{"id":12920,"date":"2026-10-02T16:33:44","date_gmt":"2026-10-02T14:33:44","guid":{"rendered":"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/"},"modified":"2026-10-02T17:52:53","modified_gmt":"2026-10-02T15:52:53","slug":"consent-mode-tracking-arab-websites","status":"publish","type":"post","link":"https:\/\/voctos.net\/ar\/consent-mode-tracking-arab-websites\/","title":{"rendered":"\u0648\u0636\u0639 \u0627\u0644\u0645\u0648\u0627\u0641\u0642\u0629 (Consent Mode) \u0641\u064a \u0627\u0644\u0645\u0648\u0627\u0642\u0639 \u0627\u0644\u0639\u0631\u0628\u064a\u0629: \u0645\u0627 \u0627\u0644\u0630\u064a \u062a\u0634\u063a\u0651\u0644\u0647 \u0641\u0639\u0644\u064b\u0627 29 \u0635\u0641\u062d\u0629 \u0631\u0626\u064a\u0633\u064a\u0629 \u0644\u0639\u0644\u0627\u0645\u0627\u062a \u062a\u062c\u0627\u0631\u064a\u0629"},"content":{"rendered":"<p>Arab brand websites load ad tags but rarely tell Google about consent. In our crawl of 29 Arab brand homepages on 2 October 2026, a Google tag ran on 20, yet only 3 of those 20 (15%) declared a Consent Mode default. Sixteen ran in Google&#8217;s implicit state, where tags behave as if every visitor said yes.<\/p>\n<blockquote>\n<p><strong>Key takeaways<\/strong><\/p>\n<ul>\n<li>20 of 29 homepages ran a Google tag within 4.5 seconds. 3 declared a Consent Mode default, and only 1 completed the default-then-update flow.<\/li>\n<li>16 of those 20 sites declared nothing, so Google&#8217;s tags treated every visitor as consenting.<\/li>\n<li>Ad pixels were common: Meta on 12 sites, TikTok on 9, Snap on 7, X on 5. Four sites ran all four. A consent platform showed up on 4.<\/li>\n<li>Google requires consent signals for visitors in the EEA, the UK and Switzerland. Saudi, UAE and Egyptian law require a lawful basis and clear notice, but none names Consent Mode.<\/li>\n<li>Egypt&#8217;s one-year transition under the Executive Regulations of Law No. 151 of 2020 ends on 1 November 2026, according to law firm summaries.<\/li>\n<\/ul>\n<\/blockquote>\n<h2>What did we find on 29 Arab brand homepages?<\/h2>\n<p>Ad tags were common and consent signals were rare. Across 29 homepages from Saudi Arabia, the UAE, Egypt, Qatar and Kuwait, 20 ran a Google tag within 4.5 seconds and 11 ran a Google Ads tag. Only 3 declared a Consent Mode default, and 2 of the 4 sites with a consent platform sent Google no default at all.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Signal in the live page (2 Oct 2026)<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Sites<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Base<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Google tag running within 4.5 seconds<\/td>\n<td style=\"padding:12px 16px\">20<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Google Ads (AW-) tag running<\/td>\n<td style=\"padding:12px 16px\">11<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Consent Mode default declared<\/td>\n<td style=\"padding:12px 16px\">3 (15%)<\/td>\n<td style=\"padding:12px 16px\">20 with a running Google tag<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Default and update both ran<\/td>\n<td style=\"padding:12px 16px\">1<\/td>\n<td style=\"padding:12px 16px\">20 with a running Google tag<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Update ran with no default<\/td>\n<td style=\"padding:12px 16px\">1<\/td>\n<td style=\"padding:12px 16px\">20 with a running Google tag<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Implicit state (no default declared)<\/td>\n<td style=\"padding:12px 16px\">16<\/td>\n<td style=\"padding:12px 16px\">20 with a running Google tag<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Consent management platform detected (2 OneTrust, 2 IAB TCF API)<\/td>\n<td style=\"padding:12px 16px\">4<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Meta \/ TikTok \/ Snap \/ X pixel in the page<\/td>\n<td style=\"padding:12px 16px\">12 \/ 9 \/ 7 \/ 5<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">All four ad pixels together<\/td>\n<td style=\"padding:12px 16px\">4<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">GTM container in source, nothing running in 4.5 seconds<\/td>\n<td style=\"padding:12px 16px\">3<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Google tag script served from the brand&#8217;s own domain<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>No market stands out. None of the 6 Saudi homepages with a running Google tag declared a default, though one Saudi retailer sent an update without one.