Blog

UAE Data Protection Law and Marketing: PDPL Consent for Email, WhatsApp and Ads

How the UAE data protection law (PDPL) affects marketing: consent for email, WhatsApp and retargeting, the right to opt out, cookies, pixels and a checklist.

Quick Answer

Yes. The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021 (the PDPL), has applied since 2 January 2022 to any business that processes the personal data of people in the UAE, whether the business is in the UAE or abroad, and the names, phone numbers, email addresses, device identifiers and ad audiences your marketing runs on are all personal data. The law makes consent the default lawful basis for processing, requires that consent be clear, specific and given by a positive statement or action, and gives every individual an absolute right to object to direct marketing, including the profiling behind retargeting, that no business interest can override.

At the time of writing the Executive Regulations that will add detail and the federal penalty schedule had not been published, and the UAE Data Office is not yet fully operational, but the obligations are in force, the Consumer Protection Law is interpreted in practice to require consent before direct marketing, the 2024 telemarketing regulations already fine unwanted calls, SMS and social messages up to AED 150,000, and the Child Digital Safety Law in force since 1 January 2026 bans targeted advertising to under-13s. The DIFC and ADGM run their own, stricter regimes. The checklist at the end is what we build into every form, pixel and broadcast we ship.

Marketing teams in the UAE have spent four years hearing that the data protection law “is not really enforced yet” and have kept buying lists, uploading customer databases to ad platforms and broadcasting on WhatsApp to anyone who once left a number. That comfort is misplaced for three reasons. The law is in force and its obligations apply now, regardless of when the penalty schedule arrives. Other instruments already bite: the telemarketing regulations have been fining companies since August 2024, and the Consumer Protection Law’s prohibition on unsolicited marketing is applied in practice as a consent requirement. And the platforms your marketing runs on (Meta, Google, WhatsApp Business) enforce their own consent policies whatever the regulator does.

This guide explains what the PDPL is and who it applies to; what consent has to look like to count; the right to opt out of direct marketing and why it is the strongest right in the law; what you can and cannot do with the email list you already have; how cookies, pixels and retargeting fit; how to build lead forms and WhatsApp opt-ins that hold up; the separate DIFC and ADGM regimes; and a compliance checklist for marketing data. It is a companion to our guide to the UAE Advertiser Permit (who may publish advertising) and the legal-footer section of our UAE business website requirements checklist.

What the PDPL Is and Who It Applies To

The PDPL is the UAE’s first federal, general-purpose data protection law. It was issued on 20 September 2021 and came into force on 2 January 2022. It is modelled broadly on international frameworks such as the GDPR: it defines personal data as any information that identifies a person directly or indirectly (a name, a mobile number, an email, a location, an online identifier, a device ID), defines processing to cover collection, storage, use, sharing and deletion, and imposes duties on controllers (who decide why and how data is processed) and processors (who process on their behalf).

For a marketer, the practical reading is this: every list, every form, every pixel and every audience upload is processing of personal data, and each one needs a lawful basis you can name. In most marketing cases that basis is consent, because none of the exceptions covers “we would like to sell them something”.

Consent That Counts: Freely Given, Specific, Informed, Unambiguous

The PDPL requires that, where consent is the basis, the individual gives it through a clear and positive statement or action, that the controller is able to prove it, that the individual is told they can withdraw it, and that withdrawal is as easy as giving it. In practice the standard mirrors what international law and the platforms already expect.

Two habits protect you. First, granularity: separate consents for email, WhatsApp and SMS, and for your own marketing versus any third-party sharing. Second, evidence: your form or CRM should store the consent text shown, the timestamp, the source (page, campaign, QR code, event) and the method. If you cannot show these for a contact, treat the contact as not consented.

The Absolute Right to Opt Out of Direct Marketing

Article 17 of the PDPL gives every individual the right to object to processing for direct marketing, including profiling connected to direct marketing, and unlike most other rights in the law this one has no balancing test and no exception. When a person says stop, you stop, across every channel and every system, and you do not need to be told why.

