The Cookie Notice for Your Online Store: What It States Section by Section and Where to Place It

Why your site needs a published notice beside the privacy policy

The main reason is the Personal Data Protection Law issued by Royal Decree M/19 and its amendments. The published text of the law gives the data subject the right to be informed, meaning to be told the legal basis for collecting their data and the purpose of collecting it, allows them to withdraw their consent at any time, and requires the controller to adopt a privacy policy and make it available to data subjects when their data is collected.

We did not find an express reference to cookies in the published text of the law. However, many of these files and tracking tools collect a device identifier and a browsing and purchase history that can be linked to a specific person, and at that point the information may become personal data to which the law applies. The practical way to inform the visitor and let them give and withdraw consent is a published notice and a clear consent banner.

Review your site now, because you most likely need the notice if you find any of the following on it:

• A tool that measures traffic and browsing behaviour, even if it was switched on from the store platform's dashboard.
• Pixels from advertising and social platforms that track who visited the store in order to retarget them with an ad or to measure sales.
• Embedded third-party add-ons such as a chat window, videos, maps and review widgets.
• The platform's own cookies that keep the cart, the login and the chosen language.

What the notice states, section by section

A good notice is short and organised, read by the visitor in minutes, and answers their question without a search. These are the sections most stores and business websites need, in an order that is easy to read:

• A plain definition: what cookies are, and similar technologies such as pixels and local storage in the browser.
• The types the site actually uses: necessary, functional, analytics and marketing.
• The purpose of each type and how long it stays on the visitor's device.
• The third-party tools that place their files through your site, who provides them, and what they use them for.
• How the visitor accepts, refuses or withdraws consent, and where to find the settings link.
• How to change browser settings to delete or block cookies, and how that affects the store.
• The contact channel for any data question, the date of the last update, and a reference to the privacy policy.

Write each section in language an ordinary customer understands, and avoid copying long technical descriptions from tool providers' websites. Most importantly, the notice must match what actually happens on your site. A notice that lists a tool you removed months ago, or leaves out a pixel you added last week, does not serve its purpose.

The four types of cookies, how long each lasts, and third-party tools

By duration, cookies fall into two kinds: session cookies, which are deleted when the browser closes, and persistent cookies, which remain until an expiry date set by the site or the tool provider. By purpose, the common split used in notices is four types:

• Necessary: the store cannot work without them, such as keeping the cart, the login and payment security.
• Functional: they remember the visitor's choices such as language, city and the displayed currency.
• Analytics: they measure visits, the most viewed pages and where visitors come from, in order to improve the site.
• Marketing: they track browsing to show personalised ads or to measure the effect of ad campaigns.

As for duration, do not write general phrases such as an indefinite period. For each type or each tool, state the duration the provider sets in its documentation, and review it whenever the tool is updated. If the duration is long, ask yourself whether you really need it, since many tools allow you to shorten it in their settings.

As for third-party tools, state in the notice the category of each tool, the name of its provider and its purpose, and refer the visitor to the provider's own privacy policy. Note that some of these tools may process data on servers outside the Kingdom, which is a matter with its own rules under the law and its regulations, so review it with your lawyer before switching on any new tool.

How the visitor accepts, refuses or withdraws consent

The notice explains, and the consent banner carries it out. The more cautious approach we recommend is for the site to run with necessary cookies only until the visitor makes a choice, for the accept and refuse options to be equally visible, and for withdrawing consent to be as easy as giving it. This is consistent with the law's rule that a data subject may withdraw their consent at any time.

1. The banner appears on the first visit with three clear options: accept all, refuse non-necessary cookies, and customise choices.
2. In the customise window the visitor chooses each type separately, and no box is pre-ticked except the necessary one.
3. Analytics tools and marketing pixels run only after the visitor chooses them.
4. The visitor's choice and its date are recorded so you can prove consent when needed.
5. A cookie settings link stays visible at the bottom of every page so the visitor can change their mind whenever they wish.

The notice also explains that the visitor can delete or block cookies through their browser settings, and that each browser has its own privacy menu. Point out clearly that blocking necessary cookies may stop the cart or the login from working, so the customer does not assume the store is broken.

Where to place the notice and the consent banner

A notice the visitor cannot find is as good as absent. So spread the access points across the places a customer expects, make sure the Arabic and English versions match, and show the notice in the interface language the visitor is browsing in.

1. The consent banner on the first visit, at the bottom or centre of the screen, without covering the close button or blocking the page from being read.
2. A link to the notice in the footer of every page, beside the links to the privacy policy and the store terms.
3. A link to the notice inside the banner itself, so the visitor can read it before choosing.
4. A short paragraph on cookies in the privacy policy that refers to the full notice.
5. A cookie settings link that is always visible for changing choices later.

If your store runs on a ready-made store platform, the platform itself places its own necessary cookies, and it may provide a ready consent banner or allow you to add one. Ask the platform's support for the list of cookies it places, and make sure the banner actually stops pixels from running before consent, rather than only displaying a message.

How the notice fits with the privacy policy and the store terms

Each of the three documents has a different role. The privacy policy is the parent document: it sets out the personal data the business collects from all sources, the basis for collecting it, the rights of the data subjects, how long it is kept and with whom it is shared. The cookie notice is a specialised document that deals only with the technologies running in the visitor's browser and manages consent to them. The store terms are the contract that governs purchase, payment, delivery and returns.

• Make each document refer to the other two by their correct names.
• Use the same contact channel and the same business name in all three documents.
• Name third-party tools the same way in the privacy policy and the notice so there is no conflict.
• Update the last-updated date in the document you amend, and check the effect of the change on the other two.

Before publishing, make a simple inventory of what actually runs on your site: open the store in a clean browser, check which cookies appear before and after consent, and ask the marketing team about every pixel they added. Then write the notice on that basis. This guide is general information, not legal advice on a specific case, and the Arabic text prevails in case of any difference.

Frequently asked questions