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Country<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Homepages reached<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Google tag running<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Consent default declared<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Saudi Arabia<\/td>\n<td style=\"padding:12px 16px\">9<\/td>\n<td style=\"padding:12px 16px\">6<\/td>\n<td style=\"padding:12px 16px\">0<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">UAE (one regional retailer served its Egypt store to us)<\/td>\n<td style=\"padding:12px 16px\">7<\/td>\n<td style=\"padding:12px 16px\">3<\/td>\n<td style=\"padding:12px 16px\">1<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Egypt<\/td>\n<td style=\"padding:12px 16px\">9<\/td>\n<td style=\"padding:12px 16px\">7<\/td>\n<td style=\"padding:12px 16px\">1<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Qatar<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">1<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Kuwait<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">0<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Total<\/td>\n<td style=\"padding:12px 16px\">29<\/td>\n<td style=\"padding:12px 16px\">20<\/td>\n<td style=\"padding:12px 16px\">3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>All 3 defaults sat on Google Ads sites, leaving 8 of 11 Google Ads sites with none. None of the 4 sites running all four social pixels declared one.<\/p>\n<h2>What is Consent Mode, and how do basic and advanced differ?<\/h2>\n<p>Consent Mode is Google&#8217;s API for telling its tags what a visitor agreed to. You set a default state before any tag fires, then send an update when the visitor answers your banner. GA4, Google Ads, Floodlight and the Conversion Linker read that state and change what they store and send.<\/p>\n<p>Version 2 arrived in November 2023 and added two parameters to the original pair. Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/security\/concepts\/consent-mode\" target=\"_blank\" rel=\"noopener\">Consent Mode overview<\/a> (updated 30 July 2026) describes them as follows.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Parameter<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">What it controls<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">What changes when it is denied<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">ad_storage<\/td>\n<td style=\"padding:12px 16px\">Advertising cookies and device identifiers<\/td>\n<td style=\"padding:12px 16px\">No ad cookies written or read; Ads truncates IP addresses<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">analytics_storage<\/td>\n<td style=\"padding:12px 16px\">Analytics cookies, such as visit duration<\/td>\n<td style=\"padding:12px 16px\">No GA4 first-party cookies; cookieless pings go to Analytics instead<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">ad_user_data<\/td>\n<td style=\"padding:12px 16px\">Sending user data to Google for advertising<\/td>\n<td style=\"padding:12px 16px\">user_id and hashed enhanced conversion data are off<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">ad_personalization<\/td>\n<td style=\"padding:12px 16px\">Personalised advertising<\/td>\n<td style=\"padding:12px 16px\">Remarketing in Google Ads, DV360 and SA360 receives no data<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The two implementations differ in what reaches Google before a choice. <strong>Basic<\/strong> blocks Google tags until the visitor interacts with the banner, so a visitor who declines sends nothing, not even the consent state, and Ads falls back to a general model. <strong>Advanced<\/strong> loads tags at once with your defaults, sends cookieless pings while consent is denied, and earns an advertiser-specific conversion model.