Cookie Consent and Privacy Pages for UAE Websites (2026): What the Law Actually Says

Frequently asked questions

• Does my UAE website legally need a cookie banner?

  No UAE source we could find names cookies as a separately regulated category, and no UAE rule requiring prior consent before a cookie fires was found. That is not the same as saying anything goes. The general rule under the PDPL is that processing personal data needs consent, so if a cookie collects an identifier or an IP address, the consent principle reaches it. The obligation flows from that general rule, not from a cookie-specific law.

• I copied a cookie banner script from another site and never configured it. Is that a problem?

  It is a practical problem rather than a confirmed legal one. An unconfigured banner does not satisfy any UAE rule we could confirm, because no cookie-specific rule was found. It also shows visitors an accept or reject choice that changes nothing behind the scenes. Google and Meta both require deliberate developer work before their tags respect a reject click. So the banner promises control the site does not deliver.

• Can I copy a European privacy policy and change the company name?

  You should not. A European policy is written around legal bases, rights and regulators that come from EU law. The UAE PDPL is built around consent and does not offer the same broad fallback bases. A copied policy will also name an EU supervisory authority that has no role here, and promise rights in wording that may not match UAE law. Write the notice around what your site actually does, then have a qualified adviser check it.

• What is the UAE PDPL and when did it start?

  The Personal Data Protection Law is Federal Decree-Law No. 45 of 2021, and the government portal states it has been in force since 2 January 2022. It applies to the processing of personal data, in full or in part, through electronic systems, inside or outside the country. That last phrase matters for websites, because almost everything a website does with visitor data is processing through an electronic system.

• What counts as personal data under the PDPL?

  Information that can identify a person. Names, phone numbers, email addresses and account details are the obvious cases. For a website the less obvious cases matter more, because analytics and advertising tools routinely collect IP addresses and device or browser identifiers. If a cookie or a script stores something that can be tied back to an individual, treat it as personal data and treat the consent principle as applying to it.

• Is consent the main legal basis under the PDPL?

  Consent is central. The government summary states the law prohibits processing personal data without the consent of its owner, except in some cases where processing is necessary to protect a public interest or to carry out legal procedures and rights. There is no broad legitimate interests fallback of the kind some businesses lean on elsewhere. That is why a copied European policy tends to justify processing in a way that does not translate here.

• Which PDPL rights are confirmed on the official government page?

  Two are named there directly. The right to request corrections of inaccurate personal data, which is rectification, and the right to restrict or stop the processing of personal data. Those two we can point to on the government portal. The full statute may contain more, but we are not going to assert rights we could not confirm on an official page. Take the complete rights list to a qualified legal adviser before you publish it.

• Do I have a right to receive a copy of my data under UAE law?

  We could not confirm that right on the official government summary of the federal PDPL, which names only rectification and restriction. That is an absence of confirmation, not proof the right does not exist in the full statute. DIFC is different. DIFC data protection law explicitly gives a right to obtain a copy of the data held about you, but DIFC law applies only to companies licensed in DIFC, not to UAE businesses generally.

• How many hours do I have to report a data breach?

  No fixed number of hours is set in the federal law. The PDPL uses the word immediately, and the Executive Regulations that would fix a precise deadline have not been published. So if you read a confident seventy-two hour figure for the federal PDPL, treat it as imported from elsewhere. The practical answer is to build a breach process that can move within a day, because a tight deadline is the likely outcome.

• What is the fine for breaching the federal PDPL?

  No federal fine schedule has been published. The penalties are due to come through a separate Cabinet decision, and as of 2026 that schedule is still pending. Any specific dirham figure you see quoted for a federal PDPL breach is somebody's estimate rather than an official number. The absence of a published fine is not the same as the absence of a legal duty, though. The law itself is in force.

• Does having a cookie banner make me PDPL compliant?

  No. A banner touches one narrow slice of one issue. It says nothing about whether your privacy notice is accurate, whether you can actually honour a correction or restriction request, how long you keep data, who inside your business can see it, or what happens when there is a breach. Plenty of sites with a banner would fail on every one of those points. The banner is the smallest part of the work.

• Do I need separate consent for Google Analytics and Meta Pixel?

  You need your consent mechanism to actually control both, which is not the same as showing one banner. They are separate tools with separate implementations. Google offers a consent mode that your banner has to be wired into. Meta Pixel documentation describes what the pixel collects but leaves consent handling to the site owner. Wiring one and forgetting the other is a common outcome, and it is easy to miss because nothing visibly breaks.

