Cookie Consent and GA4 Consent Mode for GCC Business Websites

In our experience, many cookie banners on Gulf and Egyptian business websites arrive in one of two ways: someone copies a European template, or a developer is told “we need a banner” and installs the first plugin that appears. Neither is a decision. The banner controls whether your analytics and ad platforms can measure anything, and the law-firm guides to local data protection rules say more about cookies than many marketing teams expect.

This guide covers the decision rather than the tag setup: which Google consent mode to run, what the Saudi, UAE, Egyptian and Qatari rules imply for the banner, and how to set defaults so you stay on the right side of the law without flying blind on leads. It is a planning summary built from the sources linked, not legal advice.

What consent mode is, and what it is not

Consent mode is a way to tell Google tags what the visitor chose in your banner. Google describes it as letting you “communicate your users’ cookie or app identifier consent status to Google”, and is explicit that it works alongside a banner or consent management platform but does not provide one (Google Analytics Help: About consent mode). So you still need a banner; consent mode only makes Google’s tags respect it.

The signals it passes are called consent types. Google’s developer documentation lists seven, of which four matter to marketing: ad_storage (advertising cookies), analytics_storage (analytics cookies), ad_user_data (sending user data to Google for advertising) and ad_personalization (personalised advertising such as remarketing) (Google Tag Platform: Consent mode overview, last updated 30 July 2026).

Basic or advanced: what each one actually gives you

Google offers two implementations. The difference is what happens before and after a visitor says no.

Sources: Google Tag Platform, Google Ads Help: About consent mode. Google lists the ping contents for consent mode pings in general; check the current page before you describe them in a privacy policy.

Advanced mode sounds like the obvious choice, but there is a catch that matters for most B2B sites in the region. GA4 only models the behaviour of visitors who declined when the property collects at least 1,000 events per day with analytics storage denied for at least seven days, and has at least 1,000 daily users with analytics storage granted on at least seven of the previous 28 days. Google adds that meeting these thresholds does not guarantee eligibility (Google Analytics Help: Behavioural modelling for consent mode).

A contractor, distributor or consultancy with a few hundred visits a day will usually not reach those numbers. For such a site, the practical gain from advanced mode is on the Google Ads side (an advertiser-specific conversion model and consent state pings), not in GA4 reports. That is still worth having if you run Google Ads, but it changes the business case. Advanced mode also means tags load before consent, which your legal adviser should be comfortable with given the local positions below.

What the local rules imply for your cookie banner

The Saudi and UAE guides below say there is no specific cookie law in those markets, and none of the four guides points to a dedicated cookie statute in the European style. That does not mean “no rules”: in each case the guides apply the general data protection law to cookies, and the expectation for advertising cookies is consent. The table summarises what dated law-firm guides say; it is not legal advice. The positions are still developing, so check the current texts with a lawyer before relying on them.

Sources: Chambers Data Protection & Privacy 2026 guides for Saudi Arabia (GLA & Company), UAE (Bizilance Legal Consultants; BSA Law), Egypt (Shehata & Partners) and Qatar (GLA & Company), all updated 10 March 2026; CMS, September 2024; Clyde & Co, January 2026.

Points that change what you build

• Egypt’s grace period ran to 31 October 2026 (Clyde & Co, January 2026). If your site collects Egyptian visitors’ data for marketing, the licence and the consent records are what to raise with your lawyer now; our guide to licensing your marketing database in Egypt sets out both, and our Saudi PDPL guide covers consent for Saudi campaigns.
• Free zones can have their own regime. Entities in the Qatar Financial Centre fall under the QFC Data Protection Regulations 2021 rather than the PDPPL, and the DIFC and ADGM in the UAE have their own data protection laws. A group with a free-zone entity and a mainland entity may need to treat two websites differently.
• The UAE regulator is still settling in. Even its name varies by source: the two UAE chapters in the Chambers guide say “UAE Data Office” and “Emirates Data Office”, while the English text of Decree-Law No. 45 of 2021 on the UAE Legislation portal calls it the “UAE Data Bureau”. One Chambers chapter says it is not yet fully operational, so check the current position before naming it in your privacy policy. Absence of enforcement is not a reason to skip consent; it is a reason to build something you will not need to rebuild.
• Privacy policy wording. SDAIA’s privacy policy guideline, as summarised by CMS, expects the policy to list the categories of data collected, with cookie data given as an example, and to state the right to withdraw consent at any time.