<\/p>\n<h2>Is Consent Mode required for sites in Saudi Arabia, the UAE and Egypt?<\/h2>\n<p>Google requires consent signals only for visitors in the European Economic Area, the UK and Switzerland. No Saudi, UAE or Egyptian law names Consent Mode or mandates a cookie banner. Those laws do require a lawful basis for processing personal data and clear notice to the person, and ad pixels process personal data.<\/p>\n<p>This is our reading of official texts, not legal advice. Confirm your setup with counsel.<\/p>\n<ul>\n<li>Google&#8217;s <a href=\"https:\/\/www.google.com\/about\/company\/user-consent-policy\/\" target=\"_blank\" rel=\"noopener\">EU user consent policy<\/a> requires consent from end users in the EEA, the UK and Switzerland on any site under your control. Google Analytics help says that, without those signals, <a href=\"https:\/\/support.google.com\/analytics\/answer\/14275483\" target=\"_blank\" rel=\"noopener\">linked ad audiences have excluded EEA users<\/a> since early March 2024.<\/li>\n<li>In Saudi Arabia, the PDPL and its Implementing Regulation contain no cookie article. SDAIA&#8217;s <a href=\"https:\/\/dgp.sdaia.gov.sa\/wps\/wcm\/connect\/3125da48-43dd-46bc-9156-1f7b91ab8f54\/Elaboration+and+Developing+Privacy+Policy+Guideline.pdf?MOD=AJPERES\" target=\"_blank\" rel=\"noopener\">Privacy Policy Guideline<\/a> (August 2024) asks policies to name cookie data and cookie-based collection, with a purpose and legal basis. Our <a href=\"https:\/\/voctos.net\/saudi-pdpl-marketing-compliance\/\">Saudi PDPL guide for marketers<\/a> covers the detail.<\/li>\n<li>In the UAE, Federal Decree-Law No. 45 of 2021 has applied since 2 January 2022. The government&#8217;s <a href=\"https:\/\/u.ae\/en\/about-the-uae\/digital-uae\/data\/data-protection-laws\" target=\"_blank\" rel=\"noopener\">u.ae summary<\/a> says it prohibits processing personal data without the owner&#8217;s consent, apart from listed exceptions.<\/li>\n<li>In Egypt, the Executive Regulations for Law No. 151 of 2020 were issued in late 2025, according to a <a href=\"https:\/\/www.shandpartners.com\/insights\/briefings\/telecoms-media-technology\/the-issuance-of-the-executive-regulations-of-the-data-protection-law-and-the-establishment-of-the-data-protection-centre\/\" target=\"_blank\" rel=\"noopener\">law firm briefing<\/a> that puts the compliance deadline at 1 November 2026. Check the current status with your counsel.<\/li>\n<\/ul>\n<p>EU visitors count too. A Dubai developer selling to London buyers, or a Saudi retailer with expats browsing from Germany, falls under Google&#8217;s policy for those sessions.<\/p>\n<h2>How do you check any site&#8217;s consent state in two minutes?<\/h2>\n<p>Open the page in Chrome, wait five seconds, and read Google&#8217;s consent object from the DevTools Console. Then confirm in Tag Assistant, which lists an On-page Default and an On-page Update column for each consent type. Together they show whether a default exists, whether the banner updates it, and which pixels load before anyone clicks.<\/p>\n<ol>\n<li>Open the homepage in a clean Chrome profile and leave the banner untouched.<\/li>\n<li>Paste the snippet below into the Console. <code>google_tag_data.ics<\/code> is an undocumented internal object, so treat it as a quick read, not proof.<\/li>\n<li>Run <a href=\"https:\/\/tagassistant.google.com\/\" target=\"_blank\" rel=\"noopener\">Tag Assistant<\/a> on the same URL, select the earliest Consent event, and check that all four parameters were set. Then accept the banner and check the latest Consent event.<\/li>\n<li>In the Network tab, filter for <code>collect<\/code> and look for the <code>gcs<\/code> and <code>gcd<\/code> parameters, which carry the consent state.