UAE PDPL Compliance for Marketers: What Your Tracking Pixels Actually Need in 2026

This is not legal advice. If your business handles meaningful volumes of personal data, a lawyer should review your setup. What I can do is read the law as a marketer who has to configure the tags, and turn it into things you can check on your own website. Most PDPL content is written from the legal side and stops before the part where someone has to open Tag Manager.

I have rewritten this post since it was first published. The first version was cautious but vague, and it said GA4 can collect IP addresses, which Google's own documentation says it does not. This version works from the text of the law itself, names the articles so you can check them, and says clearly what is still unsettled.

One practical note about sources. The official text of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data is published in Arabic only, and the UAE government's own page says so. I worked from that Arabic text. Where I describe an article below, the wording is my plain-English paraphrase, not an official translation, so treat the article numbers as your route to the real text.

What the UAE PDPL Means for Your Tracking Pixels

Where the Law Stands: In Force, but Not Fully Switched On

The law was issued in September 2021 and has been in force since 2 January 2022 (Article 31). It created the UAE Data Office as the federal regulator. Article 28 said the Executive Regulations, the detailed rules that explain how to apply the law, were due within six months of issue. In the most recent sources I could open, they had not appeared. A law firm guide from Chambers, updated in March 2026, says the Implementing Regulations "have yet to be issued", that the Data Office is not yet fully operational, and that enforcement has been limited. An older DLA Piper summary said the same as of January 2025.

Two consequences follow from the text. First, Article 29 gives organisations six months from the date the Executive Regulations are issued to bring themselves into line, and the Cabinet can extend that once. So there is no fixed compliance date yet. Second, Article 26 leaves penalties to a later Cabinet decision, so I will not quote fines, and you should be wary of anyone who does.

Please treat my summary of the regulations' status as a snapshot. I could not open the official legislation portal from my tools, and the position can change. Before you rely on it, check the UAE Legislation portal and the Official Gazette for the current position.

I would not read that gap as a reason to wait. The obligations in the law are already in force, the rules on consent and defaults are cheap to follow now, and it is much easier to fix a tracking setup before a regulator or a customer asks about it.

Who the Law Covers, and Who It Leaves to Other Rules

Article 2 applies the law to the processing of personal data by three groups: data subjects who live or work in the UAE, controllers and processors located in the UAE, and controllers and processors located outside the UAE who process the data of people in the UAE. In practice that means a company abroad that markets to UAE visitors is in scope, and so is a UAE company tracking visitors from anywhere.

Article 2 also lists what it does not apply to. The list includes government data and government bodies, data held by security and judicial authorities, data an individual processes for personal purposes, health data and banking and credit data that have their own legislation, and companies in free zones that have their own data protection law. The UAE government's data protection page names one such regime: the Data Protection Law of the Dubai International Financial Centre, DIFC Law No. 5 of 2020. If you are based in a free zone, find out whether it has its own law, because that law may apply to you instead.

Article 3 lets the Data Office exempt some small establishments that do not process large volumes of personal data, but the criteria come from the Executive Regulations, which are not out yet. Do not assume you are exempt because you are small.

If you run a clinic or another business that touches health information, be more careful still. Health data with its own legislation is outside the PDPL, which means other rules apply, and the UAE government's page lists a federal law on ICT in health fields. Get advice before you put any marketing pixel on a page where someone books a treatment or describes a condition.

What Counts as Personal Data, and What Counts as Consent

Article 1 defines personal data as anything relating to an identified person or a person who can be identified directly or indirectly, using identifiers such as name, voice, ID number, "electronic identifier" and geographic location. That wording is wide enough to cover the identifiers that tracking tools use: cookie and device IDs, and location. Whether one particular analytics report contains personal data is a legal question. The safer working assumption for a marketer is that the identifiers your tags set are in scope.

The same article defines consent as specific, clear and unambiguous agreement, given by a statement or a clear affirmative action. Article 6 adds the conditions. You must be able to prove that the person consented. The request must be written in a clear, simple and accessible way. It must tell the person they can withdraw consent, and withdrawing must be easy. A person can withdraw at any time, and that does not undo the lawfulness of earlier processing.

I would not rely on "by continuing to browse you agree" wording, or on boxes that are already ticked, because neither is an affirmative action by the visitor. That is my reading, and it is one to check with a lawyer.

Article 4 is the one that matters most for advertising tags. It prohibits processing personal data without consent, then lists the cases where that is allowed. They include protecting the public interest, data the person has made public, legal claims, certain health and research purposes, protecting the person's own interests, employment matters, performing a contract with the person, and duties under other UAE laws, plus any other cases the Executive Regulations add. As I read the Arabic text, there is no general "legitimate interests" ground like the one in the European GDPR, and none of the listed cases is a natural fit for advertising or remarketing tags. So consent is the route I would plan around. A lawyer should confirm that reading for your case.

Article 17 adds a right for people to object to processing for direct marketing, including profiling connected to it, and to have that processing stopped. In practice that means every marketing channel needs a working way to opt out, not only the cookie banner. The UAE government's page also notes that the Consumer Protection Law, Federal Law No. 15 of 2020, protects consumers' data and prohibits suppliers from using it for marketing. I have not read that law's article, so ask your lawyer how it interacts with your campaigns.

