We scanned the top KSA ecom stores for PDPL + GDPR privacy compliance. Results are public, data is shareable, no email gate.
Stores scanned
1556
Median score
45/100
Worst score
14/100
Inconclusive scans
60
The takeaway, in one paragraph
Across the 1556 stores we scanned, the median compliance score is 45/100. Translation: the average Saudi e-commerce store today is roughly half-compliant with the PDPL — firing marketing pixels before consent, shipping no banner at all, and running on a privacy stack designed for the pre-PDPL era. The headline isn't that some stores are failing. It's that the entire market is.
60%
Tracking with no consent banner
935 of 1,556 stores scanned
68%
Pre-consent tracking
1,065 of 1,556 stores scanned
48%
Google tags with no Consent Mode v2 signal
751 of 1,556 stores scanned
The headline
97%
of the stores we scanned would fail a PDPL audit today.
That's 1507 out of 1556 stores. The pattern isn't isolated bad actors — it's a market that hasn't caught up with the law that came into full effect in September 2024.
Key findings · September 2026 edition
What we found, in quotable sentences
1The median compliance score was 45/100 across the 1,496 storefronts that could be scored (1,556 scanned, 60 inconclusive).
21,065 of 1,556 storefronts scanned (68%) loaded tracking before the visitor gave consent.
3935 of 1,556 storefronts scanned (60%) ran trackers or non-essential cookies with no consent banner.
4751 of 1,556 storefronts scanned (48%) ran Google Analytics or Google Tag Manager without sending a Google Consent Mode v2 signal.
5Google Analytics was detected on 920 of 1,556 storefronts scanned (59%), and Meta Pixel on 452 (29%).
A market in healthy shape would cluster around 70–80. What we found instead: of the 1,496 stores that could be scored, 664 (44%) scored below 40, 116 (8%) landed in the 60–79 band, and 379 (25%) scored 80+. The good news:379 stores cleared 80, so a high score is within reach. The bad news:664 are still below 40.
Curious where YOUR store falls in this distribution?
68% of stores load Google Analytics, Meta Pixel, or both — before the visitor has had a chance to accept or reject. This is the single largest PDPL violation we observed across the index. The mechanism is usually Google Tag Manager firing on page-load with no consent gating. The fix is well-documented (Google Consent Mode v2 default-denied + a banner that flips the gate after interaction). That this much of the market hasn't done it tells you most stores don't know it's required.
Finding 260%
60% track visitors with no consent banner at all
Not a "bad banner" — no banner. The visitor lands, the trackers fire, the data flows. No pop-up, no choice, no record of consent. Under PDPL this isn't an aesthetic issue — it's a baseline violation. The "no banner" pattern correlates strongly with stores running on stock Salla / Shopify / WordPress without a CMP installed. Every platform we tested ships defaults with tracking enabled and no consent layer at all.
Finding 348%
48% run Google tags with no Consent Mode v2
GCM v2 is the modern way to signal consent state to Google's ad ecosystem (Ads, Analytics, Tag Manager). Without it, even stores that DO have a banner end up signaling "consent granted" for every visitor regardless of what they clicked — which Google now penalizes by withholding bid signals in the EEA. KSA isn't EEA, but Google Ads accounts spanning both get clipped globally. The fix is one config block in Tag Manager.
Set up a consent banner and Google Consent Mode v2 on your platform: Salla · Zid · Shopify · WordPress
Top trackers detected
Trackers that show up on most stores
Google Analytics
59%920/1556
Facebook Pixel
29%452/1556
Hotjar
6%99/1556
Google Tag Manager
1%13/1556
Google
1%9/1556
Microsoft Clarity
0%7/1556
Intercom
0%4/1556
jsDelivr CDN
0%4/1556
Cloudflare
0%4/1556
Klaviyo
0%3/1556
Google Analytics on 59% of stores, Meta Pixel on 29% — that's the entire visible tracking surface for most Saudi e-commerce. What this list is missing isn't more trackers; it's the trackers we couldn't see. Server-side forwarding, custom-domain Meta CAPI endpoints, first-party analytics — these don't show up in a client-side scan, but they're where the modern stack is heading. The headline: 62% of stores have no server-side event forwarding at all.
