How to Install a PDPL Cookie Banner on Zid: Step-by-Step (2026)

Zid separates installing an app from adding its code to your storefront: the app comes from the Zid App Market, and its storefront script is added through Zid's snippet system. SDAIA confirmed 48 enforcement decisions in its January 2026 announcement, and the violation categories named in summaries of it include processing without a valid legal basis and marketing sent without consent. So a Zid store running Google Ads, Meta Pixel or TikTok tags needs to ask before they fire. This guide walks through installing a PDPL cookie banner on Zid with the Arqam360 app, step by step, and checking that it works.

This post is the installation walkthrough. For the rules behind it, read Saudi PDPL cookie consent.

Looking for the app rather than the steps? Arqam360 for Zid covers what it does, pricing and the Zid App Market install.

What Saudi PDPL Requires on a Cookie Banner

Saudi PDPL Article 6 requires explicit, informed, prior consent before processing personal data for non-essential purposes. In practical terms for a Zid store: trackers cannot fire and cookies cannot be written until the visitor has actively granted permission. Opt-out consent is not lawful — the visitor must take an affirmative action (clicking "Accept" on a banner) before Google Analytics, Meta Pixel, TikTok pixel, or any other non-essential cookie/tag activates. The PDPL Implementing Regulations add: consent recorded with timestamp + scope, withdrawal as easy as granting, and clear naming of data categories collected.

• Banner appears on first page load, before any non-essential tracker fires
• Visitor takes an affirmative action (Accept / Reject / Customize) — implicit consent is not lawful
• Visitor can withdraw consent as easily as granted (one-click via settings link)
• Banner copy names the data categories (Analytics / Marketing / Preferences) and purposes
• If visitor rejects, no non-essential trackers fire on subsequent page loads
• Consent records stored with timestamp + scope + visitor identifier for audit
• Banner available in Arabic with RTL layout for Saudi visitors

Step-by-Step: Install Arqam360 on Your Zid Store

This walkthrough assumes you have a Saudi Zid store and want a PDPL-compliant banner live in 3 clicks. Zid's architecture splits app integration (the merchant admin iframe) from snippet injection (the storefront script). The Arqam360 Zid app handles both layers — once approved by Zid, the snippet auto-injects across your storefront with zero extra steps. This is different from Shopify (single integration) and Salla (Easy Mode SDK) but produces the same outcome: a working banner on your storefront within minutes of install.

Step 1: Find Arqam360 in the Zid App Store

Open your Zid merchant admin → التطبيقات (Apps) → متجر التطبيقات (App Store). Search "Arqam360" or browse the privacy/compliance category. The listing shows the Free plan (the banner forever, no card required) and the paid plans, Pro and Managed. For a single Saudi store with up to 10,000 monthly pageviews, the Free plan includes the banner, Google Consent Mode v2 and a consent log. Click «تفعيل» (Activate).

Step 2: Approve OAuth + Grant Scopes

Zid redirects you through OAuth to authorize the app. The scopes the app requests: read your store information (for banner detection of language and currency), receive snippet-injection permission (the banner script). Approve. Zid uses code-exchange OAuth only (no Easy Mode shortcut like Salla), so you'll briefly see Zid's OAuth screen. After approval, Zid returns you to your store admin where the Arqam360 app is now active.

Step 3: Configure the Banner

Click the Arqam360 app icon in your Zid admin. The Arqam360 dashboard loads inside the Zid admin iframe. What you start with: the banner is in Arabic, laid out right to left, because every Zid install is set to Arabic by default; visitors can switch to English. It sits at the bottom centre of the page, in Arqam360's ochre accent (#C4753B) on a dark navy background. None of this is read from your Zid theme, so if you want the banner to match your store, change its colours, position and button text in the dashboard, then click «حفظ» (Save). The banner queues for storefront injection via Zid's official Snippet system.

Step 4: Verify on Your Storefront

Open your Zid storefront URL in an incognito browser. The banner should appear within 1-2 seconds. If it doesn't appear immediately after Step 3, wait 1-2 minutes — Zid's Snippet auto-injection has a brief propagation delay. If still no banner after 5 minutes, check your Zid admin → Apps → Arqam360 for any "Connection issue" warnings; re-authorize if needed. Click "Accept" on the banner — banner disappears. Refresh — banner stays gone (consent stored). New incognito window — banner reappears (fresh visitor).

