WhatsApp Marketing Rules in Saudi Arabia (2026): Consent, Opt-Out and What Each Regulator Actually Covers

Short answer: to send WhatsApp marketing to customers in Saudi Arabia you need their prior, provable consent and an easy way to stop. That comes from the Personal Data Protection Law (PDPL), enforced by SDAIA, and from the E-Commerce Law's advertising rules — and it matches Meta's own policy, which requires opt-in and lets Meta block or remove accounts that ignore it. CST's well-known SMS rules (no promotions from 10 PM to 9 AM, the "-AD" sender suffix, opt-out within 24 hours) are written for SMS through licensed providers, so for WhatsApp they are best practice, not the law. Property ads and discount campaigns carry extra licence rules. SDAIA is consulting on tighter marketing-consent rules until 5 November 2026.

This guide explains the rules in plain language for planning purposes. It is not legal advice; for a specific campaign or dataset, ask a Saudi-qualified lawyer.

Four layers, one message

A single promotional WhatsApp from a Riyadh perfume brand to a customer in Khobar can touch four sets of rules at once. It helps to see them side by side before going into each.

The PDPL: the law that clearly applies

The PDPL was issued by Royal Decree M/19 in September 2021 and amended by Royal Decree M/148 in March 2023. It came into force on 14 September 2023 with a one-year transition period, so enforcement has been possible since September 2024. The Saudi Data and AI Authority (SDAIA) is the regulator.

Who it covers

It applies to processing of personal data in the Kingdom and to processing of data about people in the Kingdom by organisations outside it. A Dubai-based brand messaging Saudi customers, or a Saudi shop using a foreign platform, is in scope. A customer's name and mobile number are personal data; so is their order history.

What it says about marketing

As Latham & Watkins summarised the final regulations, consent appears to be the only legal basis that can be relied on for marketing. The Implementing Regulations treat sending advertising or awareness material and processing data for direct marketing in separate articles: the first requires consent where there has been no prior interaction with the recipient; the second requires consent for direct-marketing processing without that distinction. Either way, recipients must be able to opt out easily, and you must be able to show the consent you are relying on.

Penalties and breaches

Fines under the PDPL can reach SAR 5 million and may be doubled for repeat violations. Controllers must notify SDAIA within 72 hours of becoming aware of a personal-data breach that may cause harm. For a WhatsApp programme, that means knowing which tools hold your customer list — your CRM, your store platform and your messaging provider — and who can export it.

What SDAIA is proposing now

SDAIA opened a public consultation on amendments to the PDPL Implementing Regulations on 6 October 2026, closing on 5 November 2026. According to Clyde & Co's summary, the draft would require controllers relying on a prior relationship to verify that valid consent exists and keep evidence of it, offer clear ways to withdraw, and — when consent is withdrawn — stop not only the messages but the underlying marketing processing, destroying the data generated by it without undue delay. If adopted, the amendments would take effect 60 days after publication in the Official Gazette. Building consent records now is cheaper than retrofitting them later.

The E-Commerce Law: rules for online sellers' ads

If you sell online — a Salla or Shopify store, a delivery-app restaurant with its own ordering, a services marketplace — the E-Commerce Law and its Implementing Regulations (in force from 31 January 2020) add three requirements to electronic advertisements: include the seller's contact details, state clearly that the message is advertising, and give the consumer a means to request that such advertisements stop. Separately, a seller may not use a customer's personal data for marketing without the customer's prior consent. The Ministry of Commerce can impose fines of up to SAR 1 million, suspend e-commerce activity or block the store.

On WhatsApp, the first requirement is partly met by your business profile, but a short brand line in the template body and a clear STOP line in the footer satisfy all three in one go.

CST's anti-spam regulation: written for SMS

CST approved the Regulations for Curbing SPAM Messages and Calls by Decision No. 493/1444 (dated 17 October 2022), replacing earlier controls and taking effect 90 days later. They regulate messages and calls delivered through telecom operators and CST-licensed internet-to-mobile SMS providers. As summarised in the compliance guide of Taqnyat, one of those licensed providers, the rules for promotional SMS include:

The Ramadan window deserves a note. Under the SMS rule, the evening hours after iftar are allowed and the morning is not. That happens to match how Saudi customers use their phones during the month, so a WhatsApp sending window of roughly 12 PM to 1 AM in Ramadan and 9 AM to 10 PM the rest of the year is a sensible default. In QuickWA you set the window once in Settings, and scheduled broadcasts wait until it reopens.

Sector rules that bite on WhatsApp

Real estate: REGA's advertising rules

REGA's Real Estate Marketing and Advertising Regulations, approved in May 2026, apply across social media, online platforms, print, broadcast, exhibitions and billboards. Each advertisement must carry its real-estate advertising licence number, the property's type, location, area, description and value, the price, rent or brokerage fee, and a valid contact method. A brokerage in Riyadh or Jeddah sending listings on WhatsApp should treat each listing message as an advertisement and include those details; buyers can check a licence on REGA's inquiry service.

