Is WhatsApp Business API legal for marketing in Saudi Arabia?

Yes, with explicit consent under the PDPL, a working opt-out, a verified sender and no messaging at hours the CST would treat as intrusive. The platform is used by Saudi banks, retailers and government-adjacent entities; what is not legal is marketing to numbers that never agreed, whatever the channel.

Can a GCC company message Saudi customers from a UAE number?

Technically yes — WhatsApp delivers across borders and the conversation is priced by the recipient's country. Practically, a +971 display on a Saudi customer's phone reduces replies, the PDPL's transfer rules apply to where you store their data, and Saudi customers expect a Saudi number for anything they will call back. Most businesses selling seriously into the Kingdom verify a +966 number.

WhatsApp Business rules in Saudi Arabia: CST, PDPL and what changes from the UAE

Saudi Arabia regulates messaging through the CST (Communications, Space & Technology Commission) and consent through the Personal Data Protection Law enforced by SDAIA. Neither is the TDRA, the documents are different, and the marketing consent standard is stricter than most UAE businesses expect.

The Zanii platform team · 9/14/2026 · 8 min read

The documents Meta checks for a Saudi business

The commercial registration (CR) from the Ministry of Commerce, checked against the Wathq record: the entity name, the CR number and the region. A CR for Riyadh with a trading address in Jeddah is the mismatch that stalls verification. Freelancers on a freelance licence from the Ministry of Human Resources can verify under it; e-commerce stores on Maroof alone cannot — Maroof is a trust registration, not a licence, and Meta does not accept it as one.

The phone number: a Saudi mobile on stc, Mobily or Zain, or a landline with the regional prefix (+966 11 Riyadh, +966 12 Jeddah, +966 13 Eastern Province). Saudi SIM registration is tied to the Iqama or national ID of an individual, so a number registered to an employee rather than the company is common — and it leaves with the employee. Register the number to the CR through the operator's business portal before verifying it on WhatsApp.

Consent under the Saudi PDPL

The PDPL (in force since September 2023, enforced from September 2024) requires explicit consent for direct marketing, a clear way to withdraw it, and a record. It also restricts transferring personal data outside the Kingdom — which is the clause that matters for a UAE-hosted platform. Zanii's Saudi tenants have their data stored in-region, and the data-processing addendum names it; ask any provider where a Saudi customer's number physically sits, because SDAIA will.

The CST's side is sender identity and unsolicited messaging, enforced most visibly on SMS through the operators' registered sender names. On WhatsApp the equivalent is the verified display name and the opt-out. Saudi customers report unwanted messages at a higher rate than UAE customers, and the operators act on volume: a Saudi number whose marketing gets reported loses its quality rating faster than the same campaign would in Dubai.

Four things a UAE playbook gets wrong

The weekend. Saudi weekends are Friday and Saturday, the same as the UAE since 2022 — but Friday prayer hours are observed more strictly, and a campaign at 12:30 on Friday is the one that gets reported.
Arabic first. UAE B2B runs in English; Saudi consumer messaging runs in Arabic, and a template with English first and Arabic second reads as foreign. Write the Arabic template as the template, not as a translation.
Pricing. Meta prices Saudi conversations differently from UAE ones, and a campaign budget copied across the causeway is wrong in both directions. Check the rate for SA before quoting a cost per recipient.
Data residency. A UAE business can store Saudi customers' data in the UAE only with a lawful transfer basis; a Saudi business generally cannot store it abroad at all. Choose the platform region before the first contact is imported, not after.

What goes wrong

Verifying with a Maroof certificate and being declined without explanation.: Obtain a CR — a sole-establishment CR takes days through the Ministry of Commerce portal — and resubmit under it.
Running the Saudi number from the Dubai office's platform tenant.: Separate tenant, Saudi region, Saudi CR. The two markets share a template library at most; they do not share a contact list.
Assuming the Absher-registered number is the company's.: Absher registration is to a person. Move the number to the CR through the operator, or verify a landline that is already the company's.

Common questions

Is WhatsApp Business API legal for marketing in Saudi Arabia?: Yes, with explicit consent under the PDPL, a working opt-out, a verified sender and no messaging at hours the CST would treat as intrusive. The platform is used by Saudi banks, retailers and government-adjacent entities; what is not legal is marketing to numbers that never agreed, whatever the channel.
Can a GCC company message Saudi customers from a UAE number?: Technically yes — WhatsApp delivers across borders and the conversation is priced by the recipient's country. Practically, a +971 display on a Saudi customer's phone reduces replies, the PDPL's transfer rules apply to where you store their data, and Saudi customers expect a Saudi number for anything they will call back. Most businesses selling seriously into the Kingdom verify a +966 number.