Data protection practices in e-commerce websites privacy policies: multidimensional study in Saudi Arabian context

Purpose Data privacy is a crucial issue in e-commerce because it directly influences consumer trust and regulatory compliance. This study aims to investigate the status of privacy practices on Saudi e-commerce websites before the enforcement of the Personal Data Protection Law (PDPL), focusing on transparency, consent and discrepancies between Arabic and English privacy policies. Design/methodology/approach The research examined privacy policies from 17 Saudi e-commerce websites using qualitative text analysis. Policies were evaluated for clarity, consent mechanisms, notification practices and data disposal provisions, with special attention to differences between Arabic and English versions. Findings The results show that 70% of policies did not provide consumers with clear choices about sharing data, and 65% used ambiguous language when explaining data collection. In addition, 40% of the websites had discrepancies between Arabic and English policies, with English versions generally clearer and better aligned with regulatory requirements. Many websites lacked strong mechanisms for notification, consent and data disposal. Research limitations/implications This research paper is restricted to the content analysis of privacy policies as publicly stated by 17 Saudi e-commerce websites. While the selection process was rigorous, the sample size inherently limits the generalizability of the findings. It, nevertheless, does not appraise actual implementation or enforcement of these privacy policies in actual sense, i.e. the working practices. Therefore, the findings may not be fully reflective of how privacy protection is applied and followed by these enterprises. Future research must comprise empirical data, user experience, compliance auditing or organizational behavior, to evaluate the efficacy and realistic observation of privacy regulations. Practical implications Businesses should strengthen privacy policies, ensure consistency across languages, and adopt transparent consent and disposal mechanisms. Regulators can use these findings to refine PDPL enforcement. Social implications Discrepancies between Arabic and English policies create exclusion risks for Arabic-speaking users, weakening trust. Improving inclusivity and transparency can enhance digital trust and consumer empowerment. Originality/value To the best of the authors’ knowledge, this study provides a unique baseline assessment of Saudi e-commerce privacy practices and is the first to systematically compare Arabic and English policies, offering valuable insights for regulators and businesses in emerging digital markets.