( Guide · Websites · Privacy )

Cookie consent banners and Google Consent Mode for websites in Oman: what the PDPL asks for and how to keep your analytics and ads working

Oman's Personal Data Protection Law does not mention cookies by name, but it does require notice before personal data is collected and explicit consent where no other legal basis applies, and analytics and advertising tags collect device identifiers and browsing data. The safe pattern for an Omani website is: essential cookies only on first load, a banner in Arabic and English that offers Accept and Reject with equal weight, analytics and ad tags that wait for a choice, a record of each choice, and a link in the footer that lets visitors change their mind. Google Consent Mode v2 is how you pass that choice to Google Analytics 4 and Google Ads. In basic mode Google tags do not load at all until the visitor accepts. In advanced mode they load with consent denied and send cookieless pings, which lets Google model the conversions you cannot measure. Google's own EU user consent policy covers visitors in the European Economic Area, the UK and Switzerland, not Oman, so the reason to do this for Omani visitors is the PDPL and your customers' trust, and the reason to do it properly for European visitors (tourists booking hotels and tours, for example) is Google's policy as well. The Meta Pixel has its own consent switch, and every other script needs to be checked one by one. A legally required banner does not count against you in Google Search, provided it covers part of the page and does not redirect visitors elsewhere. This guide is from OGB Labs, a website development company in Muscat, and is based on Google's and Meta's developer documentation; it is practical guidance, not legal advice.

By OGB Labs · Published 2 November 2026

What the PDPL means for cookies and tracking scripts

Oman's Personal Data Protection Law (Royal Decree 6/2022, enforced since 5 February 2026 and amended by Royal Decree 68/2026) defines personal data broadly enough to include device identifiers and online behaviour linked to a person. Our PDPL guide for websites and apps covers the whole law; the parts that matter for cookies are these:

Notice before collection. The privacy notice, in Arabic, has to reach people before their data is collected, which means before the analytics tag fires, not after.
Explicit consent where no other basis applies. Measuring visitors and building ad audiences is not needed to deliver what a visitor asked for, so consent is the basis you can rely on. Pre-ticked boxes, "by using this site you agree" lines and consent buried in the terms do not count as explicit.
A record. You should be able to show what a visitor agreed to and when.
Withdrawal. People can withdraw consent, so the choice has to be reversible from any page, not only from the first banner.
Transfers abroad. Google Analytics, Google Ads, Meta and most chat and heatmap tools process data outside Oman. The amended law requires explicit consent and an equivalent level of protection for transfers, so name these services in the notice.
Essential cookies are different. A cookie that keeps a cart, a login session, a language choice or a security check is part of delivering the service the visitor asked for. These can load without a banner choice, and you should still list them in the notice.

Google's consent rules: EEA, UK and Switzerland, not Oman

Google's EU user consent policy requires sites that use Google products to obtain legally valid consent for cookies where the law requires it and for ad personalisation, to keep records of consent and to explain how to withdraw it. The policy applies to end users in the European Economic Area, the UK and Switzerland. It does not mention Oman or the Gulf.

So Google does not require Consent Mode for visitors in Oman; the PDPL is the reason to ask them. Where Google's rules do bite is European traffic. A hotel in Muscat, a tour operator in Salalah or a dive centre in Musandam can get a large share of visitors from Germany, Italy, France or the UK, and Google's policy requires valid consent before that traffic is used for ad personalisation and remarketing. Google's Consent Mode set-up guide recommends scoping defaults to the regions where you show a banner; for an Omani site, we show it to everyone.

What Google Consent Mode is

Consent Mode is not a banner. It is a set of signals that tells Google tags what a visitor chose, so the tags change their behaviour. You still need a banner: either a consent management platform (CMP) or a banner your developer builds. Google's Consent Mode overview lists the consent types below; the first four control analytics and ads. Version 2, introduced in November 2023, added `ad_user_data` and `ad_personalization`.

Consent Mode consent types
Consent type	What it controls	On an Omani website
analytics_storage	Analytics cookies such as visit duration	Google Analytics 4 measurement
ad_storage	Advertising cookies and identifiers	Google Ads conversion tracking and remarketing
ad_user_data	Sending user data to Google for advertising	Enhanced conversions, which send hashed email or phone
ad_personalization	Personalised advertising	Remarketing lists and similar audiences
functionality_storage	Functional storage such as language settings	Arabic or English choice; usually essential
security_storage	Authentication and fraud prevention	Logins and form protection; essential

Basic or advanced Consent Mode: which one for Oman

Google describes two implementations. In basic mode, Google tags are blocked until the visitor interacts with the banner; if they reject, nothing at all is sent to Google, not even the consent state, and Google Ads models conversions with a general model. In advanced mode, the tags load straight away with consent set to denied, send what Google calls cookieless pings (a timestamp, the user agent, the referrer, whether the page had an ad click identifier, and the consent state), and write cookies only after the visitor accepts. Google says advanced mode gives an advertiser-specific conversion model instead of a general one.