<\/li>\n<\/ol>\n<pre><code>\/\/ Paste into the DevTools Console after the page settles\nconst ics = window.google_tag_data &amp;&amp; window.google_tag_data.ics;\nconsole.log('default ran:', ics &amp;&amp; ics.usedDefault, '| update ran:', ics &amp;&amp; ics.usedUpdate);\nconsole.log((window.dataLayer || []).filter(e =&gt; e &amp;&amp; e[0] === 'consent'));\nconsole.log({ meta: typeof fbq, tiktok: typeof ttq, snap: typeof snaptr, x: typeof twq });<\/code><\/pre>\n<p>A result of <code>usedDefault: false<\/code> with tags running is the implicit state we saw on 16 sites.<\/p>\n<h2>What is the correct order for the consent default and update?<\/h2>\n<p>The default command must run before the Google tag loads and before any config or event command. Your banner then calls update the moment the visitor chooses, and again on every later page from the stored choice. Google&#8217;s own guide is blunt about order: &#8220;If your consent code is called out of order, consent defaults won&#8217;t work.&#8221;<\/p>\n<p>The snippet below denies everything by default for the EEA, the UK and Switzerland, then applies a second default to every other region, including Saudi Arabia, the UAE and Egypt. The second block is an example policy, not a recommendation for your business. Choose it with counsel.<\/p>\n<pre><code>&lt;script&gt;\n  window.dataLayer = window.dataLayer || [];\n  function gtag(){dataLayer.push(arguments);}\n\n  \/\/ 1. EEA + UK + Switzerland: deny until the visitor chooses\n  gtag('consent', 'default', {\n    'ad_storage': 'denied',\n    'ad_user_data': 'denied',\n    'ad_personalization': 'denied',\n    'analytics_storage': 'denied',\n    'region': ['AT','BE','BG','HR','CY','CZ','DK','EE','FI','FR','DE','GR','HU','IE',\n               'IT','LV','LT','LU','MT','NL','PL','PT','RO','SK','SI','ES','SE',\n               'IS','LI','NO','GB','CH'],\n    'wait_for_update': 500\n  });\n\n  \/\/ 2. Every other region (SA, AE, EG and the rest): your documented policy\n  gtag('consent', 'default', {\n    'ad_storage': 'denied',\n    'ad_user_data': 'denied',\n    'ad_personalization': 'denied',\n    'analytics_storage': 'granted',\n    'wait_for_update': 500\n  });\n\n  gtag('set', 'ads_data_redaction', true);\n  gtag('set', 'url_passthrough', true);\n&lt;\/script&gt;\n&lt;script async src=\"https:\/\/www.googletagmanager.com\/gtag\/js?id=G-XXXXXXX\"&gt;&lt;\/script&gt;\n&lt;script&gt;\n  gtag('js', new Date());\n  gtag('config', 'G-XXXXXXX');\n\n  \/\/ 3. Call from the banner's Save handler, and on each page load from the stored choice\n  function applyConsent(choice) {\n    gtag('consent', 'update', {\n      'ad_storage': choice.ads ? 'granted' : 'denied',\n      'ad_user_data': choice.ads ? 'granted' : 'denied',\n      'ad_personalization': choice.ads ? 'granted' : 'denied',\n      'analytics_storage': choice.analytics ? 'granted' : 'denied'\n    });\n  }\n&lt;\/script&gt;<\/code><\/pre>\n<p>Region codes follow ISO 3166-2, and the most specific region wins. A default without a region covers everyone else; with no default at all, Google treats the state as granted. <code>wait_for_update<\/code> gives an async banner 500 milliseconds to answer. Consent Mode does not store choices, so persist them in a first-party cookie and replay the update on each page, per Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/security\/guides\/consent\" target=\"_blank\" rel=\"noopener\">website setup guide<\/a>.<\/p>\n<p>In Google Tag Manager, load the banner on the Consent Initialization trigger, ideally through a Community Template Gallery CMP template, and use <code>updateConsentState<\/code> rather than <code>gtag('consent','update')<\/code>, which Google says can be queued too late.<\/p>\n<p>Not sure your own container fires in this order? <a href=\"https:\/\/www.voctos.com\/web-development\/\" target=\"_blank\" rel=\"noopener\">Check my tag order and consent setup<\/a>.<\/p>\n<h2>How do you gate Meta, TikTok, Snap and X pixels on consent?<\/h2>\n<p>Google&#8217;s consent state does not reach other vendors&#8217; pixels. Meta and TikTok each ship their own consent calls, so wire them to the same banner handler as the Google update. For Snap and X we found no equivalent public command, so the reliable gate is not loading their scripts until the visitor grants advertising consent.