🇸🇦Saudi Arabia's telecom law says nothing about WhatsApp calls, and something pointed about getting round a block

15 plans for Saudi Arabia, from 1 GB at $4.49 to 50 GB at $81.49, plus 7 unlimited-data tiers. 5 GB for 30 days costs $14.99 — 7th cheapest of 13 in the Middle East, against a $14.99 median. Our retail prices from the operator catalogue, checked 28 September 2026.

The Act does not ban app calls, and we counted

The current Saudi telecom law contains no prohibition on calling through an application. We read the Act in the Commission's own English text. It was issued under Council of Ministers Resolution No. 592 and Royal Decree M/106, both dated 1443 AH. The strings VoIP and voice over appear zero times in it. We ran that count ourselves on 8 September 2026.

That matters because the opposite is the thing travellers arrive believing. Saudi Arabia did restrict internet calling years ago, and the reputation outlived the rule. What the law regulates now is filtering, and filtering is not the same subject as an application category.

Article 24 is the clause that actually governs this

One article covers both halves of the question, and its second paragraph is the one to read twice. Article 24(1) empowers the Commission, after coordinating with the competent authorities, to «make internet filtering and limit access to a specific content on the internet, prevent or restrict access to internet services on the gateways». Article 24(2) then states: «It is prohibited to bypass or swindle internet filtering or to provide the means to do so.»

Note who that sentence addresses. It is not written about service providers, and it carries no exception for a visitor. Travel pages answer a Saudi blocking question by recommending a VPN. This is the written rule that advice runs into. **We are telling you what the Act says and stopping there.**

Owning a device without a licence is listed as a violation

The Act's list of violations includes a line that, read alone, would reach every phone in the Kingdom. Article 26(9) makes it a violation to be «Owning any telecommunications or information technology device without obtaining the necessary license». Article 26(1) sits next to it, covering acquisition or making available of devices «that are not compatible with the approved technical specifications and standards».

The penalty attached is large, which is why the clause needs finishing rather than quoting. Article 27(1) allows a fine «not exceeding (twenty-five) million Riyals», cessation of the service, a bar on obtaining licences, or blocking of a digital content platform, against «the person who commits any of the violations provided for in Article (Twenty - Six)». A sentence like that, quoted without the next section, is how a rumour starts.

The regulations deem an approved device licensed

The Implementing Regulations close Article 26(9) at the level of the device rather than the traveller. Article 91 has the Commission issue regulations covering technical specifications and «Licenses for telecommunications and information technology devices», and issue those licences itself. Article 92 then provides the mechanism that matters: where CST approves a list of national and international type-approval entities and laboratories, «the telecommunications devices and equipment approved by these entities shall be deemed licensed for usage in the Kingdom».

Deemed licensed. That is not a tourist exemption, and we will not dress it as one. It is the clause that takes an ordinary handset out of Article 26(9). The Implementing Regulations we read are dated Rabi' II 1444H, November 2022, on the Commission's own server.

You can check your own model against a public register

The Commission publishes the approved-device list, and it is browsable. Its Approved Devices directory reported 30,226 results on 8 September 2026. Entries carry a model code, a device name and a manufacturer. The first page alone showed an iPhone 17 Pro Max, an iPhone 17, a MacBook Air and several Apple Watch models.

That is a rare thing in this subject: a device question with an official register behind it. If your handset is a current model from a mainstream manufacturer, this is where its approval would appear. **Look your model code up before you worry about Article 26(9), not after.**

SIM registration is a Commission competence exercised on providers

Registration in Saudi Arabia is real and the Act frames it as regulation of the industry. Article 35 lists what the Commission is competent to set controls and rules for, and its paragraph (c) is «Authenticating, selling, promoting or using SIM cards». The same article's paragraph (b) covers agreements with providers outside the Kingdom «to provide international roaming service or any other service».

Both are powers of the Commission over the sector, not duties on you. The word subscriber does not appear in the Act at all, and neither does identity or identification. The Commission's own consumer page on eSIM even makes the point from the other direction: it says you can subscribe and download configuration profiles remotely «without the need to visit the operator's branch».

One article of the Act is written to protect you

Amid the violations there is a clause pointing the other way. Article 32 provides that phone calls and information sent or received over public telecommunications networks «shall be considered confidential and shall not be reviewed, listened to, or recorded except in the cases set out in the regulations». That is a protection with your name on it rather than a duty.

We flag it because a page listing only prohibitions gives a false shape of a legal system. Saudi Arabia's Act does both things, and the confidentiality clause is as much a part of it as Article 24.

