Turn first-party consent
into ad performance.
A guide for ecommerce + app teams running paid acquisition in MENA. Pixel-based audiences are degrading on every channel — Apple, Google, and the new MENA privacy regimes are all pushing the same direction. Consent-event audiences are the replacement: built from events that fire only when the visitor has given explicit consent, with the consent state, event signal, and resolved identity riding along.
Why pixel audiences are failing
Three forces, same direction.
Apple, Google, and MENA regulators are independently pushing toward the same outcome: tracking without explicit consent stops working. The data isn't getting "less accurate" — it's becoming structurally unavailable.
Most users opt out of ATT.
App Tracking Transparency makes cross-app tracking opt-in. Industry trackers consistently report opt-in rates around 25%, meaning the majority of iOS users are invisible to pixel-based attribution.
Adjust ATT reportConsent Mode v2 is now required.
Without Consent Mode v2, Google Ads cannot attribute conversions from users who haven't opted in. Modeled conversions and audience eligibility both depend on the consent signal arriving with the event.
Google Ads · Consent Mode v2Five active regimes.
Saudi PDPL is in active enforcement (since 2024). UAE Federal Decree 45 of 2021, Egypt Law 151 of 2020, Bahrain Law 30 of 2018, and Oman Royal Decree 6 of 2022 all require explicit consent before processing.
SDAIA · Saudi PDPLPixel-based audiences are degrading. Consent-event audiences are the replacement — and they happen to be exactly what every regulator now requires.
The definition
A consent-event audience, in one sentence.
An audience built from events that only fire after the visitor gives explicit consent — every record carries the consent state, the event signal, and the resolved identity. That's it.
Explicit per-category record (necessary, analytics, marketing). Stored, audit-logged, and replayable on demand.
The behavior that matters — purchase, add-to-cart, lead, signup — captured at the moment it happens, gated by consent.
Anonymous device ID stitched to known identity (email, userId) deterministically when available.
How it works
The 5-step workflow.
The same flow on web and mobile. One SDK call per surface. Every step inherits the consent state from the previous one — there's no "where do I attach the consent?" question, because consent is the spine.
Step 1
Capture consent.
A bilingual consent banner fires before any analytics or marketing tag loads. Per-category toggles (necessary, analytics, marketing). The result is a per-visitor consent record with timestamp, IP, regulation context, and method.
Banner script loads before any tag. Auto-detects language from browser, jurisdiction from IP.
Native SwiftUI sheet (iOS) or Material 3 dialog (Android). Same toggle vocabulary, native UX.
We use cookies to improve your experience.
إعدادات الخصوصية
Privacy preferences
Powered by Arqam360
Step 2
Capture events.
Once consent is granted, events flow. The SDK auto-fires standard events (page_view, purchase, add_to_cart, lead) and accepts custom calls. Every event is gated by consent state — analytics events fire only when analytics consent = granted, same for marketing.
dataiq.track('purchase', { value: 240, currency: 'SAR' })
Arqam360.shared.track(name: 'purchase', properties: ['value': 240])
Step 3
Stitch identity.
Anonymous device IDs are merged into known identities the moment the user logs in or completes a transaction. Deterministic match (email, userId) is preferred — same user across devices without leaking any data they didn't already give you.
dataiq.identify('user_123', { email })
Arqam360.shared.identify(userId: 'user_123', email: email)
Step 4
Build the segment.
Combine consent state with event criteria in a visual rule editor. No SQL. Common shapes:
- Repeat purchasers —
consent.marketing = granted AND events.purchase ≥ 2 in 90d - High-intent abandoners —
events.add_to_cart in 7d AND no events.purchase - GCC-only —
country in [SA, AE, KW, QA, BH, OM]
Step 5
Sync to ad platforms.
Audience members are forwarded server-side to the destinations you've connected. Every event carries the consent flags and the resolved identity, so each platform gets the strongest possible match signal — and respects opt-outs at the source.
10 destinations supported:
Meta CAPI · GA4 · Server-side GTM · Google Enhanced Conversions · TikTok · Snap · LinkedIn · HubSpot · Mixpanel · BigQuery
Sources
PROCESS
Destinations
Web + mobile, same engine
One dashboard, one routing engine. Two SDKs.
Whether the event comes from Salla, Zid, Shopify, WordPress, a custom site, an iOS app, or an Android app — it lands in the same consent ledger, the same identity graph, the same segment builder, the same audience destinations.
Web
One-line script tag. Native install on Salla, Zid, Shopify, and WordPress (no developer needed). Custom HTML for everything else.
- Salla App Store
- Zid App Store
- Shopify App Store
- wordpress.org
- Custom HTML / GTM
Mobile
Native iOS and Android SDKs, MIT licensed, under 100KB compiled. Apple Privacy Manifest + Play Data Safety + Saudi PDPL templates included.
- iOS SDK · Swift + SwiftUI
- Android SDK · Kotlin + Compose
- SPM · CocoaPods · Gradle
- Privacy Manifest auto-generated
- ATT + Play Data Safety wired
What changes when you ship this
Three concrete improvements.
No invented numbers. Each claim links to the platform's own documentation — these are improvements ad platforms publish themselves when consent state and identity ride along with each event.
Attribution recovery via Consent Mode v2.
Without Consent Mode v2, Google Ads loses conversion data from users who haven't opted in. With Consent Mode v2 wired correctly, Google models the missing conversions using aggregate, privacy-safe signals — recovering a meaningful share of lost attribution.
Google · Consent Mode v2 modelingHigher Event Match Quality on Meta CAPI.
Meta scores each event by the strength of the identity signal that arrives with it. Server-side events with email + phone + external ID + consent state hash to a higher Event Match Quality score than pixel-only events, which means more events deduplicate and attribute correctly.
Meta · Event Match QualityCleaner audiences — bots and unconsented traffic excluded.
Pixel-based audiences include every visitor the pixel could fingerprint, which means bot traffic, scrapers, and users with no real intent end up in your remarketing pools. Consent-event audiences only include visitors who explicitly opted into marketing — smaller pool, higher conversion rate, lower CPA.
How to install
One line of code per surface.
Same dashboard for all three. Same audience builder. Same routing rules.
<script data-key="ak_..." src="https://cdn.arqam360.com/widget-v2.js"> </script>
import Arqam360 Arqam360.shared.configure( apiKey: "ak_..." )
Arqam360.configure( this, apiKey = "ak_..." )
v0.1.0 mobile SDKs are public on GitHub under MIT, feature-complete, with tagged releases held for one round of integration testing on real devices.
Three ways to take the next step.
Every option below is reversible. The free scan takes about a minute, the trial requires no credit card, and a founder reply lands in under 24 hours.
Run a free scan
Get a one-page report on your site's consent gaps in about a minute. No signup.
Start scanningStart free trial
14 days, no credit card. Install the widget in 5 minutes, see your first consent records in the dashboard.
Create accountTalk to the founder
Email admin@arqam360.com. Real human reply within 24 hours, no scheduler middleware.
Send a note