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Pixel<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Sites in our crawl<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Consent control<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Gate it this way<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Meta<\/td>\n<td style=\"padding:12px 16px\">12 of 29<\/td>\n<td style=\"padding:12px 16px\"><code>fbq('consent','revoke')<\/code> before init, <code>fbq('consent','grant')<\/code> on accept<\/td>\n<td style=\"padding:12px 16px\">Call revoke on every page, as <a href=\"https:\/\/developers.facebook.com\/docs\/meta-pixel\/implementation\/gdpr\/\" target=\"_blank\" rel=\"noopener\">Meta&#8217;s developer docs<\/a> require<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">TikTok<\/td>\n<td style=\"padding:12px 16px\">9 of 29<\/td>\n<td style=\"padding:12px 16px\"><code>ttq.holdConsent()<\/code>, <code>ttq.grantConsent()<\/code>, <code>ttq.revokeConsent()<\/code><\/td>\n<td style=\"padding:12px 16px\">Hold before the first page event, grant or revoke from the banner<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Snap<\/td>\n<td style=\"padding:12px 16px\">7 of 29<\/td>\n<td style=\"padding:12px 16px\">None found in the public script<\/td>\n<td style=\"padding:12px 16px\">Load <code>snaptr<\/code> only after ad consent<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">X<\/td>\n<td style=\"padding:12px 16px\">5 of 29<\/td>\n<td style=\"padding:12px 16px\">None found in the public script<\/td>\n<td style=\"padding:12px 16px\">Load <code>twq<\/code> only after ad consent<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>We confirmed the three TikTok methods exist in TikTok&#8217;s live pixel library on 2 October 2026. In GTM, set each non-Google tag&#8217;s Additional Consent Checks to &#8220;Require additional consent for tag to fire&#8221; with <code>ad_storage<\/code>, and the tag stays silent until the update arrives. The OpenAI Pixel needs the same treatment, as our <a href=\"https:\/\/voctos.net\/chatgpt-ads-conversion-tracking\/\">ChatGPT Ads conversion tracking guide<\/a> explains.<\/p>\n<h2>What happens to GA4 numbers when you switch consent on?<\/h2>\n<p>Reported users and conversions drop for every visitor who declines, unless GA4 can model them. Behavioral modeling needs advanced mode on every page, at least 1,000 events a day with analytics_storage denied for 7 days, and at least 1,000 daily consenting users on 7 of the previous 28 days.<\/p>\n<p>Those thresholds come from Google&#8217;s <a href=\"https:\/\/support.google.com\/analytics\/answer\/11161109\" target=\"_blank\" rel=\"noopener\">behavioral modeling article<\/a>, which adds that meeting them does not guarantee eligibility. A mid-size Arab brand site with a few hundred daily users never reaches the bar, so its GA4 totals simply fall after launch. Basic mode gets no GA4 modeling at all, because declining visitors send nothing.<\/p>\n<p>Three habits keep the numbers readable:<\/p>\n<ul>\n<li>Annotate the launch date in GA4 and Google Ads, so nobody reads the drop as an SEO or campaign failure.<\/li>\n<li>Scope the strict default to the regions that need it, so measurement elsewhere follows your chosen policy instead of collapsing everywhere.<\/li>\n<li>Remember the other blind spots. Our <a href=\"https:\/\/voctos.net\/ga4-ai-traffic-arab-markets\/\">study of how GA4 classifies AI traffic for Arab sites<\/a> shows a second undercount.<\/li>\n<\/ul>\n<p><strong>A consent banner without modeling is a measurement change, and it needs a dated note in every report.<\/strong><\/p>\n<h2>Where does server-side tagging fit?<\/h2>\n<p>Server-side tagging changes where tags run, not whether a visitor consented. The browser still reads the banner, and the Google tag passes the consent parameters to your server container with each request. The server container then fires vendor tags according to those signals. Two sites in our crawl served the Google tag script from their own domain.