What the Saudi profile actually is

You get data on Zain and nothing else. Our Saudi Arabia catalogue record names the seller Red Sand. It puts your profile on Zain at 5G, checked 8 September 2026. No minutes come with it, no texts, and no Saudi number in your name. The identity-check field on that record sits empty.

Two clocks run apart. You get a year from purchase to install the profile. The days you paid for start at the first connection. The record marks it «Rechargeable online with no expiry». Nothing about the purchase asks who you are.

Both ladders are long, and one tier is built for a long stay

Saudi Arabia has the fullest set of options in our catalogue. Metered sizes run 1, 2, 3, 5, 10, 20 and 50 GB (our Saudi Arabia catalogue record, checked 8 September 2026). A 25 GB tier sits alongside them and runs 45 days. Unlimited windows run 1, 3, 5, 7, 10, 15 and 30 days on the same record. A one-day unlimited tier exists, which few countries here have.

Pick against the shape of the trip rather than the map. A short Umrah visit is a few days of heavy messaging and photographs. That is what a 1-day or 3-day unlimited window is for. A longer stay crosses the 30-day line where most metered tiers stop. The 25 GB over 45 days is the only step built for it. Riyadh and Jeddah business weeks sit comfortably on a metered size.

Before you fly

Install at home over your own Wi-Fi, days ahead. Scan the QR from your order page and give the line a name you will recognise. Then leave it switched off until you land, because buying early costs you nothing on a year-long install window (our Saudi Arabia catalogue record, checked 8 September 2026).

Sort the two lines out before departure. Your home line keeps voice and bank messages, with its data roaming off. The Saudi line takes the data once you switch it on. **Enable data roaming for the travel line and for nothing else.**

Your first day, and the APN

Android owners type something here; iOS owners do not. Our Saudi Arabia catalogue record sets the APN automatically on iOS and manually on Android (checked 8 September 2026). The value it lists is globaldata, with isp as the alternative. A slash in a catalogue APN field is a list of options, not one string to type.

Then check the line properly. Open a web page rather than placing a call. This profile carries no voice, so a failed call tells you nothing. If nothing loads, check which line is set for mobile data, and whether roaming is on for it. Emergency dialling stays with your home line or with the handset itself.

Topping up

Recharge on the order page you already have open. Your profile is marked «Rechargeable online with no expiry» on the record, checked 8 September 2026, and no Saudi rule reaches that payment. Buy before the allowance empties, or the hotel Wi-Fi password becomes step one.

Read the two counters apart before a travel day. A metered 30-day plan runs out of gigabytes more often than it runs out of days. An unlimited day tier ends on schedule with the signal still full. Neither one warns you in time, and the desert road between cities is a poor classroom.

FAQ

Before you fly: the checklist

Sources and freshness

Telecommunication and Information Technology Act, issued under Council of Ministers Resolution No. 592 and Royal Decree M/106 of 1443 AH, Articles 24, 26, 27, 32 and 35, English text published by the Commission (used in every legal section, the FAQ and the checklist) — the document, read 8 September 2026.

Implementing Regulations of the Telecommunications and Information Technology Law, Rabi' II 1444H / November 2022, Articles 91 and 92 on device licensing and deemed licensing (used in section 4 and the FAQ) — the document, read 8 September 2026.

CST, Approved Devices directory, the public register of type-approved equipment, showing 30,226 results (used in section 5, the FAQ and the checklist) — the document, read 8 September 2026.

CST, eSIM consumer page, for the statement that a profile can be subscribed to and downloaded remotely without visiting a branch (used in section 6) — the document, read 8 September 2026.

Our Saudi Arabia catalogue record: seller, network, plan type, identity check, install window, activation, APN values, recharge and both package ladders, read 8 September 2026.

What we did not check: Nothing below is settled, and none of it is presented as settled. cst.gov.sa refuses ordinary requests from our environment, so every document above was retrieved through a commercial scraping proxy; the files are the Commission's own English PDFs, and the Act itself warns that «In the event of any discrepancy between the Arabic and the English versions, the Arabic version shall prevail». We did not read the Arabic originals, which is a real limitation on a page that leans on exact wording. We did not enumerate the Commission's regulatory decisions, so a decision issued under Article 24 setting the «regulating controls and requirements» it mentions went unread, and that is precisely where the operational detail on filtering would live. We found no published enforcement case applying Article 24(2) or Article 26(9) to a traveller, which is an absence in what we could search rather than proof that none exists. We tested no application inside the Kingdom and measured no blocking; every statement here comes from a text. Whether Zain applies any check of its own to an inbound roaming handset is not something we could verify. On the product side the record carries no coverage caveat, no Wi-Fi sharing field and no fair-use condition on the unlimited tiers, and it does not say whether a top-up extends the running window or opens a new one. We measured no speeds, and silence in a record is not a measurement.