What the Law Asks of Your Setup

Beyond consent, three duties translate directly into tracking work:

Collect what you need and keep it no longer than you need it. Article 5 sets the principles: a specific purpose, only the data necessary for that purpose, accuracy, security, and no retention once the purpose is used up unless the data has been anonymised. Article 7 goes further and asks controllers to set default settings so that processing is limited to the stated purpose, covering the amount and type of data collected, how long it is kept and who can access it. Tool defaults are exactly where marketing accounts drift.

Keep a record. Article 7 also requires a record of processing, including the categories of data, the purposes, retention periods and any cross-border transfers, which you must be able to give the Data Office on request. A simple table of every tag, what it collects, why, and where it sends data is a good start.

Know where the data goes. Articles 22 and 23 set the conditions for sending personal data outside the UAE: a destination with adequate protection recognised through the Data Office, or a contract that binds the recipient to equivalent protections where no such law exists. The details depend on the Executive Regulations. Google, Meta and most other ad platforms are global services. I cannot tell you from the law alone whether a given transfer is permitted, so ask each vendor for its data processing terms and where the data is handled, and keep the answers on file.

What to Check in Each Tool

Consent has to change what fires, not just what the page shows. A banner that appears while every tag runs underneath does not meet the consent conditions above. Google's Consent Mode is one way to pass the visitor's choice to Google tags. Its documentation says you set the default state on every page before any command that sends measurement data, and it covers four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization. It also lets you set defaults by region. Read the limits, though. Google says that when advertising storage is denied, new advertising cookies are not set, but data sent to Google can still include the full page URL. Consent Mode is a signalling system, not a blocker. If your standard is that nothing is sent before consent, block the tag itself in Tag Manager until the visitor has chosen. My Consent Mode v2 setup guide covers the mechanics.

Meta Pixel. Meta's developer documentation gives two calls for this: fbq('consent', 'revoke') before the pixel initialises, on every page, and fbq('consent', 'grant') once the visitor agrees. The same page says each company is responsible for its own compliance. Also review Advanced Matching. It can send hashed customer details with events, such as email, phone number, name, city and other fields, and it can be set up automatically from Events Manager. Check whether it is switched on and whether you want it.

GA4. Google's documentation says IP addresses are not logged or stored in GA4, so the claim I made in the first version of this post was wrong. What you can control is retention and signals. For event data in standard properties, the retention choices are 2 months or 14 months, and the setting does not affect the standard aggregated reports. You can also switch off Google signals and the collection of granular location and device data by region, though Google warns that doing so reduces some modelling and reporting features. Make those decisions on purpose rather than living with whatever the account was created with.

Lead forms and WhatsApp. Data you collect directly, such as names and phone numbers, needs the same thinking: say what you will use it for, record when and how the person agreed, and give them a way out of marketing messages. Do not put personal details in page addresses or campaign tags. Google notes that data sent to it can include the full page URL, so an email address in a link would travel with it. My guides to UTM tagging and tracking WhatsApp leads both keep personal data out of the URL for this reason.

A 30-Minute Audit You Can Do Today

Open your site in a private browser window. Open the developer tools, go to the Network tab, and reload the page without touching the cookie banner. Look at the requests. Addresses that contain facebook.com/tr, google-analytics.com, analytics.google.com, doubleclick.net or googleadservices are ad and analytics tags. Then open the storage or cookies view and look for cookies such as _fbp, _ga and _gcl_au. If they appear before you have made any choice, your consent setup is not controlling anything, whatever the banner says. Take a screenshot as evidence, fix the setup, and repeat the test after every change. Do the same on the mobile version and on any Arabic pages, since a separate template or a different tag setup is a common way for a gap to survive.

What to Do This Week

1. Find out which rules apply to you. Mainland, free zone with its own data law, or a regulated sector such as health or banking. The answer decides whether this post applies at all.

2. Run the audit above and list everything that fires before consent.

3. Rebuild the consent step. Make agreement an affirmative action, make withdrawal as easy as agreeing, and connect the choice to Consent Mode and to the Meta consent calls, or block the tags until the choice is made.

4. Review the defaults. GA4 retention, Google signals, granular location and device data, and Meta Advanced Matching.

5. Start the record. One table with each tag, its purpose, the data it collects, the retention period and where it sends data. Keep proof of consent.

6. Book a legal review for the points I flagged: the no-legitimate-interest reading, cross-border transfers and the Consumer Protection Law.

Frequently Asked Questions

Next Step

I can review the technical side of your tracking setup: what fires and when, what each tool collects, and which settings need a decision. I will also flag where you need a lawyer's opinion rather than a configuration change. Send me your site address and the tools you use through my Google Ads and PPC management service page, and tell me you want a tracking review.

Related reading:

• Google Consent Mode v2 Setup Guide for Dubai Websites Advertising to the EU
• Google Tag Manager 101: Tracking Your Website's Most Important Events
• UTM 101: How to Track Every Click in Dubai (Templates + GA4 Tips)