Many people ask whether AI is watching them. This page answers a practical version of that question. It covers what data already exists about you, what AI can and cannot do with that data, which laws apply in each Gulf state, and who you can contact if something seems wrong.
It has two companion pages. For the fear itself and the evidence behind it, read Will AI be used to watch us?. For the everyday risks, especially scams and deepfakes, and habits that protect you, read our guide Is AI watching me? What happens to my data?.
The short answer
AI does not start from zero. The services many of us use every day already collect location, activity and device data, and their own privacy policies say so. What AI changes is how quickly that data can be sorted and searched. Wherever personal-data rules apply in the GCC, they apply to AI just as they apply to any other technology. Each state has a body you can contact about personal data, though the routes differ from country to country.
You already leave many digital traces
Before asking what AI might do, it helps to see what is already collected. These examples come from the companies' own policies and help pages.
- Google. Google's privacy policy (effective 16 October 2026) says it collects location information from sources including "GPS and other sensor data from your device", your IP address and your activity on Google services. It also collects activity such as the terms you search for, the videos you watch and your purchase activity (Google Privacy Policy).
- Google Maps Timeline. Timeline saves the places you visit and the routes you take. Google says it is "off by default", that the data comes from your device, and that you can turn it off or delete it at any time. If you choose to back it up, Google keeps an encrypted copy on its servers (Google Maps Help).
- Facebook, Instagram and other Meta services. Meta's privacy policy (effective 23 July 2026) says it collects content you create, "like posts, comments or audio", and information you share through device settings, "like GPS location, camera access, photos and related metadata". It also says: "We also receive and use some location-related information even if Location Services is turned off", including IP addresses, "which we use to estimate your general location" (Meta Privacy Policy).
- Phones and apps. Each app asks your phone for permissions such as location, camera or microphone. Android lets you allow location access "all the time", only while you are using the app, ask every time, or not at all (Android Help). On iPhone, location access is controlled under Settings > Privacy & Security > Location Services (Apple Support).
None of this is secret. It is set out in documents that few people read. The point is simple: an AI system that analyses personal data is usually working with data of this kind, collected in these ways. That is why the rules about data matter more than whether a system is labelled "AI".
What AI can and cannot do in surveillance-type uses
Face recognition compares a face in one image with faces in other images and gives a score for how alike they are. Its accuracy depends a great deal on the system. In 2019 the US National Institute of Standards and Technology (NIST) tested 189 face-recognition algorithms from 99 developers. It found "a wide range in accuracy across developers". Many algorithms wrongly matched people from some demographic groups more often than others. The fairest algorithms were also among the most accurate (NIST, 19 December 2019).
Pattern analysis looks for regularities in large amounts of data, such as movements, purchases or messages, and flags what stands out. It is good at sorting large volumes quickly. It is not good at knowing why something happened. A pattern is a statistical signal, not proof. It can point at the wrong person, and it carries over any gaps or bias in the data it learned from. Our page on bias explains how that happens.
The limits matter. A face match or a flagged pattern is a probability, not a fact. That is why serious guidance asks for human review of important decisions. Saudi Arabia's AI Ethics Principles, published by SDAIA, say that automated decisions that are irreversible or hard to reverse "should trigger human oversight and final determination". They add: "AI systems should not be used for social scoring or mass surveillance purposes" (SDAIA, AI Ethics Principles, September 2023).
The same privacy rules apply to AI
Data-protection laws are written about personal data and how it is processed, whatever the tool. The UAE government portal says the UAE law applies to processing personal data "in full or part through electronic systems" (u.ae). SDAIA's guide to the Saudi law quotes its Article 2, under which the law applies to any processing of personal data in the Kingdom "by any means" (SDAIA guide). An organisation that uses AI on your data must therefore follow the same rules as one that uses a spreadsheet.