<\/p>\n<p>Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/server-side\/consent-mode\" target=\"_blank\" rel=\"noopener\">server-side consent guide<\/a> requires a web container that collects consent, a server container, and a GA4 client in the server container to receive the consent data. The gain is control, with one first-party endpoint and one place to block a vendor. The risk is a server container that forwards events to Meta or TikTok without checking the consent parameters, which bypasses the banner entirely.<\/p>\n<h2>How we checked<\/h2>\n<p>We loaded each brand&#8217;s Arabic homepage in desktop Chrome on 2 October 2026, waited up to 4.5 seconds, then read the live page with JavaScript. We recorded Google tag IDs, Google&#8217;s consent object, consent platform globals and the Meta, TikTok, Snap and X pixel functions. The result is a snapshot of 29 sites, not a census.<\/p>\n<ul>\n<li>One page per site, one visit. Tags that load on scroll, click or after consent are not counted. The 3 sites with a GTM container in the source and nothing running most likely defer loading.<\/li>\n<li>The 4.5-second window cuts off deferred loading by design.<\/li>\n<li>Our connection was in Cairo, and at least one regional retailer redirected us to its Egypt store.<\/li>\n<li>No Core Web Vitals field data was collected.<\/li>\n<li>8 of 37 sites (22%) returned a bot challenge or a blank page and are excluded. We did not try to bypass any challenge.<\/li>\n<\/ul>\n<h2>Our read<\/h2>\n<p>Declare a consent default on every Arab site that runs a Google tag, even where no local law names Consent Mode. The implicit state leaves you unable to show what your tags did for a given visitor, and EU visitors already trigger Google&#8217;s policy. The fix is a few lines of code placed in the right order.<\/p>\n<p>The weak point in our data sits between the banner and the tags. Two of the four sites with a consent platform still sent Google no default, which means a CMP was bought and never wired to the tags it exists to control. Wiring it, plus the Meta and TikTok consent calls, is a small developer task next to the cost of the platform.<\/p>\n<p>A more useful test than any regulator&#8217;s question is this: can you say, for any visitor, which tags fired and on what basis? If you can, add region-scoped defaults for EEA, UK and Swiss traffic. If you cannot, run the two-minute check on your homepage and fix the order before touching the banner design.<\/p>\n<p>Want a developer to do that audit for you? <a href=\"https:\/\/www.voctos.com\/web-development\/\" target=\"_blank\" rel=\"noopener\">Audit my tags, pixels and consent order<\/a>. If those GA4 numbers also drive your search reporting, <a href=\"https:\/\/www.voctos.com\/seo\/\" target=\"_blank\" rel=\"noopener\">help me read my SEO data after the consent change<\/a>.<\/p>\n<h2>FAQ<\/h2>\n<h3>Is a cookie banner legally required in Saudi Arabia?<\/h3>\n<p>Neither the Saudi PDPL nor its Implementing Regulation contains a cookie article or mandates a banner. SDAIA&#8217;s Privacy Policy Guideline does require privacy policies to name cookie data and to list cookies and website analytics as collection methods with a purpose and legal basis. This is our reading of the texts, not legal advice.<\/p>\n<h3>Our site only targets the Gulf. Do we still need Consent Mode?<\/h3>\n<p>Google&#8217;s EU user consent policy applies to visitors in the EEA, the UK and Switzerland on any site you control, wherever your company is based. Gulf sites receive expat and travel traffic from Europe. A region-scoped default denies consent for those visitors only and leaves your chosen policy in place for Saudi, UAE and Egyptian visitors.<\/p>\n<h3>Will Consent Mode lower our GA4 and Google Ads numbers?<\/h3>\n<p>Yes, for every visitor who declines. GA4 models the gap only in advanced mode, and only once a property logs at least 1,000 denied events a day for 7 days plus 1,000 daily consenting users. Smaller sites miss that bar, so annotate the launch date and compare trends rather than raw totals.