• What does Google Analytics collect if a visitor clicks reject?

  It depends entirely on whether your site is wired into Google Consent Mode. If it is not, a reject click usually changes nothing, because the tag fires the way it always did. Google states plainly that consent mode does not provide a consent banner or widget, and that it interacts with your banner instead. Someone has to connect the two. Installing a banner plugin on its own does not do it.

• What is Google Consent Mode?

  It is Google's mechanism for telling Google tags how to behave based on a visitor's consent choice, using signals such as ad storage, analytics storage, ad personalisation and ad user data. In basic mode, a denied consent blocks the tags and no data reaches Google at all. In advanced mode, tags still load with defaults set to denied and send cookieless pings carrying a timestamp, browser details, referrer and the consent state.

• What does the Meta Pixel actually track?

  Meta's own developer documentation describes HTTP header data including IP address, browser information, page location and referrer, plus the pixel ID and the Facebook cookie, button click data covering which buttons were clicked on which pages, and form field names. Field values are not sent unless the site owner explicitly opts into advanced matching. That is a defined set of data collected by default, which is worth knowing before you argue your site collects nothing.

• I have no privacy policy at all. How exposed am I?

  There is no published federal PDPL fine to point at, so nobody can hand you a number. Your exposure is more practical. You have nothing to show a visitor, a partner or a corporate buyer who asks how you handle data, and enterprise procurement teams increasingly ask. Consumer protection law also already places duties on suppliers around consumer data and disclosure, and that law is live and enforceable today.

• What does the UAE Consumer Protection Law require from an online store?

  Federal Law No. 15 of 2020 on Consumer Protection, as amended by Federal Decree-Law No. 5 of 2023, requires suppliers to protect consumer privacy and data security and to refrain from using consumer data for promotional and marketing purposes without a proper basis. For e-commerce it also requires disclosure of the licensing entity, Arabic language product and contract information, specifications, payment terms and warranty terms. That is a present duty, not a future one.

• What are the penalties under the Consumer Protection Law?

  The official government summary describes fines reaching up to two million dirhams and imprisonment of up to two years for certain offences, including misleading pricing, providing false information, and failing to repair or replace a defective product. That is a published schedule, unlike the federal PDPL position. If your store leans on vague claims or hides its return terms, this is the law that has teeth right now.

• My company is in DIFC. Does the federal PDPL apply to me?

  No. DIFC has its own regime under DIFC Law No. 5 of 2020, supervised by the DIFC Commissioner of Data Protection. It applies to DIFC establishments, meaning entities established, licensed, registered or authorised to operate or conduct activity within or through the DIFC. If your licence is in DIFC, that is your law, and building your policy around the federal PDPL means you are compliant with the wrong statute.

• My company is in ADGM. Same question.

  Same answer, different zone. ADGM enacted its Data Protection Regulations 2021, replacing the 2015 regulations, and set up an independent Office of Data Protection headed by a Commissioner of Data Protection. ADGM states the regulations apply to entities established in ADGM that process personal data, or that process in the context of the activities of an ADGM establishment. So an ADGM licence means ADGM rules, not the federal PDPL.

• My company is in DMCC or IFZA or JAFZA. Which law applies?

  The federal PDPL. Only DIFC and ADGM operate their own separate data protection regimes with their own regulators. Every other free zone, along with mainland companies, sits under the federal law. This trips people up because free zone marketing often blurs the difference. The check is simple. Look at the licence, and if it does not say DIFC or ADGM, plan around the federal PDPL.

• Do DIFC and ADGM publish their own penalties?

  Yes, both zones publish their own penalty structures, unlike the federal PDPL where the schedule is still pending. We are not quoting specific figures here because we could not re-verify current numbers directly with either authority in this round of research, and these schedules do get updated. If you are licensed in DIFC or ADGM, get the current figures from the relevant authority rather than from a blog.

• I have visitors from Europe. Does GDPR apply to my Dubai business?

  It can, under the GDPR's own territorial scope rule. Article 3 reaches a controller or processor not established in the EU where processing relates to offering goods or services to people in the EU, or to monitoring their behaviour while that behaviour takes place in the Union. Ad tracking against EU visitors can count as monitoring. This is EU law describing its own reach, not something UAE law imposes on you.