For the wider set of legal and trust items a UAE site should carry, see our guide to UAE website legal requirements and trust signals.

Setting defaults by region

Google suggests configuring “a default state to apply to particular regions instead of to all visitors” (Google Analytics Help), and its developer guide says region values let you “comply with regional regulations”. Regions are set with ISO 3166-2 codes, and Google warns that the order of the default and update commands is “vital”: called out of order, the defaults will not work (Google Tag Platform: Set up consent mode, last updated 13 October 2026).

It is worth being precise about what Google itself requires. Google’s EU user consent policy covers end users in the European Economic Area, the UK and Switzerland, and requires consent for cookies where legally required and for personal data used in ad personalisation (Google EU user consent policy). In the Google pages we checked for this guide (the EU user consent policy and the consent mode help and developer pages above), we found nothing that extends a consent-signal requirement to Saudi Arabia, the UAE, Egypt or Qatar. That is not proof no such requirement exists, and Google’s policies change, so check the current versions; on what we found, the obligation for GCC and Egyptian visitors comes from local law rather than from Google.

That leads to a simple decision sequence:

1. Map where your visitors are. GA4’s country report shows the split. As hypothetical examples, a Riyadh contractor may find that almost all its visitors are in Saudi Arabia, while a Dubai trading house may see real traffic from European suppliers and partners.
2. List the markets whose law applies to you. Your entity’s location, and where the people whose data you process are, both matter. Your lawyer decides this, not the developer.
3. Set advertising consent to denied by default for every market where your adviser expects consent for advertising cookies. Based on the guides above, that is likely all four markets as well as Europe.
4. Decide analytics separately. The guides above speak most clearly about advertising cookies and targeted marketing; ask your adviser whether analytics cookies need the same treatment, and record the decision and the reason.
5. Only then choose basic or advanced, using the thresholds and Google Ads question above.

In practice, for a site whose visitors are mostly in the Gulf and Egypt, regional defaults rarely mean “granted for local visitors”. Their value is that you can run one implementation with the right defaults and banner behaviour for each audience, instead of a lowest-common-denominator setup.

What changes in your reports

Brief your management before the banner goes live, because the numbers will move.

• Fewer recorded visitors and leads. In basic mode, visitors who decline disappear from GA4 entirely. Leads still arrive by form, phone and WhatsApp; they simply stop being attributed to a source.
• Modelled data needs the right setting. If you qualify for behavioural modelling, GA4 shows it only with the Blended reporting identity (Google Analytics Help).
• A waiting period for Google Ads. Google Ads Help notes that uplift reporting may be available after consent mode has been running for at least seven full days.
• The CRM becomes the number that matters. GA4 was never going to match your CRM; consent widens the gap. Count qualified inquiries and quotations in the CRM and use GA4 for direction. Our guide to tracking leads in GA4 explains how to set up forms, calls and WhatsApp clicks so the consented share is measured cleanly.

A hypothetical example: a distributor sees GA4 leads fall by a third the week the banner launches, while the sales team’s inquiry log is flat. Nothing is wrong with the campaigns; the measurement window narrowed. Agreeing that interpretation in advance prevents a budget being cut for the wrong reason.

A banner checklist for Gulf and Egyptian sites

• Arabic and English. A consent request a visitor cannot read is hard to call informed. Match the banner language to the page language.
• Equal choices. “Accept” and “Reject” at the same level and size. Egypt’s position that dark patterns invalidate consent is the clearest statement, but it is good practice everywhere.
• Granular categories. At minimum: necessary, analytics, advertising. Map each category to the matching consent types so “reject advertising” actually sets ad_storage, ad_user_data and ad_personalization to denied.
• Reversible. A permanent link, usually in the footer, to change cookie choices, and a privacy policy that states how to withdraw consent.
• Recorded. Keep a log of what each visitor chose and when. Most consent platforms do this; check where the log is stored.
• Tested. Decline everything, then check in Tag Assistant or the browser’s developer tools that no advertising cookies are set. Repeat on mobile and on the Arabic pages.
• Owned. One person signs off any new tag or pixel against the consent categories, so a later campaign does not quietly bypass the banner. On a new website build, plan the banner and the tracking together rather than adding the banner after launch.

Start with the “Tested” check on your live site today: decline every category, then see which cookies are still set. Whatever appears is the first item for your developer and your legal adviser, and it tells you whether your problem is lost measurement, legal exposure or both.