Consent as Experience

The Pop-Up Nobody Designed

Every organisation operating in the Gulf now has to show a consent screen. Almost none of them have designed one. The default has been to bolt a legal disclosure onto the front of the customer journey, written by counsel, approved by no one who thinks about experience, and shown to a hundred percent of visitors before they see anything else the brand actually wants them to see. That is a strange place to leave undesigned.

The UAE's Federal Decree-Law No. 45 of 2021 and Saudi Arabia's PDPL, fully enforceable since 14 September 2024, both require consent that is specific, informed and revocable — not a single buried checkbox. Neither law asks for good design. But both create the same forcing function GDPR created in Europe from 2018: a mandatory, high-visibility moment at the very start of the relationship. What a company does with that moment is now a choice, not an accident.

The consent screen is the first sentence of a conversation the customer never asked to start. What it says about the brand sets the tone for everything after.

Why This Counts as Experience, Not Legal Text

Behavioural science has a name for what most consent banners exploit: choice architecture. A prominent green 'Accept All' button next to a greyed-out, hard-to-find 'Manage Preferences' link is a default engineered to push customers toward maximum data sharing. It works, in the narrow sense that it raises acceptance rates. It also teaches the customer, in their very first interaction, that the brand is willing to use friction against them.

That lesson compounds. Loss aversion and the affect heuristic mean early negative impressions carry disproportionate weight — a customer who feels tricked into consenting is primed to distrust every subsequent claim of personalization being 'for their benefit'. Conversely, a consent flow that offers real, legible choice — plain language, granular toggles, a visible way to change your mind later — signals competence and respect before a single product feature has been used.

This is why the framing matters more than the legal minimum. Two consent screens can satisfy the same statute while producing opposite customer reactions: one reads as an obstacle to be cleared as quickly as possible, the other reads as evidence that the brand has thought carefully about the relationship it wants. The difference is entirely in the design decisions layered on top of the legal requirement, not in the requirement itself.

From One-Off Banner to Living Preference Centre

The more sophisticated shift is structural: replacing the single consent event with a persistent preference centre the customer can return to. Regulation in the UAE and Saudi Arabia explicitly requires the ability to withdraw consent as easily as it was given — which a one-time pop-up cannot deliver. A living settings page can, and it turns a legal obligation into an ongoing point of contact.

• Granular categories instead of an all-or-nothing toggle — marketing, analytics, third-party sharing shown separately
• Plain-language explanations of what each category actually changes for the customer, not just legal category names
• A visible, permanent link to revisit and adjust choices, not a setting buried three menus deep
• Consistent tone across the consent screen and the rest of the brand's voice, so it reads as the same company

Building this as infrastructure rather than a one-time pop-up also has an operational benefit: it removes the recurring cost of re-engineering the banner every time a new data use case appears. A well-structured preference centre absorbs new categories as toggles rather than requiring a fresh legal review and a fresh piece of interface work each time.

What Good Consent Design Buys the Business

There is a commercial argument alongside the ethical one. Personalization only works with data, and data only flows from consent. Every dark-pattern banner that tricks a customer into accepting also teaches that customer to distrust the personalization built on top of it — eroding the very asset the company was trying to protect. A consent flow that earns a genuine, informed yes produces a customer more willing to accept relevant offers, because they understood and agreed to the trade-off in the first place.

Regulators in both the UAE and Saudi Arabia are still in early enforcement phases, which means the standard for 'good enough' consent design is still being set by the market rather than by case law. Organisations that treat their preference centre as a design project now — rather than waiting for an enforcement action to force the issue — get to define what trustworthy data practice looks like in their sector, ahead of competitors who are still treating it as an IT ticket.

The Renascence View

Consent is the first moment in any digital journey where a brand tells the truth about what it wants from the customer. Treating that moment as throwaway legal text is a missed opportunity dressed up as compliance. The organisations moving fastest are folding consent design into their core CX practice — same scrutiny, same testing, same tone-of-voice standards as any other touchpoint — because the alternative is teaching customers, in the very first seconds of the relationship, exactly how much the brand values their time.