Cookie consent in Thailand under the PDPA
The PDPA does not mention cookies. Consent and notice come from its general rules - and from practice, while specific guidance is awaited.
Short answerThailand's Personal Data Protection Act 2019 (PDPA) has no cookie-specific rule. Where cookies or tracking collect personal data, its general rules apply: consent before or at collection unless another lawful basis applies (section 19), and a notice of the purpose, data, retention and recipients (section 23). In practice, Thai sites ask for opt-in consent for non-essential cookies with nothing pre-ticked.
What does the PDPA say?
Section 19 requires consent to be requested before or at the time of collection, explicitly, in writing or electronically, unless another lawful basis applies. Section 23 requires a notice at or before collection covering the purpose, the data collected, how long it is kept, who it is disclosed to and how to contact the controller (PDPA, English translation).
Is there official cookie guidance?
The Personal Data Protection Committee (PDPC) has published guidelines on requesting consent and on notices, but we have not found a dedicated PDPC cookie guideline as of 1 October 2026. Check pdpc.or.th for anything newer.
What do Thai websites do in practice?
- Ask for opt-in consent for analytics and marketing cookies, with nothing pre-ticked.
- Do not treat continuing to browse as consent.
- Show a cookie notice in Thai as well as English.
- Let visitors change their choice later.
This is practice, not the text of the law or of PDPC guidance.
Where Sadang fits
Sadang has a separate Thai deployment, so a Thai site's tracker and consent records are served from it rather than from the UK one. Its banner includes Thai, and a site's default consent level can be set for visitors from Thailand. See consent management.
This guide is general information, not legal advice. Laws and regulator guidance change; check the sources linked above and take advice on your own site.