This has consequences for how marketing is built. Every marketing message must carry a working opt-out. Opt-outs must propagate: an unsubscribe from email should also stop WhatsApp broadcasts if the consent covered both, and a “STOP” on WhatsApp should suppress the number everywhere. Suppression must reach ad platforms: a person who has objected should be removed from uploaded custom audiences at the next sync. And the right covers profiling, so scoring a contact for likelihood to buy and using that score to target them is within scope once they have objected.

The PDPL is not alone here. Article 4(5) of the Consumer Protection Law prohibits suppliers from sending unsolicited marketing to consumers, and the prevailing interpretation in practice has been that consent is required before direct marketing begins. The telemarketing regulations (Cabinet Resolution No. 56 of 2024, in force since 27 August 2024, with penalties under Resolution No. 57 of 2024) define marketing communications to include marketing SMS and social media messages as well as calls, require prior approval from the licensing authority to conduct telemarketing, limit marketing calls to 9am to 6pm, require screening against the TDRA’s Do Not Call Registry, and set fines that reach AED 150,000 for calling a registered number or trading consumer data without consent. The TDRA’s separate SMS policy limits marketing SMS to 7am to 9pm with prior consent. Enforcement under these rules has been public and continuing.

Email Lists: What You Can and Cannot Do With Old Data

The commonest question we are asked is what to do with the list the business has accumulated over the years: customer emails from invoices, contacts from events, a purchased database from 2019, and the export from a previous agency.

A permission request is a single, plain message that explains who you are, how you have their details, what you would like to send and how to say yes, with no offer attached beyond the request itself. It is not a loophole for indefinite re-mailing: send it once, honour the silence, and delete or suppress those who do not respond within a defined period.

Retention belongs in the same conversation. The PDPL expects personal data to be kept only as long as necessary for its purpose. A marketing list should have a rule (for example, suppress contacts who have not opened or clicked in 24 months, then delete after a further period), and the rule should be written down in your privacy notice and your records of processing.

Cookies, Pixels and Retargeting

The PDPL does not contain a specific cookie article, but online identifiers and device identifiers are personal data, and setting a tracking pixel that builds an advertising profile is processing. The market has moved toward a consent-banner model for non-essential cookies and marketing pixels, and the ad platforms’ own terms require advertisers to have a lawful basis and to honour user choices.

The practical setup for a UAE website is as follows. Strictly necessary cookies (session, security, load balancing) run without consent. Analytics, advertising and social pixels (Google Ads, Meta Pixel, TikTok, Snap, LinkedIn Insight) load only after the visitor accepts, through a consent management platform that records the choice. The banner offers a real reject option of equal prominence, not “accept” and “learn more”. The privacy notice lists each pixel, its provider, what it collects and how to withdraw. Google Consent Mode and the equivalent platform mechanisms are configured so that conversion measurement degrades gracefully rather than firing regardless.

Retargeting and custom audiences add a second layer. Uploading a customer list to Meta or Google to build a matched audience is disclosure of personal data to a third party for marketing, and it needs a consent that covered that use. Lookalike modelling from a consented audience is generally treated as the platform’s processing, but the seed list must itself be lawful. Anyone who has objected to direct marketing must be removed from every uploaded audience.

Children’s data: The Child Digital Safety Law (Federal Decree-Law No. 26 of 2025), in force since 1 January 2026, adds a hard rule: no collection or processing of personal data of children under 13 without verifiable parental consent, no use of children’s data for targeted advertising or tracking beyond the declared purpose, and default privacy settings at the highest level for children’s accounts. Brands in toys, education, gaming, family entertainment and children’s retail need age-gating and audience exclusions designed in, not bolted on.

Lead Forms and WhatsApp Opt-Ins Done Properly

WhatsApp is the UAE’s primary sales channel, and it is where consent is most often taken for granted. Meta’s Business Messaging policy requires that you obtain a person’s opt-in before sending them marketing messages on WhatsApp, that the opt-in names your business and the type of messages, and that you honour opt-outs, and it enforces this through quality ratings and messaging limits before any regulator does. The PDPL and the telemarketing regulations sit on top: social media messages sent for marketing are within the definition of telemarketing, and consent to be contacted is the expectation.

