PDPL WhatsApp Marketing: Consent Rules for Saudi Stores

PDPL WhatsApp marketing comes down to one rule. You need the customer's clear consent before you send a promotion, and you must be able to prove it. Saudi Arabia's Personal Data Protection Law (PDPL) does not accept "they bought from us" as a reason to message them.

This guide is for Saudi online stores, trading companies and sellers planning WhatsApp offers. It is practical guidance, not legal advice. For your own setup, check with a Saudi data protection lawyer.

What does PDPL WhatsApp marketing require from a Saudi store?

It requires three things: consent before the first promo, proof of that consent, and a simple way to stop.

SDAIA's Implementing Regulation (IR) covers direct marketing in Article 29. According to the Implementing Regulation:

• The message must state who is sending it.
• If the person withdraws consent, you must stop sending related marketing materials immediately, without undue delay.
• You must keep material evidence of the recipient's consent to receive marketing materials.

A WhatsApp promotion is direct marketing. It is an electronic message that carries an offer.

Enforcement is real. On 16 January 2026, SPA reported that SDAIA's violation committees issued 48 decisions under Article 36, enforcing the prescribed penalties. The violations included sending advertising and marketing messages to people without their consent. SPA does not say how many of those cases involved WhatsApp, so don't assume it.

The Ministry of Commerce says the same thing for online shops. Its Guide to Consumer Rights 2023 says an online store must not use consumer data for advertising or marketing without first getting the consumer's permission.

Does Meta's opt-in rule cover me in Saudi Arabia?

Meta's rule is a minimum. The PDPL is the stricter test, so you have to pass both.

Meta's page on getting opt-in for WhatsApp says businesses must get opt-in before messaging people. Since the November 2024 update, the opt-in can be general and doesn't have to be specific to WhatsApp. But the business must still comply with all local laws. Meta also lists SMS and in person or on paper as valid ways to collect it.

So a paper form at your Jeddah showroom can work for Meta. It only works for the PDPL if it is clear, specific to marketing and recorded.

Meta also says you must give clear opt-out instructions and honour them. That lines up with the PDPL withdrawal rule below.

Can I message customers who already bought from me?

Not for promotions, unless they also agreed to marketing. A past order does not equal marketing consent.

SDAIA's Guide to the PDPL for controllers and processors says legitimate interest cannot be used as a lawful basis (PDPL Article 6(4)). The guide even gives a retail example. A store collects customer details without consent and uses them for marketing emails. The store has no lawful basis.

Two more points from the same guide:

• Even with consent, sensitive data may not be processed for marketing (Article 26). Don't build offers around health, religion or similar details.
• Individuals can withdraw consent at any time.

Here is a hypothetical case. Say a Riyadh store has 2,000 phone numbers from Salla orders over two years. Those numbers were given to deliver parcels. They are not a marketing list. The store should send a one-time, consent-based invitation only if it has a valid basis to contact them at all, and should ask a lawyer how to handle the old list. Safer still, start a new opted-in list from today.

How do you collect consent that counts?

Ask clearly, ask for marketing on its own, and save the proof. Here is a process you can set up this week.

1. Build the opt-out first. IR Article 12 says that before asking for consent, you must set up procedures for withdrawing it. Withdrawal must be similar to or easier than giving consent.
2. Write the consent wording. Name your store, say you will send promotions on WhatsApp, and say how often if you know. Offer Arabic and English.
3. Use an unticked box or a clear yes button. At checkout on Salla, Zid or your own site, add a separate marketing field. Check what your platform lets you add.
4. Keep marketing separate from order updates. Don't hide the promo permission inside "I accept the terms." This is our practical advice, so that the consent can't be read any other way.
5. Collect in person with a record. At a counter or event, use a form or QR code that captures the same wording, with the number and a date.
6. Save the proof straight away. See the table below.
7. Send a first message that matches what they agreed to. If they signed up for restock alerts, don't send a general sale blast.

What should you record for each contact?

Record enough that you could show a regulator who agreed, to what, when and how. The IR says the evidence must be kept. It does not give a template, so this one is our suggestion.

Keep this in one place your team can search. A spreadsheet is fine for a small store. If several people reply on WhatsApp, Instagram and Messenger, a shared inbox such as Quickship's Meta Messaging Module lets your team see conversations in one view. You still own the consent record, whatever tool you use.

How do you handle STOP requests?

Stop immediately and mark the contact. The IR says that once consent is withdrawn, you must stop sending related marketing materials without undue delay.

• Make "Reply STOP" work on every promo.
• Mark the contact as opted out the same day, in every list you use.
• Treat other wording as a request to stop too, such as "unsubscribe", "no more" or the Arabic equivalent.
• Don't send a "Are you sure?" message that tries to win them back.
• Log the withdrawal date.

Don't make leaving harder than joining. If people signed up with one tap, they should be able to leave with one reply.

What does a compliant promo look like?

It is expected, timely, relevant and short, with one call to action. It also follows Meta's message rules: under 1024 characters, at most one full link with no shorteners, no shouting in capitals and no pressure words.

Here is a hypothetical example for a customer who asked for restock alerts:

Hello Sara, this is Najd Home Store. You asked us to tell you when the black abaya range is back. It is in stock today in sizes 52 to 58. See the range here: [full store link] Reply STOP and we will not message you again.

Why it works:

• It names the sender, as IR Article 29 requires.
• It is tied to something she asked about.
• It has one link and one action.
• It ends with the opt-out line.

Don't send several promos in quick succession. One message when something is relevant is enough.

What are the common mistakes?

• Using old order numbers as a promo list.
• Bundling consent into terms and conditions.
• Pre-ticked boxes. Consent has to be clear, and you must be able to prove it.
• No saved wording. You can't show what the customer saw.
• Ignoring STOP for a few days because the campaign was already scheduled.
• Buying lists. The customer never agreed to hear from you.
• Relying on Meta's opt-in alone. Meta itself says you must comply with local law.

Fix these before your next campaign, not after a complaint.