Real-browser scan of 2,103 Gulf websites finds most track visitors without asking

Most sites track before anyone asks

A scan that loaded 2,103 Gulf websites in a real browser found that most of them begin tracking visitors without ever showing a consent banner. The results were published on dev.to by Taha Farhane, founder of Arqam360, a company that builds consent tooling for businesses in the region.

The work covers 1,556 Saudi online stores scanned in September 2026 and 547 UAE business websites on .ae domains scanned in October 2026. Each homepage was loaded once in Puppeteer, which drives a real Chromium browser, while the scanner recorded every cookie set and every third-party tracker that loaded.

The legal backdrop is what makes the numbers notable. According to the post, Saudi Arabia's Personal Data Protection Law has been fully enforceable since September 2024, and the regulator SDAIA confirmed 48 enforcement decisions in a January 2026 announcement, with marketing conducted without consent named as one of the violation categories. The UAE has its own data protection law.

The numbers

For Saudi Arabia:

• 935 stores, or 60%, run trackers and display no consent banner of any kind.
• 1,065 (68%) begin tracking before the visitor has made any choice.
• 751 (48%) run Google Analytics or Tag Manager with no Google Consent Mode v2 signal.
• Google Analytics appears on 920 stores (59%); Meta Pixel on 452 (29%).

For the UAE:

• 279 sites (51%) run trackers with no consent banner.
• 287 (52%) track before any choice is made.
• 223 (41%) run Google tags with no Consent Mode signal.

The author deliberately avoids ranking the two countries against each other. The samples are different populations — online stores on one side, general business websites on the other — and the UAE list covers only part of the .ae namespace, since each domain it contains begins with a digit or the letter "a". Every figure is meant to stand alone.

Why the missing banner is the finding

Most consent fights in Europe are about banner design: dark patterns, a "Reject all" button that is hard to find. In the Gulf, the post argues, the problem happens one step earlier. On most sites in the sample there is no banner to argue about — data is already on its way to Google and Meta from the very first page view.

How it was done, and what it cannot see

For every site, the scanner checked three things: whether any tracker fired before the visitor made a choice, whether a consent banner appeared at all, and whether Google tags sent a Consent Mode v2 signal. Sites that blocked the scanner were marked inconclusive rather than counted as failures.

The limitations are stated up front: only homepages were tested, and only from the client side. No checkout pages, server-side processing, contracts or internal procedures were examined. A weak result points to consent practice at the storefront, not a verdict on legality. No individual site is named and no store-level results were published. The underlying datasets have been released openly on Zenodo under a CC BY 4.0 licence, so the numbers can be checked independently.

One caveat the post discloses itself: Arqam360 sells consent software, the exact product category that stands to gain from findings like these, and the article was written with an AI assistant from the company's own data and method. The open data release is the offered mitigation.

Why it matters

The gap cuts in two directions. Legally, Saudi fines reach SAR 5 million, rising to SAR 10 million for repeat violations, and SDAIA has already shown a willingness to act. Functionally, under Google Consent Mode v2, tags that fire with no consent signal can lose measurement and advertising capabilities for traffic coming from regions where consent is required — so non-compliant sites may be quietly degrading their own analytics and ad performance. And as the post points out, simply adding a banner does not close the gap: the tags must hold off until the visitor answers, and the choice itself has to be recorded. For Gulf e-commerce, consent infrastructure is starting to look less like a European import and more like basic operating plumbing.