For a typical Omani business site we recommend basic mode: it matches the PDPL's notice-before-collection idea most cleanly, and it is easy to explain in the privacy notice. Advanced mode recovers more measurement for businesses with large Google Ads budgets, but cookieless pings are still requests to Google's servers that carry the visitor's browser details and, like any web request, their IP address, so treat it as a decision for your legal adviser rather than a default.

Basic and advanced Consent Mode compared
Criteria	Basic	Advanced
Before a choice	Google tags do not load	Tags load with consent denied
If the visitor rejects	Nothing is sent to Google	Cookieless pings are sent
If the visitor accepts	Tags load and measure normally	Cookies are written and full data is sent
Conversion modelling in Google Ads	General model	Advertiser-specific model
Our default for Omani sites	Yes	Only after legal review, for large ad budgets

Step by step: setting it up on an Omani website

List every script on the site. Open the site with the browser's developer tools and record each third-party request: Google Analytics, Google Ads, Tag Manager, the Meta Pixel, TikTok or Snap pixels, Microsoft Clarity or Hotjar, chat widgets, YouTube and Google Maps embeds. Each one goes into a category: essential, analytics or advertising.
Choose a banner. A CMP is the quickest route; Google's help article on obtaining consent lists CMPs that integrate with Consent Mode and Tag Manager templates. A banner built into the site is lighter and fully bilingual, and is what we build on custom Next.js sites.
Write the banner text in Arabic and English. Say in one or two sentences what you use cookies for, link the privacy notice, and give Accept, Reject and Settings buttons the same size and prominence. A tiny grey Reject link is not a free choice.
Set the default before any tag runs. With gtag.js, Google's documentation says to call `gtag('consent', 'default', {...})` on every page before any `config` or `event` command, with `analytics_storage`, `ad_storage`, `ad_user_data` and `ad_personalization` set to `denied`. In Tag Manager, use a consent template rather than raw gtag commands.
Update on the visitor's choice. When the visitor clicks Accept, call `gtag('consent', 'update', {...})` with the granted types on the same page, before they navigate away. If they choose analytics but not advertising, grant only `analytics_storage`.
Save the choice yourself. Google notes that Consent Mode does not store choices, so keep the choice in a first-party cookie or local storage and apply it on every page load. Keep a server-side log too, with a timestamp and the banner version, so you can show what was agreed.
Gate the tags that have no consent checks. Google tags (Google Analytics, Google Ads, Floodlight, Conversion Linker) adjust themselves. Everything else does not. In Tag Manager, set consent requirements under Advanced > Consent Settings on each other tag; in code, load the script only after consent.
Add a way back. Put a "Cookie settings" link in the footer of every page, in both languages, that reopens the banner. When someone withdraws, send an update with the types set to `denied`.
Test it. Google's Consent Mode debugging guide uses Tag Assistant to show the default and updated states; the `gcs` and `gcd` parameters in Google requests carry the consent state. Check that no analytics or ad request leaves the browser before a choice in basic mode, and test Arabic and English, mobile and desktop.

The Meta Pixel, TikTok and other scripts

Instagram and Facebook ads are the main paid channel for many Omani businesses, so the Meta Pixel is often the most important script on the page after Google. Meta's Pixel consent documentation provides `fbq('consent', 'revoke')`, called before `fbq('init', ...)` on every page, which holds Pixel events back, and `fbq('consent', 'grant')` once the visitor accepts. Meta lists what the Pixel receives: HTTP headers including the IP address and page details, the Pixel ID and Facebook cookie, button clicks and their labels, and form field names (not the values, unless you switch on advanced matching).

Apply the same rule to TikTok, Snap and LinkedIn tags, heatmap and session-recording tools, and chat widgets that set their own cookies. YouTube and Google Maps embeds load Google cookies too: show a placeholder with a play button or "Load map" link and load the embed only when the visitor clicks. If you run click-to-WhatsApp ads, much of your conversion data stays inside Meta's apps and does not depend on the website Pixel at all.

Keeping your GA4 and Google Ads data useful

Expect your reported numbers to drop once analytics waits for consent: visitors who reject or ignore the banner are no longer counted in basic mode. That is the cost of measuring lawfully, and the trend lines still tell you what is working. A few settings help:

Region controls in GA4. Google's Analytics privacy controls let you switch off Google signals and granular location and device data per region. Google's statement that Analytics does not log IP addresses applies to users in the EU, Switzerland and the UK; it says nothing similar for Oman, so turn off the controls you do not need.
URL passthrough. With `gtag('set', 'url_passthrough', true)`, Google passes ad click identifiers such as `gclid` through page links instead of cookies, which helps Google Ads attribute conversions when ad cookies are denied.
Ads data redaction. With `ads_data_redaction` set to true and `ad_storage` denied, Google redacts ad click identifiers in its pings, which suits a cautious set-up in advanced mode.
First-party lead data. Many Omani leads arrive by call or WhatsApp, not by form. Record the source in your CRM when the lead comes in; that data is yours and does not depend on cookies. Our guide to measuring AI search traffic in GA4 and Search Console shows the reports worth keeping.

