← ALL REGULATIONS
Thailand PDPA cookie consent requirements, in force since 2022.
Thailand’s Personal Data Protection Act requires a legal basis for collecting personal data through cookies, and for non-essential cookies that basis is usually consent: explicit, separate from other terms, and not a condition of using the site.
Thailand PDPA at a glanceConsent, with exceptions
- Applies to
- Organisations collecting personal data of people in Thailand, including from abroad when offering them goods or services or monitoring them
- In force
- 1 June 2022
- Enforced by
- Personal Data Protection Committee (PDPC) and its Office
- Penalties
- Administrative fines up to THB 5 million, criminal penalties, and punitive damages
WHAT THAILAND PDPA REQUIRES
What the PDPA asks of a site that uses cookies.
THE RULEA legal basis, usually consentCollecting personal data through non-essential cookies needs a legal basis, and for analytics and advertising that is usually consent.
WITH KATLAIn GDPR mode, which Auto uses for Thai timezones, cookies outside the functional category wait for an opt-in.
THE RULEExplicit, separate consentConsent must be explicit, requested separately from other terms, and not a condition of using the service.
WITH KATLAAccept, Reject and Customise sit together on the first layer of the banner, and nothing is pre-selected.
THE RULEWithdrawal as easy as consentWithdrawing consent must be as easy as giving it.
WITH KATLAA floating settings icon, or your own "Cookie settings" link calling katla.open(), reopens the choice on any page.
THE RULEClear, understandable requestsThe request for consent must be clear, easy to understand and not misleading about its purpose.
WITH KATLAKatla’s banner is available in Thai, and the widget can follow the visitor’s browser language. Generated policies are not yet available in Thai.
Thailand PDPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does the Thai PDPA require a cookie banner?
- For cookies that collect personal data without another legal basis, yes: consent has to be requested explicitly, and a banner is how sites do it.
- What are the penalties?
- Administrative fines of up to THB 5 million, criminal penalties including imprisonment for some offences, and courts can award punitive damages of up to twice the actual damages.
- Does it apply to companies outside Thailand?
- Yes, when they offer goods or services to people in Thailand or monitor their behaviour there.
- When did it take effect?
- It was enacted in 2019 and, after two postponements, came fully into force on 1 June 2022.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.