until you purge it yourself. If the banner is missing for visitors but visible to you while logged in, this is almost always why.

Gotcha 2 — Page builder plugins (Elementor, Divi, Beaver Builder) sometimes load their own analytics. A builder's integrations settings can add Google Analytics alongside Site Kit or another analytics plugin, so the same tag loads twice. Keep Google Analytics in one place. If that place is a snippet the builder prints outside wp_head, check with Tag Assistant (Step 5) that it still waits for the consent default.

Gotcha 3 — A tag hard-coded above wp_head(). The plugin prints its script in the <head>, synchronously and ahead of the other scripts WordPress enqueues, so the Consent Mode default is set before tags added through WordPress read it. What it cannot get ahead of is a Google Tag Manager or GA4 snippet pasted into your theme's header.php above the wp_head() call: that runs before anything WordPress outputs. If Tag Assistant shows GA4 firing before the consent default, look there first, and move the snippet below wp_head() or load the tag through a plugin.

Gotcha 4 — WooCommerce checkout pages use a separate template. WooCommerce's checkout flow runs on a dedicated template that some lightweight themes hijack (e.g., some checkout-optimization plugins replace the template entirely). The Arqam360 banner appears on the storefront and product pages by default, but verify the banner also appears on /checkout/ and /cart/ pages. If it disappears on those pages, the optimization plugin is removing the wp_head hook our plugin uses — contact the plugin author or override the template.

Gotcha 5 — WordPress multisite networks need per-site settings. On a network with several sites, the plugin's settings are stored per site: each site needs its own Widget Key and Site Token, and keeps its own banner settings and consent records. Network-activating the plugin is not enough — open each site's admin and enter its credentials.

PDPL Compliance Checklist for Your WordPress Site

Beyond the banner installation, full PDPL compliance requires several more pieces. This checklist covers the essentials for a WordPress site (with or without WooCommerce). Tick each box; gaps are audit exposure.

• PDPL-compliant consent banner installed and verified across Steps 1-5 above
• Privacy policy published that explicitly names PDPL and SDAIA — not a generic GDPR template translated
• Data Subject Access Request (DSAR) channel published with a 30-day response commitment per PDPL Implementing Regulations
• Data Protection Officer (DPO) appointed if you process sensitive data at scale or systematically monitor visitor behavior
• Registered on SDAIA's National Data Governance Platform (NDGP) if you're a public entity, process sensitive personal data, or your primary business is data processing
• Cross-border data transfer documented if any vendor (your hosting provider, Meta, Google, Cloudflare) processes Saudi-resident data outside Saudi Arabia
• Consent records stored with timestamp + scope + visitor identifier for audit (Arqam360 stores 90-day rolling logs)
• Visible link to a withdraw-consent UI on every page (most themes support this via the footer widget area)

Frequently Asked Questions

Authoritative Sources

Next Steps

Once your WordPress site has a verified banner running, two follow-ups add the most. First, run the free Arqam360 scanner against your site to confirm which cookies and trackers load before consent. Second, read the Saudi PDPL cookie consent guide: the banner is one piece of a larger picture that includes your privacy policy, consent records and data-subject requests.