Marketing Consent Law in Arab Markets: Saudi, UAE and Egypt

Egypt and Saudi Arabia publish marketing consent fines; the UAE does not. Egypt fines a breach EGP 200,000 to 2,000,000, Saudi Arabia allows a warning or a fine up to SAR 5,000,000, and the UAE law we read sets no amount at all. All three still require consent before you send a promotional message.

We read the Egyptian and UAE law texts and law-firm summaries of the Saudi law on 22 October 2026. This is not legal advice. Each source link below is where to confirm the current wording before you change a lead flow.

Which law governs marketing consent in each market?

Saudi Arabia regulates marketing messages in Article 25 of its Personal Data Protection Law. The UAE covers them through consent and objection rights in Federal Decree-Law 45 of 2021. Egypt has the most specific text: Articles 17 and 18 of Law 151 of 2020 govern electronic direct marketing by name, with a fine attached.

Sources: Clyde & Co on the Saudi PDPL; Saudi PDPL Article 25 text; UAE Decree-Law 45 of 2021; Egypt Law 151 of 2020 (English translation, not an official text).

What does Saudi Arabia require before you message a customer?

Saudi Arabia bars a controller from using personal channels such as post or email for advertising unless the recipient gave prior consent and a clear opt-out exists. Public entities are exempt for awareness material. The rule has been enforceable since 14 September 2024, so a list built on silence is already exposed.

The Implementing Regulations were published on 7 September 2023, the PDPL came into force on 14 September 2023, and full enforcement began a year later. A law-firm summary of the Regulations lists four duties for promotional messages: consent given freely, a choice of which types of advertising the recipient accepts, a documented record, and a free stop on request. It also says the sender must be identified.

On penalties, the Clyde & Co summary lists imprisonment up to two years or a fine up to SAR 3,000,000 for disclosing sensitive data, up to one year or SAR 1,000,000 for breaking the transfer rules, and a warning or a fine up to SAR 5,000,000 for everything else. A marketing breach is not named in the first two tiers, so the general tier is the likely exposure. Fines can double on a repeat offence.

Enforcement is real. IAPP reported on 25 February 2026 that the data authority issued 48 decisions in 2025, and that a notable number involved marketing messages sent without prior consent. The report gives no fine amounts, so treat the SAR 5,000,000 ceiling as a limit, not as what was charged.

One date matters for planning. The data authority announced a consultation on draft changes to the Implementing Regulation on 9 October 2026, open until 5 November 2026. The draft would revise the consent framework for promotional and direct marketing, with stronger withdrawal and opt-out requirements. It is a draft, not law.

What does the UAE require, and where are the penalties?

The UAE law requires you to prove consent, make it clear and easy to give, and let people withdraw it at any time. Article 17 lets a person object to direct marketing, including profiling for it. What the UAE lacks is a penalty schedule: the Decree-Law sends fines to a Cabinet decision that we could not find.

The text is specific on consent. Article 6 asks for proof that consent was given, a clear and unambiguous way to give it, and a statement of the right to withdraw. The administrative penalties appear in Articles 9, 24 and 26, but Article 26 only tells the Cabinet to issue a decision listing the violating acts and their penalties. The words fine and sanction do not appear in the text, and it contains no monetary amount.

The Executive Regulations were due within six months of issue under Article 28, and the compliance window under Article 29 starts only when they exist. Two trackers we read, one last modified in January 2025 and one updated in September 2026, say they are still unissued. We could not confirm an issued text. The newer page warns that several sites cite Cabinet decision numbers as the Regulations, and says none appears in the Official Gazette as such.

Ranges such as AED 50,000 to AED 5 million are quoted online for the PDPL. We could not trace them to the Decree-Law, so we do not repeat them as the PDPL fine. Other UAE laws carry their own penalties, and the free zones DIFC and ADGM run separate data protection regimes. A missing schedule is a gap in enforcement, not permission to send.