Step 5: Verify Google Consent Mode v2 (Critical)

This is the step that shows whether Google tags actually wait. Install the Google Tag Assistant Companion (free Chrome extension). With it active, refresh your Zid storefront in incognito. The extension should show gtag('consent', 'default') firing FIRST with all four parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) set to 'denied'. Click "Accept" on the banner. You should now see gtag('consent', 'update') fire with parameters set to 'granted'. If the default doesn't fire before any GA4 tag, the load order is broken — but Arqam360's Zid integration uses Zid's official Snippet position which guarantees early-page injection.

Four Zid-Specific Gotchas

Zid's App-vs-Snippet architecture introduces some platform-specific edge cases. Each is solvable; run through this checklist after Steps 1-5.

Gotcha 1 — Check how payment cookies are classified. Zid stores commonly use Mada (the Saudi national debit network), Tabby, Tamara and Apple Pay, and each can write cookies during checkout. Arqam360's cookie database has patterns for Mada checkout-session cookies (classified Necessary) and for Tabby and Tamara cookies (classified Marketing, because they track the checkout funnel); it has no Apple Pay entry. None of these patterns has yet been matched on a real store scan: the scanner visits your homepage, and payment providers mostly set their cookies at checkout, often from their own domain. So check the categories in your scan results, and if a payment cookie sits in the wrong one, contact Arqam360 support.

Gotcha 2 — Zid theme cache propagation. When you change banner configuration in the Arqam360 dashboard, Zid's storefront cache can delay the visible change by 5-10 minutes. Hard-refresh (Cmd+Shift+R) usually bypasses this. If your store has Cloudflare in front (some larger Zid merchants do), purge Cloudflare cache for your domain too.

Gotcha 3 — Snippet propagation depends on Zid app status. If Zid temporarily de-lists the Arqam360 app for any reason (rare, but possible during marketplace re-reviews), the snippet auto-injection pauses. Your banner stays functional on already-loaded pages but new visitors see the storefront without the banner. Monitor Zid → Apps for any status-change alerts; contact Arqam360 support if you see them.

Gotcha 4 — Multi-currency stores need explicit verification. Zid supports multi-currency for cross-GCC merchants. The Arqam360 banner detects the visitor's currency-language combination correctly, but multi-currency stores should test both: visit with SAR context (Saudi IP) → Arabic banner; visit with AED context (UAE IP) → Arabic banner with UAE-PDPA framing if enabled. Both regimes use Consent Mode v2; the difference is in the banner copy framing.

PDPL Compliance Checklist for Your Zid Store

Beyond the banner, full PDPL compliance requires several more pieces. Tick each box; gaps are audit exposure.

• PDPL-compliant consent banner installed and verified across Steps 1-5
• Privacy policy published explicitly naming PDPL and SDAIA — Zid provides a policy template you can customize under الإعدادات (Settings) → الصفحات (Pages)
• DSAR (Data Subject Access Request) channel published with 30-day response commitment
• Data Protection Officer (DPO) appointed if processing sensitive data at scale or systematically monitoring visitors
• Registered on SDAIA's National Data Governance Platform (NDGP) if public entity, processing sensitive data, or primary business is data processing
• Cross-border data transfer documented if any vendor (Zid itself, Meta, Google, Tabby, Tamara, Mada) processes Saudi-resident data outside Saudi Arabia
• Consent records stored with timestamp + scope for audit (Arqam360 stores 90-day rolling logs)
• Visible link to withdraw-consent UI in your Zid store footer

Frequently Asked Questions

Authoritative Sources

Next Steps

Once your Zid store has a verified PDPL banner running, two compounding follow-ups. First: run the free Arqam360 scanner against your storefront to confirm no trackers fire pre-consent and to surface any Saudi-payment cookies the classifier might handle differently than your specific store setup. Second: read the Cluster A cornerstone "Saudi PDPL: The Complete Merchant Guide 2026" to understand the broader compliance picture beyond the banner — DSAR workflow, DPO appointment criteria, and NDGP registration. The banner is the technical foundation; everything else is operational discipline. Zid merchants tend to be higher-GMV operators with sophisticated payment integrations; that operational sophistication is exactly the discipline PDPL compliance rewards.