Data protection practices in e-commerce websites privacy policies

Purpose Data privacy is a crucial issue in e-commerce because it directly influences consumer trust and regulatory compliance. This study aims to investigate the status of privacy practices on Saudi e-commerce websites before the enforcement of the Personal Data Protection Law (PDPL), focusing on transparency, consent and discrepancies between Arabic and English privacy policies. Design/methodology/approach The research examined privacy policies from 17 Saudi e-commerce websites using qualitative text analysis. Policies were evaluated for clarity, consent mechanisms, notification practices and data disposal provisions, with special attention to differences between Arabic and English versions. Findings The results show that 70% of policies did not provide consumers with clear choices about sharing data, and 65% used ambiguous language when explaining data collection. In addition, 40% of the websites had discrepancies between Arabic and English policies, with English versions generally clearer and better aligned with regulatory requirements. Many websites lacked strong mechanisms for notification, consent and data disposal. Research limitations/implications This research paper is restricted to the content analysis of privacy policies as publicly stated by 17 Saudi e-commerce websites. While the selection process was rigorous, the sample size inherently limits the generalizability of the findings. It, nevertheless, does not appraise actual implementation or enforcement of these privacy policies in actual sense, i.e. the working practices. Therefore, the findings may not be fully reflective of how privacy protection is applied and followed by these enterprises. Future research must comprise empirical data, user experience, compliance auditing or organizational behavior, to evaluate the efficacy and realistic observation of privacy regulations. Practical implications Businesses should strengthen privacy policies, ensure consistency across languages, and adopt transparent consent and disposal mechanisms. Regulators can use these findings to refine PDPL enforcement. Social implications Discrepancies between Arabic and English policies create exclusion risks for Arabic-speaking users, weakening trust. Improving inclusivity and transparency can enhance digital trust and consumer empowerment. Originality/value To the best of the authors’ knowledge, this study provides a unique baseline assessment of Saudi e-commerce privacy practices and is the first to systematically compare Arabic and English policies, offering valuable insights for regulators and businesses in emerging digital markets

Audit · Confidentiality · Data Protection Act 1998 · Enforcement · Generalizability theory · Information privacy · Personally identifiable information · Privacy by Design · Privacy policy · Privacy-Preserving Technologies in Data · Privacy, Security, and Data Protection · Technology Adoption and User Behaviour

• Trust and TAM in Online Shopping

  David Gefen, Elena Karahanna et al.•MIS Quarterly•2003

  Add to list

• Administrative Measures for Protecting Personal Data in Saudi Law An Analytical and Practical Study

  Open Access•Salih Alsamhan•Journal of Posthumanism•2025

  Add to list