Does a cookie banner hurt SEO or speed?

Not if it is built well. Google's guidance on interstitials and dialogs treats legally required dialogs differently from promotional pop-ups, and recommends that even mandatory ones overlay the content rather than redirect every URL to a separate consent page, because Googlebot would then only see that one page. A banner across the bottom or a corner of the screen, with the page content in the HTML underneath, is fine for crawling and for AI search tools that read your pages.

Speed is the other risk. A banner that pushes the page down when it appears causes layout shift, which hurts Cumulative Layout Shift in Core Web Vitals; a fixed-position banner that sits over the page does not. Heavy CMP scripts can also slow the first load, so check your Core Web Vitals after installing one, and prefer a lightweight banner on a fast site.

Common mistakes we find on Omani websites

Cookie and consent mistakes, and the fix
Mistake	Why it matters	Fix
Analytics and the Meta Pixel fire on first load	Data is collected before notice or consent	Default denied; load tags only after Accept
Banner with only an OK or Accept button	No real choice, so no explicit consent	Accept, Reject and Settings with equal weight
English-only banner and privacy notice	Notice is expected in Arabic	Arabic and English, matching the page language
Choice not remembered across pages	Banner repeats, or tags fire on the next page	Store the choice in a first-party cookie
No way to change the choice later	Consent cannot be withdrawn	Cookie settings link in every footer
Consent Mode v1 only	No ad_user_data or ad_personalization signals	Upgrade to v2 with all four types
Full-page consent wall or redirect	Blocks visitors and crawlers	A banner that overlays part of the page
YouTube and Maps embeds load on first view	Google cookies set without a choice	Click-to-load placeholders

How OGB Labs helps

Every website we build in Oman ships with a bilingual consent banner, Google Consent Mode v2, the Meta Pixel and other tags gated on consent, a stored record of each choice, and a privacy notice in Arabic and English that names the services you use. For existing sites we audit what fires before consent, fix the banner and tag set-up, and check that your Google Ads and digital marketing reporting still works afterwards. The Ministry of Transport, Communications and Information Technology publishes the law, regulations and templates on its personal data protection portal. Run the free website check or message us on WhatsApp at +968 7111 0727.

( FAQ )

Questions people ask.

Do I need a cookie banner on my website in Oman?

If the site uses analytics, advertising pixels or other non-essential cookies, yes in practice. The PDPL does not mention cookies by name, but it requires notice before collection and explicit consent where no other legal basis applies, and these tools collect device identifiers and browsing data. A site with only essential cookies needs a privacy notice but not a consent choice.

Is Google Consent Mode required for Omani websites?

Google's EU user consent policy applies to visitors in the European Economic Area, the UK and Switzerland, not Oman. You need Consent Mode to pass PDPL consent choices to Google tags correctly, and you need it for European visitors if you use Google Ads personalisation or remarketing.

What is Consent Mode v2?

The version Google introduced in November 2023, which added the ad_user_data and ad_personalization consent types to the original ad_storage and analytics_storage. Sites still on the old version should upgrade.

Should I use basic or advanced Consent Mode?

For most Omani business sites, basic: Google tags do not load until the visitor accepts, so nothing is sent before consent. Advanced mode sends cookieless pings before consent and gives better conversion modelling; consider it only after legal review and when Google Ads spend justifies it.

Will a cookie banner reduce my Google Analytics numbers?

Yes. Visitors who reject or ignore the banner are not measured in basic mode, so reported sessions and conversions fall. Trends remain useful, and recording lead sources in your CRM keeps the numbers that matter most.

Does a cookie banner affect SEO?

Not if it overlays part of the page. Google treats legally required dialogs differently from promotional pop-ups, but recommends never redirecting pages to a separate consent page and never hiding all the content, because crawlers would then see only the consent screen.

Does the Meta Pixel need consent in Oman?

Treat it as non-essential. Meta's own documentation provides fbq('consent', 'revoke') before the Pixel initialises and fbq('consent', 'grant') once the visitor accepts. The Pixel receives the IP address, page details, button clicks and form field names.

Do essential cookies need consent?

Cookies needed for what the visitor asked for, such as the cart, login, language choice and security checks, can load without a banner choice. List them in the privacy notice.

Does the banner have to be in Arabic?

The PDPL notice is expected in Arabic, and a bilingual site should show the banner in the language of the page, with an English version on English pages.

How do visitors withdraw cookie consent?

Put a cookie settings link in the footer of every page that reopens the banner. When a visitor withdraws, update Consent Mode to denied and stop the other tags from loading.

( Related )

Service · 01

Want this done for you?

Tell us what you are building. We reply within one business day.

Start a projectWhatsApp +968 7111 0727Or check your website and SEO free