Saudi E-Commerce Law: What Online Sellers Must Do in 2026

Saudi Arabia has one rulebook for selling online: the E-Commerce Law of 2019 and its Implementing Regulations.

The good news? It's short and practical. Its 26 articles mostly come down to one idea: tell the customer the truth, in writing, before and after they pay.

That clarity is part of why Saudi shoppers buy online with confidence. It's also why new stores keep arriving: e-commerce registrations grew 23% in a year.

Below you'll find each rule a seller needs, the article it comes from, and a checklist for your own store.

What is the Saudi E-Commerce Law, and who does it cover?

It's the law that governs online sales to consumers in Saudi Arabia. Royal Decree M/126 issued it in 2019, and the Ministry of Commerce enforces it with its own Implementing Regulations.

The law calls every seller a "service provider". There are two kinds:

• Merchant: a business with a CR (commercial registration, your Saudi business licence) that sells online.
• Practitioner: someone who sells online without a CR, such as a freelancer or an Instagram shop.

Most duties apply to both. The law covers anyone selling continually for profit, so a regular social-media shop counts and a one-off private sale doesn't.

Here's the part foreign sellers miss. Article 2(b) extends the law to practitioners outside the Kingdom who offer products to Saudi consumers. A Shopify store in Shenzhen or Ohio that ships to Riyadh follows the same rules as a Riyadh store.

The law sits alongside VAT, licensing and product rules, all mapped in our guide to Saudi ecommerce regulations. Not sure which status fits you? Start with Saudi business registration.

What must your store display?

Article 6 lists what your store must show, or link to, at all times. Most sellers put it in the footer and an About or Legal page.

Item	When it's required	Article
Your name or identifying mark, and address	Always, unless your store is authenticated	Law Art. 6
Contact details	Always	Law Art. 6
CR name and number	If you have a CR	Law Art. 6
VAT number	If you're VAT-registered	Regs Art. 6
Privacy policy	Always	Regs Art. 6
Complaints procedure	Always	Regs Art. 6
Professional licence details	Regulated professions only	Law Art. 9
Authentication certificate	If you're authenticated	Regs Art. 16

If any of these details change, you must tell customers, so keep the footer current.

These items double as trust signals, and shoppers check them. Our Saudi trust signals checklist shows how to present them so they also lift conversion.

What must the checkout show before payment?

Before the customer pays, the law requires a clear statement of terms (Art. 7). It covers:

• The seller and the product: who you are and the product's main features.
• The total price: all charges, taxes and delivery fees, broken down, plus any recurring costs and how they're calculated.
• Payment and delivery: how they pay, how you ship, and when the order arrives.
• Warranty and after-sales service: what you cover and how to claim it.
• The cancellation right: whether it applies, what it costs and how to use it, or which exemption applies.

Then there's the pay button. Regs Art. 7(2) says it must make clear that clicking concludes the contract and creates an obligation to pay.

"Place order and pay" does the job, while a vague "Continue" doesn't.

Show prices with 15% VAT included from the product page onward. Our VAT-inclusive pricing guide has the setup.

What must the receipt include?

After purchase, send a receipt the customer can download (Regs Art. 8). It must show:

1. Your name or trade name, and a description of the product.
2. The order confirmation and the order date.
3. The total, with the tax amount, a price breakdown and the shipping charges.
4. Your VAT number.
5. The delivery date, the carrier's name and the tracking details.
6. A summary of your refund and replacement rules.
7. The payment method and confirmation of payment.

Standard order emails often stop at the price. Add the delivery date, carrier, tracking link and refund summary to your template.

VAT-registered sellers also issue ZATCA e-invoices. See ZATCA e-invoicing for that layer.

Cancellation, returns and late delivery

Two clocks start when someone orders, and knowing both will save you most disputes.

The 7-day cancellation right

Customers can cancel within seven days of receiving an item, as long as they haven't used it. By default the customer pays the return cost. Many Saudi stores offer free returns anyway, because it sells.

Some products have no cancellation right, unless you choose to offer one:

• Made to order: customised goods, unless they're faulty or not as described.
• Hygiene and perishables: goods that can't be resold for health reasons, and food that spoils.
• Media: books, newspapers, magazines, and opened audio, video or software.
• Volatile prices: gold, silver and other goods priced on fast-moving markets.
• Services: travel, hotels, transport, catering and event tickets.

The 15-day late-delivery rule

If an order is more than 15 days late against the agreed date, the customer can cancel. They get a refund plus any costs the delay caused. Force majeure and a new date the customer accepted are the exceptions.

You must also warn customers of an expected delay.

For example, say a London store promises a serum by 1 March, and the parcel stalls in transit. If the store messages before the due date with a new date and the customer agrees, the clock moves.

If it stays silent, the customer can cancel from 17 March, when the order becomes more than 15 days late. They don't have to wait for the parcel. If it lands on 18 March, 17 days late, they can still refuse it and claim costs.

Your practical returns setup is in Saudi returns, and warranty and defective-goods rules are in Saudi consumer protection.

What are the advertising rules?

An online ad is part of the contract (Art. 10). Whatever you promise in it, you must honour.

Every ad must:

• Name the product and the seller, with contact details, though authenticated stores can leave out their name.
• Say clearly that it's an ad, including paid influencer posts.
• Be truthful, with no misleading claims and no counterfeit or unlicensed trademarks (Art. 11).
• Offer an opt-out from marketing messages, and honour it.

If the Ministry finds a problem, it can order the ad fixed or withdrawn within one day (Art. 12). Influencers need their own licence too, which our influencer marketing guide explains.

How must you handle customer data?

Keep personal data only as long as the order needs, unless the customer agrees to longer. Don't share it without consent (Art. 5).

The regulations add three practical duties:

• Marketing needs express prior consent, so use a separate opt-in box.
• Account closure must be easy, and a clear "delete my account" link works.
• Breaches must be reported to the Ministry and to affected customers within 3 days.

The PDPL (Personal Data Protection Law) adds its own duties on top. See Saudi data protection for the full list.

Do you need to register or authenticate your store?

If you hold a CR, add your main online store to it within 30 days of launch (Regs Art. 12). Report changes within 30 days too.

E-store authentication is the state's way of verifying a seller. In March 2023, the Ministry moved it from Maroof to the Saudi Business Center's Business Platform. It's free, and authenticated stores must show the certificate.

The steps are in Maroof and the Saudi Business Center.

What are the penalties?

The Ministry of Commerce can apply these under Art. 18:

• A formal warning to fix the problem.
• A fine of up to SAR 1 million per violation.
• Temporary or permanent suspension of your e-commerce activity.
• Partial or full blocking of your online store.

Penalties scale with how serious and repeated the breach is, the harm and the size of your business (Art. 19). Decisions can be published at your expense, and you can appeal to the Board of Grievances.

Urgent blocking cases reach a committee within 3 days, and it decides within 10.

Your E-Commerce Law checklist

Notes for foreign stores

The law applies to you, even without a Saudi entity. In practice, enforcement against stores abroad comes through blocking and through the marketplaces and payment partners you rely on.

• Show where you're registered, with your company name, country and registration number.
• Price landed, showing SAR totals with VAT and duties included.
• Date honestly, because cross-border shipping is where the 15-day rule bites.

For the practical routes in, see selling online in Saudi Arabia.

Notes for marketplace sellers

Selling only on noon or Amazon.sa? The law still applies to you as a service provider, even though the marketplace runs the checkout.

The marketplace has extra duties of its own (Regs Art. 18). It must verify seller data, keep contract records for at least 3 years and give a week's notice of rule changes. That's why it asks for your CR or authentication at sign-up.