Here is the main law in each GCC state and the body that oversees it, as we checked them on 27 October 2026. Each law has its own scope and exceptions, so check the text that applies to your situation.
| Country | Main personal-data rules | Who oversees them, and where complaints go |
|---|---|---|
| Saudi Arabia | Personal Data Protection Law, approved by Royal Decree No. M/19 (1443 AH). In force 14 September 2023, with a one-year grace period that ended on 14 September 2024 (SDAIA guide) | The Saudi Data and AI Authority (SDAIA). Its National Data Governance Platform offers an online service for submitting a complaint about personal data (dgp.sdaia.gov.sa) |
| UAE (federal) | Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022 (u.ae) | The UAE Data Office was given the job of setting up systems for data-protection complaints and grievances (u.ae). In June 2026 its functions were folded into the new Artificial Intelligence and Data Authority (Dubai Media Office, 14 June 2026). Financial free zones such as the DIFC have their own data-protection law (u.ae) |
| Qatar | Law No. 13 of 2016 on the Protection of Personal Data Privacy (DLA Piper) | The National Cyber Security Agency (NCSA), through its office for the protection of personal data privacy (QNA, 17 March 2025). Any data subject may submit a complaint about a violation of the law (DLA Piper) |
| Bahrain | Law No. 30 of 2018 issuing the Personal Data Protection Law (Legislation and Legal Opinion Commission) | The Personal Data Protection Authority. Under Article 25, anyone with an interest may complain to the Authority if they have reason to believe the law has been broken (law text) |
| Oman | Personal Data Protection Law, issued by Royal Decree No. 6/2022 and in force since 13 February 2023 (Qanoon.om; Clyde & Co) | The Ministry of Transport, Communications and Information Technology. Under Article 12, a data subject may submit a complaint to the Ministry (Qanoon.om) |
| Kuwait | No single general data-protection law (DLA Piper; Chambers, 2026). CITRA's Data Privacy Protection Regulation (Decision No. 26 of 2024) covers how telecoms and IT service providers handle data (CITRA) | The Communication and Information Technology Regulatory Authority (CITRA), which runs a complaints service for users (CITRA) |
Some laws also deal with automated decisions directly. The UAE law, for example, includes a right to object to decisions that result from automated processing, with some exceptions (Article 18, per DLA Piper). For a fuller table aimed at businesses, see our digitisation roadmap.
AI-specific guidance sits on top of these laws. SDAIA's AI Ethics Principles include "Privacy & Security" as one of seven principles (SDAIA). The UAE Charter for the Development and Use of AI lists data privacy among its 12 priorities (u.ae). These are principles and guidance rather than new laws, but they show where regulators expect AI systems to stand.
If you think something is not right
- Start with the organisation. Ask what personal data it holds about you, where it came from and why it uses it. The laws above give you rights such as access and correction. In Bahrain, for example, if a request is refused or not answered in time, the law lets you take a complaint to the Authority (law text).
- Keep a record. Note dates, screenshots and the replies you receive. A clear record helps any complaint.
- Contact the authority in your country. Use the body named in the table above.
- If it looks like a crime, go to the police. Fraud, hacking and blackmail are matters for the police, not only for a data regulator.
Settings you can check today
- App permissions. On Android, go to Settings > Apps, choose an app, then Permissions (Android Help). On iPhone, go to Settings > Privacy & Security > Location Services (Apple Support). Ask whether an app really needs your location "all the time".
- Google Maps Timeline. Check whether Timeline is on. You can turn it off or delete it from My Activity, or delete parts of it in the Google Maps app (Google Maps Help).
- Your Google Account. Google's privacy policy points to Privacy Checkup and My Activity, where you can review and delete saved activity (Google Privacy Policy).
- Facebook. Privacy Checkup is under Settings & privacy. It walks you through who can see what you share, how people can find you, your data settings for apps and websites, and your ad preferences (Meta Help Center).
What we don't know yet
- How well these laws are enforced in practice. A law protects people only when it is applied and when people know their rights.
- The UAE complaints route after June 2026. The Data Office's functions moved to the new Artificial Intelligence and Data Authority, and we have not yet found a published complaints process from the new authority.
- Whether Kuwait will adopt a general data-protection law. For now its main rules apply to telecoms and IT service providers.
The overall picture is steadier than the headlines suggest. Much of what AI could analyse is data we already share. Most of it is covered by rules that apply whatever the technology, and every GCC state has a body you can contact. A few minutes in your phone and account settings is a good place to start.