Cookie Policy: A Ready-to-Use Template for Your Website Under Saudi PDPL
A copyable cookie policy template, written in Arabic first with an English version, covering what Saudi Arabia's Personal Data Protection Law expects from a company website or online store that uses cookies and tracking tags. Fill in the square brackets, remove what does not apply to your site, and publish it.
Short answer
What is a cookie policy, and does my website in Saudi Arabia need one?
A cookie policy tells visitors which cookies and trackers your site sets: each cookie, who sets it, its purpose, how long it lasts, and how to withdraw consent. A Saudi site running analytics or advertising tags needs one in practice, because PDPL requires explicit, informed consent with each purpose explained. It complements your consent banner rather than replacing it.
Before you copy
What must a PDPL cookie policy say?
PDPL treats a cookie that can identify a visitor, directly or indirectly, as personal data, and requires explicit, informed consent before it is processed unless another legal basis applies. Consent is only informed if the visitor knows what they are agreeing to — that is the policy's job. A policy aligned with PDPL answers six questions:
- 01
Who is collecting the data?
The registered name of the business and how to contact it about personal data.
- 02
Which cookies are used?
A list of every cookie on the site, grouped by purpose — not a general line about "improving your experience".
- 03
For what purpose, and on what basis?
The purpose of each category, and that non-essential categories only run with the visitor's consent.
- 04
Who receives the data, and where is it processed?
The third parties that set cookies on your site, and whether data leaves the Kingdom, since PDPL restricts cross-border transfers.
- 05
How long does it last?
How long each cookie lasts, and how long the visitor's choice is kept before they are asked again.
- 06
How can the visitor change their mind?
Where to find the settings to withdraw consent, and how to exercise the rights to access, correct and delete their data.
This template is a starting point, not legal advice. Check it against how your site actually processes data before you publish it.
The template
Cookie policy template
Everything in [square brackets] is a blank for your business's details. The four categories are the same as the Arqam360 consent banner's: necessary, analytics, marketing and preferences.
Cookie Policy
Last updated: [date of last update]
1. Who we are
This policy explains how [website or business name] ("we") uses cookies and similar technologies on [website URL]. The organisation responsible for processing your data is [registered legal name], commercial registration number [CR number], of [address]. To contact us about this policy or your personal data: [privacy email address].
2. What cookies are
Cookies are small text files your browser saves on your device when you visit a website. We also use similar technologies, such as pixels, tracking tags and browser local storage, and in this policy we call all of them "cookies". Some of these can identify you directly or indirectly, so we treat them as personal data under Saudi Arabia's Personal Data Protection Law (PDPL).
3. The categories we use
We group the cookies on our site into four categories:
- Necessary: the store cannot work without them — keeping your cart, signing you in, protecting the site, and remembering your cookie choice. They are always on and cannot be switched off in the cookie settings.
- Analytics: help us understand how visitors use the site, such as which pages are visited most and where visits come from. They only run after you consent.
- Marketing: used to show you ads closer to your interests and to measure our ad campaigns, and may be set by advertising platforms we work with. They only run after you consent.
- Preferences: remember your choices, such as language and display settings. They only run after you consent.
4. Cookies used on our store
[Insert a table of every cookie your site sets, with five columns: cookie name, who sets it, category, purpose, and how long it lasts.]
[Example row: cookie name | provider | Analytics | purpose | duration]
5. Legal basis
We rely on your consent to run analytics, marketing and preference cookies, and we do not run them before you consent. For necessary cookies we rely on [the legal basis you rely on, confirmed with your legal adviser].
6. Who receives the data
Some cookies collect data on behalf of organisations we work with: [names of providers, such as analytics and advertising providers and the website or store platform]. This data may be processed outside Saudi Arabia, in [countries or regions], with the following safeguards: [safeguards applied to transfers outside the Kingdom].
7. How long we keep it
Each cookie lasts for the period shown in the table in section 4. We keep your cookie choice for [consent period, such as 365 days], then ask you again.
8. How to control cookies
On your first visit, a banner lets you accept, refuse, or choose the categories you allow one by one. You can change your choice or withdraw your consent at any time from [where your site's cookie settings are, such as the icon at the bottom of the page]. You can also delete or block cookies in your browser settings; blocking necessary cookies may stop parts of the store from working.
9. Your rights
Under the PDPL you have the right to know the purpose and legal basis of the processing of your data, to access your data, to ask for it to be corrected or deleted, and to withdraw your consent at any time. To exercise any of these rights, email [privacy email address] or use [link to your data request form], and we will reply within [response time]. You may also file a complaint with the Saudi Data and AI Authority (SDAIA).
10. Changes to this policy
We may update this policy when the cookies we use change, and we publish the date of the last update at the top. [If we add a new category or change the purpose of an existing one, we will ask for your consent again.]
Contact: [privacy email address] · [phone number]
Policy generated with Arqam360: arqam360.comAfter you copy
Three steps to make the policy true for your site
- 01
Fill section 4 from a real scan
Do not write the cookie list from memory. The free scanner opens your site, lists the cookies and trackers it finds sorted into the same four categories, and marks anything it cannot match as unknown.
Scan your site free - 02
Complete your privacy policy
A cookie policy is part of your privacy policy, not a replacement for it. Create an Arabic and English privacy policy with the free generator.
Create a privacy policy - 03
Link the policy from your banner
Visitors should reach the policy from the banner itself. In the Arqam360 banner you add your cookie policy link in the dashboard, and it appears on the banner and in the visitor's settings panel.
Consent banner for Salla stores
FAQ
Cookie policy questions
What is a cookie policy, and does my website in Saudi Arabia need one?
A cookie policy tells visitors which cookies and trackers your site sets: each cookie, who sets it, its purpose, how long it lasts, and how to withdraw consent. A Saudi site running analytics or advertising tags needs one in practice, because PDPL requires explicit, informed consent with each purpose explained. It complements your consent banner rather than replacing it.
What is the difference between a cookie policy and a privacy policy?
A privacy policy covers all the personal data your business collects, from accounts and orders to messages, and the rights people have over it. A cookie policy details one part of that: what your website collects through cookies and trackers. It is part of your privacy policy, not a replacement for it, and can sit on its own page linked from your banner and your privacy policy.
What should I list for each cookie?
Five things: the cookie name, who sets it, its category (necessary, analytics, marketing or preferences), its purpose, and how long it lasts. Also name the third parties that receive the data and where it is processed, because an analytics or advertising platform processing your visitors' data outside Saudi Arabia counts as a transfer out of the Kingdom. Build the list from a real scan of your site, not from memory.
How often should I update my cookie policy?
Whenever the cookies on your site change, for example when you add an app, a tracking tag or an ad platform, and put the date of the last update at the top. Good practice is to rescan your site after each such change and compare the result with your list. If you add a new purpose, ask for consent to it, since consent is given separately for each purpose.
Does my cookie policy need to be in Arabic?
PDPL requires consent to be informed, with each purpose explained before or when you ask, and that only works if visitors understand what they read. So publish the policy in the language your visitors read: Arabic for an Arabic-reading audience in Saudi Arabia, with English alongside if your site serves both. The template on this page comes in both languages.
Does a cookie policy replace the consent banner?
No. The policy explains; the banner asks. The banner has to ask for consent before analytics and advertising tags run and record the answer, and publishing a page that says the site uses cookies is not enough. Link the policy from the banner itself so visitors can reach it before they choose.
Related
Find out which cookies your site sets
The scan is free and only needs your website URL. Its result is what goes in section 4 of the policy.