Thailand PDPA: Cookie consent and website tracking explained

What your website needs to do

The PDPA does not mention cookies. It applies when cookies, pixels or forms collect information that identifies a person directly or indirectly (section 6). For each tool that relies on consent, follow four steps:

1. Tell visitors the purpose. Before or at collection, explain the purpose, the data collected, how long it is kept, who receives it, your contact details and the visitor’s rights (section 23).
2. Obtain the consent you need. Ask before or at collection, explicitly, in writing or electronically, separately from other matters and in clear, plain language. Do not make a service conditional on unnecessary consent (section 19).
3. Control the affected scripts. Section 19 bars consent-based collection before consent, so keep those tags and cookies blocked until the visitor agrees, and load only the purposes they accepted.
4. Make withdrawal easy. Visitors can withdraw at any time, as easily as they gave consent. Explain any effect of withdrawing and stop the processing that relied on it (section 19).

A consent request that does not follow section 19 does not bind the visitor, and you cannot rely on it to collect, use or disclose the data.

Practical tip: Passiro’s automatic script blocking and cookie settings button support steps 3 and 4. Test both after every tag change; see Check automatic script blocking.

Make the request easy to understand

Section 19 asks for an accessible, intelligible request in clear, plain language that does not mislead about the purpose. The test is whether your visitors understand what they are agreeing to.

The Act sets no general rule that notices must be in Thai. For an audience that mainly reads Thai, though, Thai-language banner text and notices are the practical way to pass that test; an English-only banner may leave many visitors unable to make an informed choice.

Practical tip: name the purposes in a short first layer, give equally clear accept, reject and settings options, and leave optional categories unticked so each consent is an active choice. Keep a record of what was shown and chosen.

Choose a legal basis for each purpose

Consent is the starting point (section 19), but section 24 allows collection without it where necessary for a contract with the visitor, for legitimate interests not overridden by the visitor’s fundamental rights, for a legal obligation, to protect life or health, for public tasks or for research with safeguards.

A basket or login that delivers what the visitor asked for may fit contract necessity, and fraud prevention may fit legitimate interests. In our view, behavioral advertising is hard to justify that way: it is rarely necessary, and visitors can object to direct marketing at any time (section 32).

Legitimate interests is not a label for all analytics. Record the interest, why the data is necessary and why the visitor’s rights do not override it; visitors can object to processing on this basis.

Sensitive data and children

Sensitive data, such as health, religious beliefs, sexual behavior, biometric data or criminal records, needs explicit consent unless a section 26 exception applies. Check what event names, URLs and audience segments reveal, for example a list built from visits to medical product pages.

For a minor under ten, consent must come from the holder of parental responsibility, and older minors may also need it depending on the act concerned (section 20).

Handle rights requests

Visitors can request access and a copy, portability, objection, erasure or anonymization, restriction and correction, each with its own conditions (sections 30–36). Requests need a route to the systems that hold the data, not just a cookie toggle.

International transfers and service providers

Transfers abroad, for example to an advertising platform, need a destination with adequate protection under the Committee’s rules, a section 28 exception or section 29 safeguards. Section 28 consent requires telling the person about inadequate protection, so a cookie choice is not automatically a transfer consent.

The Act requires controllers to take steps to prevent recipients from using or disclosing data unlawfully (section 37). A controller outside Thailand that is covered by section 5 must appoint a representative in Thailand in writing, unless an exemption in section 38 applies.

Example: a travel site with advertising tags

A tour operator based outside Thailand sells trips to customers in Thailand, using a booking engine, an analytics tool and an advertising pixel. A visitor books a tour but rejects optional advertising.

The booking engine processes what the contract needs. The pixel stays blocked, including any second copy loaded by a plugin or tag manager, and the visitor is left out of audience exports. Because it targets Thailand from abroad, the company also checks the representative requirement and where each vendor sends data.

Website checklist

• Scope: confirm whether you offer services to, or monitor, people in Thailand.
• Notice: check that the section 23 details appear at collection.
• First visit: confirm consent-dependent cookies and requests stay off.
• Reject and withdraw: confirm affected tags and exports stop.
• Sensitive signals: review event names and audience segments.
• Transfers: record where each vendor sends data and on what basis.

FAQ