<\/p>\n<h3>We use GTM. Where do the consent settings go?<\/h3>\n<p>Load your consent banner on the Consent Initialization trigger, ideally through a CMP template from the Community Template Gallery. Set non-Google tags to require additional consent, such as ad_storage, under Advanced Settings. Inside GTM templates, use updateConsentState instead of a gtag update call, which Google warns can be processed too late for the next event.<\/p>\n<h3>What does an implicit consent state mean in our tag setup?<\/h3>\n<p>It means no Consent Mode default was declared before your Google tags ran. Google&#8217;s documentation treats an unspecified state as granted, so tags write cookies and send full data for every visitor. In our October 2026 crawl, 16 of the 20 Arab homepages with a running Google tag were in this state.<\/p>\n<p><script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@graph\": [\n    {\n      \"@type\": \"BlogPosting\",\n      \"@id\": \"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/#article\",\n      \"headline\": \"Consent Mode on Arab Websites: What 29 Brand Homepages Actually Run\",\n      \"description\": \"Only 3 of 20 Arab brand homepages running a Google tag declared a Consent Mode default in our October 2026 crawl. What Consent Mode is, what Arab laws ask, and how to fix tag order.\",\n      \"datePublished\": \"2026-10-02\",\n      \"dateModified\": \"2026-10-02\",\n      \"inLanguage\": \"en\",\n      \"author\": {\n        \"@type\": \"Person\",\n        \"name\": \"Reem Sameh\",\n        \"jobTitle\": \"Senior Full-Stack Web Developer\",\n        \"url\": \"https:\/\/voctos.net\/team\/reem-sameh\/\",\n        \"worksFor\": {\n          \"@type\": \"Organization\",\n          \"name\": \"VOCTOS\",\n          \"url\": \"https:\/\/www.voctos.com\/\"\n        }\n      },\n      \"publisher\": {\n        \"@type\": \"Organization\",\n        \"name\": \"VOCTOS\",\n        \"url\": \"https:\/\/www.voctos.com\/\",\n        \"logo\": {\n          \"@type\": \"ImageObject\",\n          \"url\": \"https:\/\/voctos.net\/wp-content\/themes\/voctos-blog\/assets\/img\/logo.png\"\n        }\n      },\n      \"mainEntityOfPage\": \"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/\",\n      \"isBasedOn\": {\"@id\": \"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/#dataset\"}\n    },\n    {\n      \"@type\": \"Dataset\",\n      \"@id\": \"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/#dataset\",\n      \"name\": \"VOCTOS crawl of 29 Arab brand homepages: Google tags, Consent Mode and ad pixels (October 2026)\",\n      \"description\": \"Live-page check of 29 Arab brand homepages in Saudi Arabia, the UAE, Egypt, Qatar and Kuwait on 2 October 2026: Google tag IDs, Consent Mode default and update, consent platforms, and Meta, TikTok, Snap and X pixels within a 4.5-second window.\",\n      \"creator\": {\"@type\": \"Organization\", \"name\": \"VOCTOS\", \"url\": \"https:\/\/www.voctos.com\/\"},\n      \"datePublished\": \"2026-10-02\",\n      \"temporalCoverage\": \"2026-10-02\",\n      \"spatialCoverage\": [\"Saudi Arabia\", \"United Arab Emirates\", \"Egypt\", \"Qatar\", \"Kuwait\"]\n    },\n    {\n      \"@type\": \"FAQPage\",\n      \"@id\": \"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/#faq\",\n      \"mainEntity\": [\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is a cookie banner legally required in Saudi Arabia?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Neither the Saudi PDPL nor its Implementing Regulation contains a cookie article or mandates a banner. SDAIA's Privacy Policy Guideline does require privacy policies to name cookie data and to list cookies and website analytics as collection methods with a purpose and legal basis. This is our reading of the texts, not legal advice.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Our site only targets the Gulf. Do we still need Consent Mode?