United Arab Emirates: cookie and consent rules

Which data protection law applies in the UAE?

It depends on where the business is. Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the PDPL, was issued on 20 September 2021 and has been in force since 2 January 2022. It covers most of the country, but Article 2 excludes government data, health and banking data that have their own legislation, and companies in free zones that have their own data protection law. Two financial free zones do: the Dubai International Financial Centre (DIFC Data Protection Law No. 5 of 2020) and Abu Dhabi Global Market (ADGM Data Protection Regulations 2021). Each has its own regulator.

Who does the federal PDPL apply to?

Article 2 applies the PDPL to processing of personal data of data subjects who reside or have a place of business in the UAE, to controllers and processors in the UAE whether the data subjects are inside or outside the country, and to controllers and processors outside the UAE that process personal data of data subjects inside it. A foreign website that tracks visitors in the UAE is therefore within the text. Personal data includes any data that identifies a person directly or indirectly, and the definition lists the electronic identifier and geographical location among the identification elements, so cookie and advertising IDs are covered.

Do cookies need consent under the PDPL?

The PDPL has no cookie clause, but its consent rule is stricter than the GDPR's. Article 4 prohibits processing personal data without the data subject's consent and lists the exceptions: public interest, data made public by the person, legal claims, health and social care, archiving and statistics, protecting the person's interests, employment obligations, performing a contract the person is party to, legal obligations, and any other case the executive regulations add. There is no legitimate interest ground, so analytics and advertising cookies that are not necessary for a contract with the visitor have no basis other than consent.

Consent is defined in Article 1 as specific, clear and unambiguous acceptance given through a clear positive statement or action. Article 6 adds that the controller must be able to prove it, that it must be clear, simple, unambiguous and easily accessible, and that it must state the right to withdraw it easily. Article 18 gives a right to object to decisions based on automated processing, including profiling. In practice that points to an opt-in banner with a Reject option and a record of each choice.

What the PDPL does not have yet is the detail. Article 28 asked the Cabinet to issue executive regulations within six months, Article 29 gives businesses six months from those regulations to comply, and Article 26 leaves the list of violations and administrative penalties to a Cabinet decision. As of 20 October 2026, the official UAE legislation portal listed no executive regulations or penalties decision for the PDPL.

What does the DIFC require for cookies?

The DIFC is the one UAE regime with an express cookie rule. Regulation 9 of the DIFC Data Protection Regulations, in the version in force since 1 September 2023, covers "digital communications and services", which include behavioral advertising, defined to include the use of cookies for personalization, analytics or advertising profile development, and pixel or cross-app tracking. For these, the controller must:

• say, at the time of collection and in plain language, whether personal data will be used for these purposes;
• give the person an opportunity to refuse or opt out the first time data is collected for them;
• set privacy preferences by default so that no more than the minimum data needed for the service is collected;
• offer clear, colour-neutral selection boxes or buttons that neither promote nor discourage a setting, an explanation of the settings, and a preferences link or dashboard to change them later;
• when relying on consent, use an unticked box or similar positive selection, explain the purposes and link to a privacy notice; pre-ticked boxes, silence and inactivity are not acceptable.

The DIFC law applies to controllers and processors incorporated in the DIFC wherever they process, and to processing in the DIFC by others as part of stable arrangements (Article 6). Consent must be a clear affirmative act, separate for each purpose, and as easy to withdraw as to give (Article 12). The Commissioner can impose administrative fines up to the Schedule 2 amounts, from USD 25,000 to USD 100,000 per contravention, and a general fine not limited to those amounts (Article 62).

What about ADGM?

The ADGM Data Protection Regulations 2021 apply to processing in the context of an establishment in ADGM. The Office of Data Protection's guidance lists cookie identifiers among online identifiers, says silence, inaction and pre-ticked boxes are not consent, and states that the Commissioner can issue fines of up to USD 28 million. There is no ADGM cookie-specific rule. The Office publishes its regulatory actions, such as a variable penalty notice issued to Okadoc Technologies on 21 May 2024 for breaches of individual rights provisions.

Can personal data leave the UAE?

Under the PDPL, transfers are allowed to countries with data protection legislation and a regulator, or with which the UAE has a data protection agreement (Article 22). Otherwise Article 23 allows transfers under a contract binding the recipient to the PDPL's standards, with the data subject's explicit consent, or when needed for a contract, legal claims or the public interest; the executive regulations are meant to set the conditions. The DIFC and ADGM run their own adequacy lists and standard contractual clauses.

How Cookiequiet fits

The UAE is not in Cookiequiet's preset list of regulated countries, so add it to a custom country list or show the banner everywhere; geo-targeting is included on every plan. The banner blocks non-essential scripts until a choice, shows Accept all and Reject all with the same size and weight and no pre-ticked category, which lines up with the DIFC's colour-neutral and unticked-box rules, and the consent log records each choice. Arabic is not one of the 24 built-in languages: visitors whose browser asks for it see the site's default language, whose strings you can edit. Check what your site sets with the cookie scanner, and read dark patterns in cookie banners for the design side. Plans are on the pricing page. This is not legal advice.