One Year After the PDPL: a Glimpse into the E-Commerce World in Saudi Arabia
This paper evaluates the one-year implementation of Saudi Arabia's Personal Data Protection Law (PDPL) by analyzing 100 e-commerce websites, revealing widespread non-compliance—particularly among top-ranked and locally hosted sites—and demonstrating the potential of Large Language Models to automate privacy policy assessment while offering recommendations for stakeholders.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine Saudi Arabia just built a new, very strict "Digital Lockbox" law called the PDPL (Personal Data Protection Law). This law says that if a shop wants to keep your name, address, or credit card number, they must tell you exactly how they use it, how long they keep it, and how you can get it back or throw it away.
This paper is like a mystery detective story where two researchers (Eman and Abeer) went on a mission to see if 100 popular online shops in Saudi Arabia were actually following these new rules one year after the law started.
Here is the story of what they found, explained simply:
1. The "Menu" Problem (Privacy Policies)
Think of a website's Privacy Policy as the restaurant menu. The law says the menu must be clear and tell you exactly what ingredients (data) are in the dish and how long it stays on the shelf.
- The Bad News: The researchers found that 40% of the shops didn't even have a menu (no privacy policy).
- The "Fine Print" Trap: Even among the shops that did have a menu, most were hiding the important details.
- The "How Long?" Question: Only about half of the menus said how long they keep your data.
- The "Delete Me" Button: Only half told you how to ask them to throw your data in the trash.
- The "Show Me" Request: Only a third told you how to ask for a copy of your data.
- The "Complaint Box": Only a third gave you a clear address to send a complaint if they messed up.
The Verdict: Only 31% of the shops had a "perfect menu" that answered all the questions. The rest were either missing the menu entirely or serving a menu with huge gaps in the text.
2. The "Big Fish" Paradox
You might think the biggest, most famous shops (the ones that show up first when you Google "buy shoes in Saudi") would be the most careful. You'd be wrong.
- The Analogy: Imagine a race. You'd expect the runners in the front (the top-ranked websites) to be the most disciplined. But in this race, the front-runners were actually the ones tripping over their own shoelaces the most.
- The Finding: The top-ranked websites had the highest rate of breaking the rules (60% were non-compliant).
- The Local Platform Twist: Many of these top shops use local Saudi "shop-in-a-box" platforms (like Salla or Zid). The researchers found that 70% of the shops using these local platforms were non-compliant.
- Why? It seems like small business owners using these local platforms think, "Hey, the platform handles the security, so I don't need to worry about my own privacy rules." But the law says the shop owner is still responsible, like a restaurant owner is responsible for the food even if they buy the ingredients from a supplier.
3. The "Robot Lawyer" Experiment
The researchers also tried something new. Instead of reading all 100 privacy policies themselves (which is like reading 100 long novels), they asked an AI Robot (a Large Language Model) to read them and answer the questions.
- The Result: The Robot was surprisingly good! It agreed with the human researchers about 80-90% of the time.
- The Robot's Superpower: The Robot was actually better than humans at finding tiny details hidden in very long, messy documents. If a policy was 5,000 words long and buried the answer in paragraph 400, the human might miss it, but the Robot found it.
- The Robot's Weakness: The Robot sometimes got confused by "mixed languages." If a policy was written for Europe (using European laws) but applied to Saudi Arabia, the Robot might get the wrong answer because it didn't know the specific Saudi rules. It also sometimes got tricked by text that was hidden in the background code of the website.
4. What Does This Mean for You?
- For Shoppers: Just because a website looks professional or shows up first in Google doesn't mean they are protecting your data. You might need to be extra careful.
- For Shop Owners: You can't just copy-paste a privacy policy from a template or assume your hosting platform does the work for you. You need to write your own clear rules.
- For the Government: They need to keep teaching businesses (especially small ones) that they are the ones responsible for the "Digital Lockbox," not just the platform they use.
The Big Takeaway
One year after the new law, Saudi Arabia's online world is still a bit chaotic. The "Big Fish" are the most likely to be breaking the rules, and while AI robots are great helpers for checking the rules, humans still need to guide them. The goal now is to turn those "missing menus" into clear, honest guides so everyone knows how their data is being treated.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.