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Google's EU user consent policy applies to visitors in the EEA, the UK and Switzerland on any site you control, wherever your company is based. Gulf sites receive expat and travel traffic from Europe. A region-scoped default denies consent for those visitors only and leaves your chosen policy in place for Saudi, UAE and Egyptian visitors.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Will Consent Mode lower our GA4 and Google Ads numbers?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes, for every visitor who declines. GA4 models the gap only in advanced mode, and only once a property logs at least 1,000 denied events a day for 7 days plus 1,000 daily consenting users. Smaller sites miss that bar, so annotate the launch date and compare trends rather than raw totals.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"We use GTM. Where do the consent settings go?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Load your consent banner on the Consent Initialization trigger, ideally through a CMP template from the Community Template Gallery. Set non-Google tags to require additional consent, such as ad_storage, under Advanced Settings. Inside GTM templates, use updateConsentState instead of a gtag update call, which Google warns can be processed too late for the next event.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"What does an implicit consent state mean in our tag setup?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"It means no Consent Mode default was declared before your Google tags ran. Google's documentation treats an unspecified state as granted, so tags write cookies and send full data for every visitor. In our October 2026 crawl, 16 of the 20 Arab homepages with a running Google tag were in this state.\"}\n        }\n      ]\n    }\n  ]\n}\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0644\u0645 \u062a\u064f\u0639\u0644\u0646 \u0633\u0648\u0649 3 \u0645\u0646 20 \u0635\u0641\u062d\u0629 \u0631\u0626\u064a\u0633\u064a\u0629 \u0644\u0639\u0644\u0627\u0645\u0627\u062a \u062a\u062c\u0627\u0631\u064a\u0629 \u0639\u0631\u0628\u064a\u0629 \u062a\u0634\u063a\u0651\u0644 \u0639\u0644\u0627\u0645\u0629 Google \u0639\u0646 \u062d\u0627\u0644\u0629 \u0627\u0641\u062a\u0631\u0627\u0636\u064a\u0629 \u0644\u0640 Consent Mode \u0641\u064a \u0641\u062d\u0635\u0646\u0627 \u0641\u064a \u0623\u0643\u062a\u0648\u0628\u0631 2026. \u0645\u0627 \u0627\u0644\u0630\u064a \u064a\u0641\u0639\u0644\u0647 Consent Mode\u060c \u0648\u0645\u0627 \u0627\u0644\u0630\u064a \u062a\u0637\u0644\u0628\u0647 \u0642\u0648\u0627\u0646\u064a\u0646 \u0627\u0644\u062e\u0635\u0648\u0635\u064a\u0629 \u0627\u0644\u0639\u0631\u0628\u064a\u0629\u060c \u0648\u0643\u064a\u0641 \u062a\u0635\u0644\u062d \u062a\u0631\u062a\u064a\u0628 \u0627\u0644\u0639\u0644\u0627\u0645\u0627\u062a.<\/p>","protected":false},"author":2,"featured_media":12924,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"post_team_member":1296,"vb_event":"","vb_takeaways":"","vb_sources":"","vb_figure":"","vb_figure_label":"","vb_sector":"","vb_sample":"","vb_period":"","vb_engines":"","vb_method":"","vb_verified":"","footnotes":""},"categories":[54,53],"tags":[],"class_list":["post-12920","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics-measurement","category-research-data"],"acf":[],"_links":{"self":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts\/12920","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/comments?post=12920"}],"version-history":[{"count":1,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts\/12920\/revisions"}],"predecessor-version":[{"id":12925,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts\/12920\/revisions\/12925"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/media\/12924"}],"wp:attachment":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/media?parent=12920"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/categories?post=12920"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/tags?post=12920"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}