Anatomy of a MENA ecommerce scan
What we find on a representative Saudi fashion store
This is a representative scan — a composite of what a typical first scan of a mid-sized Saudi fashion ecommerce site reveals. We don't attribute to a specific merchant because our case-study practice is to name customers only when they explicitly agree. Findings are real patterns we see; specific numbers are a realistic representative range.
The setup
The merchant runs on Salla with ~50K monthly visits, ~85% from Saudi Arabia, ~60% mobile. They ship to GCC + Egypt. Their checkout offers Mada, Tabby, Tamara, and Apple Pay. Their existing consent stack: a Cookiebot banner installed by a developer 11 months ago, never revisited. Their marketing stack: Meta Pixel, TikTok Pixel, Google Ads, GA4, Hotjar.
The scan completes in ~12 seconds via our AI Radar (Puppeteer headless Chromium). Here's what it surfaces.
Findings
Meta Pixel fires before consent
_fbp cookie set on page load, before the consent banner appears. Visitors in GDPR/PDPL jurisdictions are tracked without a lawful basis. Google Consent Mode v2 not wired — ad_storage defaults to "granted" instead of "denied".
TikTok Pixel fires before consent
_ttp cookie set on page load. Same issue as Meta — no consent gate, no Consent Mode signal.
Tabby attribution cookie unclassified
tabby_session cookie observed, not categorized by the existing (Cookiebot-generated) cookie declaration. Visitors see "Unknown cookie" in the preferences panel — a trust-eroding UX and a compliance gap.
6 analytics cookies, no consent category
_ga, _ga_*, _gid, _gat, Hotjar, and Microsoft Clarity all present. All reporting consent state = "granted" regardless of user choice.
Cookie declaration is English-only
Merchant's primary traffic is Arabic-speaking. The policy page exists but is not bilingual. Not an enforcement issue yet, but a real merchant-quality gap.
What install day looks like
The Salla app installs in under 5 minutes. The widget goes live on the storefront immediately. The following changes take effect the same day:
1. Quarantine all tracker scripts + network requests
Our widget intercepts <script> injection via MutationObserver and proxies fetch + XHR. Meta, TikTok, GA, Hotjar, Clarity — all blocked until consent. On opt-in, quarantined items replay. On opt-out, they stay blocked.
2. Wire Google Consent Mode v2 automatically
GCM v2 defaults to "denied" for analytics_storage, ad_storage, ad_user_data, ad_personalization on page load. Updates to "granted" only on affirmative consent. Google Ads + GA4 retain signal from opted-in visitors — no duct-tape.
3. Classify MENA-specific cookies correctly
Our classifier has 124 cookie patterns, 37 built for this region: regional ecommerce platforms, payment gateways and shipping carriers, alongside the global trackers. The cookie declaration renders with vendor names + categories, in English AND Arabic.
4. Auto-regime detection
CF-IPCountry classifies each visitor to the right regime (PDPL, UAE PDPA, GCC, GDPR, CCPA). Banner copy, categories, and consent logic adjust per visitor — not by best-guess defaults.
What we deliberately don't claim
We don't claim specific conversion-rate lifts from consent fixes. The real world has too many other variables — a merchant's ad spend, creative rotation, seasonality, pricing all move conversion more than a consent banner does. What proper consent infrastructure reliably recovers is signal for the ad platform's optimization, which compounds over time. We don't promise a specific number because that number isn't ours to guarantee.
We do claim, and can prove per-event in the audit log: which routing rule matched, which platforms received the event, and what the consent state was. That's the compliance artifact. That's what this product does.
Want to see what we'd find on your site?
Free scan, no signup. Results in about 60 seconds.