• When does GDPR not apply to a UAE business?

  Random traffic from an EU IP address does not put you in scope on its own. The Article 3 trigger is about offering goods or services to people in the EU or monitoring their behaviour there. A Dubai clinic serving UAE residents, priced in dirhams, with no EU targeting and no EU tracking, is a long way from that trigger. Plenty of UAE small businesses are sold GDPR compliance they do not need.

• Do I need a cookie policy as a separate page?

  No UAE rule we found mandates a cookie policy at all, let alone as a separate page. Many sites publish one anyway, and there is a good reason to. Writing down every tool you run and what it collects forces someone to actually check, which is how unconfigured banners and forgotten tracking scripts get found. Treat it as a transparency and housekeeping exercise rather than a statutory checkbox.

• What should a privacy notice tell a UAE website visitor?

  In plain language: what personal data you collect, why you collect it, who you share it with, roughly how long you keep it, and how someone contacts you to have inaccurate data corrected or to ask you to restrict processing. Those last two map to the rights confirmed on the official government page. Write it around what your site genuinely does, then have a qualified adviser review the wording before it goes live.

• What should my terms of use cover?

  There is no UAE statutory template we found for terms of use. Whatever you write has to sit consistently with consumer protection law, which means accurate representations, terms you can actually enforce, and Arabic availability of contract information for consumers on an e-commerce site. A copied set of terms from a foreign site tends to fail on all three. This is drafting work for a qualified legal adviser, not something to generate.

• My Google Ads account warns me about consent signals. What is that?

  That is Google's own platform requirement, not a UAE legal one. Google is telling you that your site is not sending it clear consent signals from a properly wired banner. Ignoring it affects your measurement quality and your standing with the ad platform. It is worth fixing on its own terms, but do not let anyone convert a Google product notice into a claim that UAE law requires a banner.

• Is no banner better than a broken banner?

  Neither maps to a confirmed UAE cookie violation, so this is about honesty rather than law. No banner is at least a truthful state. Nothing on the page claims to give the visitor a choice. A banner that was never configured displays a working control that does not exist, and anyone who checks what fires after a reject click can see the gap. That is the worse position to be in.

• I am selling into Saudi Arabia. Does that change things?

  It adds a separate set of questions rather than changing your UAE position. Saudi Arabia has its own data protection law and its own e-commerce and consumer protection regime, and Saudi VAT sits at fifteen percent against the UAE's five. Our Saudi guide covers the commercial and consumer side. If you process Saudi residents' data at any scale, treat Saudi data protection as its own review with its own adviser.

• Can a foreign company with no UAE office be caught by the PDPL?

  The stated scope covers processing of personal data, in full or in part, through electronic systems, inside or outside the country. On that wording a foreign online store selling to UAE shoppers is within reach even with no local office. This is the mirror image of the GDPR question. Every serious data protection law now claims some reach beyond its own borders, which is why location alone settles very little.

• Who enforces the PDPL day to day?

  The UAE Data Office was the original federal regulator, established under Federal Decree-Law No. 44 of 2021. In June 2026 it was brought into a new Federal Authority for Artificial Intelligence and Data, which is expected to publish the pending Executive Regulations and take enforcement forward. Our PDPL compliance guide covers the regulator, the Executive Regulations timeline and the six month compliance window in more depth.

• Does ISO 27001 certification satisfy my PDPL obligations?

  It covers the security side well, because the PDPL expects appropriate technical and organisational measures and an information security management system gives you documented evidence of exactly that. It does not cover the rest. Consent, privacy notices, handling correction and restriction requests, and breach reporting are legal duties that no security certification addresses. Treat the certification as a strong foundation rather than a finished compliance programme.

• What is the most common mistake with UAE privacy pages?

  Two, and they usually appear together. The first is a European style privacy policy pasted in whole, promising rights and naming regulators that do not apply here. The second is a consent tool installed and never connected to the tags it is meant to control, so the reject button is decorative. Both come from the same root cause, which is treating this as a page to install rather than a decision to make.

• How much does this cost to sort out?

  The engineering side is normal website work. A focused business site build starts from around AED 3,500, and wiring an existing banner into your tags properly is usually a small piece of work on top of an existing site. Final pricing depends on scope. Drafting the policy wording itself is a legal question for a qualified adviser rather than something we sell, and we will say so rather than pretend otherwise.