A compliant lead form in the UAE looks like this.

For click-to-WhatsApp advertising, which is the highest-intent format in the UAE market, the sequence matters: the person taps the ad and sends the first message (which opens the conversation), you respond to the enquiry, and you ask a clear yes-or-no question about receiving future offers before adding them to any broadcast list. Our upcoming guide to WhatsApp marketing rules in the UAE covers the template and quality-rating side.

DIFC and ADGM: The Separate Regimes

The two financial free zones are excluded from the PDPL and run their own, more developed regimes. The DIFC Data Protection Law (DIFC Law No. 5 of 2020) is enforced by a Commissioner of Data Protection with published guidance, a registration requirement for controllers, and fines that can reach USD 100,000 for specified breaches with unlimited discretionary fines above that. The ADGM Data Protection Regulations 2021 are enforced by the ADGM Office of Data Protection with a similar structure. Both regimes have explicit rules on direct marketing, cookies and consent that broadly track the GDPR.

If your business is registered in the DIFC or ADGM, or you process data on behalf of a client that is, these regimes apply to that processing and the PDPL does not; you may need to comply with both if you operate across mainland and free-zone entities. Other free zones (JAFZA, DMCC, Dubai Media City, twofour54 and the rest) are within the PDPL.

A Marketing Data Compliance Checklist

Items 7 and 8 fail most often, usually because the CRM, the email tool, the WhatsApp platform and the ad accounts were set up by different people at different times and nothing connects the suppression lists. Fixing that plumbing is the single most valuable compliance project most UAE marketing teams can run this year.

We build consent capture, suppression sync and privacy plumbing into every form, pixel and broadcast we ship, and we publish our own approach in our privacy policy. If you would like your marketing data audited against this checklist, see our media and execution services, our digital development services or start a project.

Frequently Asked Questions

Does the UAE PDPL apply to my marketing emails and WhatsApp broadcasts?

Yes. Email addresses and phone numbers are personal data, and sending marketing to them is processing. The PDPL requires a lawful basis, which for marketing is almost always clear, specific, recorded consent, and it gives every recipient an absolute right to object to direct marketing. WhatsApp marketing is also governed by Meta’s opt-in policy and falls within the UAE telemarketing regulations’ definition of marketing communications.

Is the UAE data protection law actually enforced?

The PDPL has been in force since 2 January 2022 and its obligations apply now. At the time of writing its Executive Regulations and federal penalty schedule had not been published and the UAE Data Office was not yet fully operational, so PDPL-specific fines had not begun. However, the telemarketing regulations have been enforced with fines since 2024, the Consumer Protection Law is applied to unsolicited marketing, and the ad and messaging platforms enforce consent through their own policies.

Do I need a cookie banner on a UAE website?

Online and device identifiers are personal data under the PDPL, so marketing and analytics pixels are processing that needs a lawful basis. Market practice and platform terms point to a consent banner that blocks non-essential tags until the visitor accepts, offers an equal reject option and records the choice, with the pixels listed in the privacy notice. DIFC and ADGM rules are explicit on this point.

Can I email customers who bought from me but never opted in to marketing?

You can send transactional messages (order updates, invoices, warranty or service notices) as performance of the contract. Promotional messages need marketing consent. The safe approach is a single, plain permission request, adding only those who say yes to the marketing list and suppressing the rest.

What is the difference between the PDPL and the DIFC or ADGM data protection laws?

The PDPL is the federal law for the UAE mainland and most free zones. The DIFC and ADGM are excluded and run their own regimes (DIFC Law No. 5 of 2020 and the ADGM Data Protection Regulations 2021) with active regulators, registration requirements and published fines. If your entity is in either financial free zone, that regime applies to its processing instead of the PDPL.

Is your marketing data PDPL-ready?

We audit your forms, pixels, lists and WhatsApp flows against the 16-point checklist above and fix the suppression plumbing that fails most often.