Why this matters now
The grace period is over
Saudi Arabia's Personal Data Protection Law (PDPL) took full effect on September 14, 2024. SDAIA — the Saudi Data and Artificial Intelligence Authority — confirmed 48 enforcement decisions against violators in its January 2026 announcement. The two-year buildup of advisory communication is over; enforcement is the operating mode.
Administrative fines up to SAR 5,000,000
The ceiling doubles to SAR 10,000,000 for repeat violations. Prison is a separate, criminal track: up to 2 years and a fine of up to SAR 3,000,000, for disclosing sensitive personal data with intent to harm or for personal gain.
48 enforcement decisions, confirmed by SDAIA
SDAIA's specialised committees issued 48 decisions against violators, confirmed in SDAIA's January 2026 announcement. Retail was explicitly named among the most-affected sectors.
PDPL + GDPR, simultaneously
Any KSA store reaching EU visitors must comply with BOTH. Most we scanned comply with neither cleanly.
5
days to respond once notified of an alleged violation
of internet users in Saudi Arabia made an online purchase; internet penetration is 99.6%. Both figures are from CST’s Saudi Internet Report 2025 as reported by Arab News; CST’s own release did not show them.
Advanced Consent Mode recovers twice as much, on average, as basic mode, which recovers more than half of lost conversions (Google’s own figure, undated)
The gap between 49/100 and 90/100 isn't expensive. It's three configuration changes most stores can ship in an afternoon.
Fire pixels AFTER consent, not before
Set Google Consent Mode v2 to default-denied. Configure your CMP to call gtag('consent','update', …) on banner interaction. Result: pixels only fire when the visitor agrees.
⏱ Time to fix: 20–40 min
Ship a PDPL-tuned consent banner
Bilingual (Arabic-first for KSA visitors), three choices (Accept / Reject / Customize), defaults to denied, logs the consent decision per visitor. Most CMPs ship this out of the box once configured for the KSA / GDPR-strict regime.
⏱ Time to fix: 1–2 hours
Publish a PDPL-localized privacy policy
Cover the seven mandatory disclosures: data collected, lawful basis, retention, sharing, data subject rights, contact info, transfer outside KSA. Link from the footer. A boilerplate template won't pass — it has to name your actual processors and lawful basis per data type.
⏱ Time to fix: 2–4 hours
Want the free PDPL banner shipped for you?
Arqam360's free tier gives you the banner forever — no signup, no card.
• Real browser (Puppeteer) loads each store homepage
• We detect cookies, trackers, consent banner, GCM v2 status
• Score 0-100 against PDPL + GDPR criteria
• Inconclusive when a store blocks our scanner (CF/DataDome)
• September 2026 edition: 1,556 storefronts scanned, 1,496 scored, 60 inconclusive. Data aggregated 7 September 2026.
• Sample: Saudi storefronts (.sa domains and Salla- and Zid-hosted stores) drawn from Common Crawl's public URL index and kept only where the site showed signs of a working shop, plus a hand-curated list of known Saudi stores
• Homepage only. Every percentage uses all 1,556 scanned storefronts as its denominator; scores exclude inconclusive scans
What this scan can't tell us
• Whether the store has proper backend protections (data-deletion workflows, DSAR pipelines, vendor agreements)
• What's collected once a visitor logs in or completes checkout
How many Saudi online stores track visitors before consent?
In the September 2026 edition of the KSA Index, 1,065 of 1,556 Saudi storefronts scanned (68%) had tracking scripts firing before any consent. The scan covers homepages only, client-side.
How many PDPL enforcement decisions has SDAIA issued?
SDAIA confirmed 48 enforcement decisions in its January 2026 announcement, as summarised by Profectus and Clyde & Co.
What is the maximum PDPL fine in Saudi Arabia?
Administrative fines of up to SAR 5,000,000, which may be doubled to SAR 10,000,000 for repeat violations (Profectus; Clyde & Co).
How was the KSA Index measured?
A real browser loaded each storefront homepage and recorded cookies, trackers, the consent banner and Google Consent Mode v2 status, then scored each store 0–100 against PDPL and GDPR consent criteria. Homepage-only and client-side only.
For journalists and researchers
Cite this report
Figures change between editions, so please cite the edition. The copy button fills in today's date.