A record Hajj, and a record surveillance footprint
Saudi Arabia's General Authority for Statistics (GASTAT) confirmed that 1,707,301 pilgrims performed Hajj in 2026, up from 1,673,230 the year before, drawing on Ministry of Interior administrative records rather than survey sampling (GASTAT, stats.gov.sa). Managing a crowd of that size inside a few square kilometers of Mecca is a genuinely hard logistics problem, and this year's answer was technological: authorities deployed facial recognition at entry points, drones and fixed-wing aircraft carrying thermal imaging, AI-driven crowd-congestion prediction, and a Unified Security Operations Center coordinating it all, under the enforcement banner "No Hajj without a permit" (Middle East Monitor, May 22, 2026). What has not appeared anywhere in that rollout is a public privacy-impact assessment.
The steelman: crowd control here is a life-and-death problem
It is worth stating the case for this system plainly, because it is a strong one. Hajj crush events are not hypothetical risks — independent tallies of the 2015 Mina crush put the death toll above 2,000, several multiples of Saudi Arabia's initial official count, making it the deadliest disaster in Hajj history. A permit-only Hajj, enforced through real-time identity verification and predictive crowd analytics, is a defensible response to a recurring mass-casualty risk, not an invented pretext for surveillance. Saudi authorities are also blunt about what the permit system is for: violators face a SAR 20,000 fine (~$5,300), facilitators face up to SAR 100,000 (~$26,700), and unauthorized pilgrims face deportation with a 10-year re-entry ban — penalties structured around deterring the exact overcrowding dynamics that turned deadly in 2015 (Khaleej Times). None of that is unreasonable on its face.
Where the law and the practice diverge
The problem is not that Saudi Arabia is using biometric surveillance for crowd safety. It is that Saudi Arabia has its own statute — the Personal Data Protection Law (PDPL), enacted by Royal Decree M/19, amended in 2023, and under full enforcement since September 2024 — that classifies biometric data used for identification as "sensitive data," requiring explicit consent, defined purpose limitation, and documented security safeguards before it is collected (SDAIA, Guide to the PDPL for Controllers and Processors). The PDPL does carve out exemptions for national security and public-authority processing — a carve-out found in most data protection regimes, including the EU's GDPR. But those exemptions are conditioned on "proper protection measures" remaining in place, and the Saudi Data and AI Authority (SDAIA), which enforces the law, has published no assessment, retention schedule, or safeguard disclosure specific to the Hajj facial recognition network. For a system processing the biometric data of 1.7 million people — most of them foreign nationals with no domestic legal recourse and, practically speaking, no ability to withhold "consent" and still perform a mandatory religious obligation — that is a meaningful gap between the law on the books and the law in practice.
Part of a broader pattern, not an isolated gap
This is not the only place where Saudi digital governance has recently drawn scrutiny for opacity rather than for the policy goal itself. Access Now and a coalition of rights groups documented that, since April 2026, Meta geo-blocked more than 100 Facebook and Instagram accounts belonging to NGOs and researchers inside Saudi Arabia at government request, with no public accounting of the legal basis for each restriction (Access Now, May 20, 2026). Different domain, same structural problem: Saudi Arabia has functioning statutory frameworks — the PDPL for data, a platform-liability regime for content — but exercises enforcement power under them with essentially no contemporaneous public disclosure of how those powers are being used, at what scale, or under what checks.
What proportionate regulation would actually look like here
A pro-innovation position does not mean opposing the Hajj security system — crowd-crush prevention at this scale is a legitimate, arguably compelling state interest, and facial recognition and predictive analytics are proportionate tools for it. It means insisting that the state hold itself to the disclosure standard its own law sets for private companies. SDAIA requires private controllers to document a lawful basis, a retention limit, and security safeguards before processing biometric data at any comparable scale; it has not published the equivalent for its own Hajj deployment. The fix is not less technology at Hajj — it is a retention schedule (facial recognition templates deleted after the pilgrimage season, not indefinitely warehoused), a published legal basis citing the specific PDPL security exemption relied upon, and an after-action disclosure of what was collected and for how long, comparable to what GASTAT already does for pilgrim headcounts. Riyadh has shown with its Hajj statistics that transparent, register-based public reporting is operationally routine. Extending that same habit to the surveillance infrastructure sitting underneath it costs little and would materially strengthen the government's own case that this is safety infrastructure, not a template for unchecked biometric enforcement elsewhere.