Sales and discounts: the Ministry of Commerce licence

The Ministry of Commerce requires a licence before a business advertises discounts, and the licence must be shown so consumers can verify it by scanning its code. If a White Friday or Founding Day template announces a percentage off, have the licence first and link to the page that displays it.

Meta's rules: the ones enforced fastest

Whatever Saudi law says, Meta's WhatsApp Business Messaging Policy is the rule your account lives or dies by. It requires that you have the customer's phone number and their opt-in permission confirming they want to receive messages from you, and that you respect every request — on or off WhatsApp — to block, stop or opt out. Meta recommends telling people how to opt out of specific categories of messages.

Template categories

Marketing templates are for anything promotional. Utility templates must be tied to a customer's order, account or service and contain no promotional or persuasive intent; mix the two and Meta re-categorises the template as marketing. Authentication templates are for one-time passcodes only.

The enforcement ladder

Meta's policy-enforcement documentation describes escalating steps for repeat violations: first a warning naming the policy; then a 1- or 3-day block on sending marketing, utility and authentication templates; then a 5-, 7- or 30-day block on sending any messages; then an account lock that only an appeal can lift; and finally a permanently disabled account. Meta also says it may limit or remove a business that receives excessive negative feedback from users — which is why block rates matter more than any regulator for a typical Saudi SME.

Consent that holds up: wording you can use

At checkout, on a booking form or on a Click-to-WhatsApp ad's welcome message, ask clearly and separately. An unticked checkbox, in both languages:

أوافق على استلام العروض والتحديثات من [اسم المتجر] عبر واتساب، ويمكنني إيقافها في أي وقت بإرسال «إيقاف».

I agree to receive offers and updates from [Store name] on WhatsApp. I can stop them at any time by replying STOP.

And a confirmation when someone opts out:

تم إيقاف الرسائل الترويجية. ستصلك فقط رسائل طلباتك ومواعيدك. لإعادة الاشتراك أرسل «اشتراك».

Promotional messages stopped. You will only receive messages about your orders and appointments. Reply START to subscribe again.

Accept the common Arabic and English stop words — إيقاف، الغاء، توقف، stop, unsubscribe — not just one keyword. QuickWA records consent per contact and turns STOP replies into opt-outs automatically, so a broadcast to a segment skips everyone who has opted out.

A compliance checklist for Saudi WhatsApp marketing

1. Collect consent separately from your terms and privacy policy, and store when, where and how it was given.
2. Never import bought or scraped lists, or numbers collected for delivery only, into a marketing segment.
3. Put a STOP line in every marketing template, in Arabic and English, and honour it at once.
4. Send a confirmation when someone opts in or out.
5. Keep utility templates purely transactional — no offers in order, COD or appointment messages.
6. Set a sending window: around 9 AM–10 PM normally and 12 PM–1 AM in Ramadan, Saudi time.
7. Identify yourself: brand name in the template and a contact route, as the E-Commerce Law expects of online sellers.
8. Hold the licences first: REGA ad licence numbers on property messages; a Ministry of Commerce discount licence before advertising a sale.
9. Know where the data sits and who can export it, so you can meet the 72-hour breach notification duty.
10. Watch your quality rating weekly and pause any template that customers block.
11. Review the PDPL amendments once SDAIA publishes the final text after the consultation closes on 5 November 2026.

For costs, setup and seasonal timing, see the Saudi pricing guide, the setup guide and our Saudi Arabia page.

Sources

• PDPL overview — in force 14 September 2023, SDAIA as regulator, fines up to SAR 5 million, 72-hour breach notice, direct-marketing consent: Latham & Watkins (checked 23 Oct 2026)
• SDAIA draft amendments to the PDPL Implementing Regulations, consultation 6 Oct – 5 Nov 2026: Clyde & Co (checked 23 Oct 2026)
• E-Commerce Law and Implementing Regulations — advertising requirements, consent, SAR 1 million fines: Global Compliance News (Baker McKenzie) (checked 23 Oct 2026)
• CST — Regulations for Curbing SPAM Messages and Calls, Decision 493/1444: cst.gov.sa and decision page; rule details as summarised in Taqnyat's CST compliance guide (checked 23 Oct 2026)
• REGA — Real Estate Marketing and Advertising Regulations: LexisNexis; advertisement licence inquiry service: rega.gov.sa (checked 23 Oct 2026)
• Ministry of Commerce discount licence requirement: Ajel, 16 August 2026 (checked 23 Oct 2026)
• Meta — WhatsApp Business Messaging Policy: whatsappbusiness.com/policy; policy enforcement: developers.facebook.com; template categorisation: developers.facebook.com (checked 23 Oct 2026)