What does Egypt require, and what is the fine?

Egypt bans electronic direct marketing unless the sender has prior consent, identifies itself, gives a valid address, labels the message as marketing and offers an easy opt-out. Article 43 fines a breach of Articles 17 and 18 between EGP 200,000 and EGP 2,000,000. The text lists no prison term for this offence.

Article 18 adds two duties: the marketing purpose must be specified and clear, and consent records must be kept for three years from the last message. The Executive Regulations also require the sender to hold a licence from the Personal Data Protection Center. Article 45 sets a separate fine of EGP 500,000 to 5,000,000 for breaking licensing provisions, though the text does not name marketing there.

Two features raise the stakes for an agency or an in-house team. Article 47 extends the penalty to a responsible manager who knew of the violation, and Article 48 doubles penalties on repeat offences. Article 49 allows settlement before a case is filed by paying half the minimum fine, EGP 100,000, with the Center’s approval.

What should a consent record contain in all three markets?

A consent record should show who agreed, when, through which form or channel, and to what wording. Add the sender identity and the opt-out history. This single record meets the Saudi documentation duty, the UAE duty to prove consent and Egypt’s three-year retention rule, so you can build it once.

• The person’s contact detail, plus the date and time of consent.
• The exact form text and the channel it covered, such as email, SMS or WhatsApp.
• The sender name shown in the message and a working reply address.
• Every opt-out, with the date it was honoured, kept at least three years after the last message.
• A separate flag for service messages, so an order update never counts as marketing consent.

Tracking is a different question. How consent signals reach your analytics tags is covered in our consent mode guide for Arab websites; this post covers the message itself.

Our read

Build to the Egyptian standard in every market. It is the strictest on paper, it carries the clearest fine, and a list that satisfies it also satisfies the Saudi and UAE consent rules. That means one opt-in per channel, one visible sender name, a marketing label and a three-year record.

We would also stop buying or importing lists. A purchased list has no consent record you can produce, and every rule above starts from proof. Where a supplier says its list is compliant in all three markets, ask for the record format before you pay. The UAE’s missing penalty schedule changes the size of the risk, not the consent duty, and our fake reviews rules post shows the same pattern: the written rule exists before the enforcement does.

FAQ

We only message people who already bought from us. Do we still need marketing consent?

Saudi Arabia’s Article 25 asks for prior consent for advertising without carving out customers, and a law-firm summary says the Regulations do not distinguish an existing relationship. Egypt’s Article 17 has no such exception in the text we read. Collect marketing consent at checkout, separate from the order confirmation.

My agency says the UAE has no penalties, so we can relax. Is that right?

The Decree-Law sets no amount and leaves penalties to a Cabinet decision we could not find. But the consent and objection duties in Articles 6 and 17 already apply, and other UAE laws carry their own penalties. Missing fines change the cost of a breach, not the rule.

Can one consent cover email, SMS and WhatsApp?

The texts we read tie consent to the message, and a Saudi summary says recipients choose which types of advertising they accept. Egypt bans electronic direct marketing without prior consent. Record the channel for every opt-in, and ask again when you add a new one.

A customer unsubscribed but still got a campaign. What do we do now?

Honour the opt-out immediately and log the date. Saudi Arabia expects the stop to be free of charge, and Egypt requires an easy opt-out. Check whether your email, SMS and ad audiences sync, because a suppression list that misses one tool causes most repeat sends.

Does my Egyptian sender need a licence even for small email campaigns?

The Executive Regulations require a sender to hold a valid licence from the Personal Data Protection Center. We did not find a size threshold in the text we read. Ask the Center, or an Egyptian lawyer, before you launch a campaign from a new sender name.

Could you produce this customer’s consent today?

If you can pull the consent record, the sender name and the opt-out date for any name on your list in a minute, send the campaign. If you cannot, fix the record first, then write the message. Review my consent flow or check how my lead forms feed campaigns.