Privacy practices of popular websites in Saudi Arabia

Abstract Preserving users’ privacy while exploring the Internet is a continuous challenge. Regulations such as GDPR, CCPA, and PDPL have been introduced to counter privacy-invasive trends. This paper introduces a framework for inspecting the state of popular websites in preserving the privacy of their visitors. The framework can be used to analyze websites in both Arabic and English languages. We use it to report the current state of popular websites in Saudi Arabia. We examined the state of these websites three months before the official enforcement of the Personal Data Protection Law (PDPL). Therefore, the paper shows the degree of alignment for popular websites in Saudi Arabia with PDPL. We analyze 723 websites and explore their utilization of cookies. We examined whether these websites inform their visitors of cookie usage and obtain visitors’ consent. We assess whether these websites detail their privacy policies to their visitors. Our results demonstrated that approximately 85% of websites that use cookies don’t display cookie banners or policies to their visitors, potentially depriving users from their PDPL-specified rights such as being informed of data collection. Our analysis shows that 39% of the scanned websites do not follow the PDPL requirement of providing privacy policies, precluding users from knowing how their collected data will be handled and how they can exercise their rights under PDPL. In summary, our analysis highlights alarming practices that can potentially violate PDPL requirements.