Thailand’s Electronic Transactions Commission (ETDA) issued a new Notification this month requiring social media platforms to verify advertiser identities before publishing paid content targeting users in Thailand. Set to take effect on 1 November 2026, the rules form part of Thailand’s broader push to combat technology-enabled fraud and scam activity.
The ETDA extends anti-fraud logic to social media advertising, mirroring rules already applied to banks, payment platforms, and digital asset operators. Under these rules, non-compliant entities may face joint liability for technology crimes they fail to prevent.
The new law comes amid persistent technology crimes in the region, with fraudulent advertisements promoting investment scams, fake financial products, and other impersonation of regulated entities. The Notification reflects a regulatory view that platforms enabling such advertising without adequate identity controls should bear a degree of accountability for resulting harm.
The Scope of the EDTA
The final version of the Notification removed the definition of “social media service provider” that appeared in the earlier consultation draft. Scope is therefore determined by reference to the EDTA’s existing platform classification framework under the Royal Decree on the Operation of Digital Platform Service Businesses Requiring Notification B.E. 2565 (2022), which recognises two relevant categories of social media services:
- General social media services: platforms enabling users to connect, communicate, and share content, where users can create profiles displaying personal information. This also includes webboard-type services.
- S-Commerce services: general social media platforms with built-in commercial transaction tools, such as dedicated business pages or features facilitating direct sales.
Platforms falling within either category and selling paid advertising disseminated in Thailand will be subject to the Notification. Notably, the jurisdictional trigger is where the advertisement is disseminated rather than where the platform or advertiser is incorporated or based. International platforms targeting Thai users are therefore also within scope.
Key Obligations for Social Media Platforms
Advertiser Identity Verification
Platforms must verify advertiser identity before any paid advertisement is published in Thailand. Verification is required where the provider receives a fee, whether from the advertiser or a third-party payer. A verified identity may be relied upon for up to one year, after which re-verification is required. Verification must be conducted either by checking government-issued identity documents against reliable sources, or through a digital identity system meeting the Identity Assurance Level (IAL) prescribed by the Electronic Transactions Commission.
Data Collection & Retention
Platforms must collect and retain the following data from the start of the advertising relationship and for at least 90 days after the advertiser ceases to use the service: the name of the advertiser (and representative, in the case of a company); government-issued identity evidence; and contact information including address and telephone number.
Third-Party Payment of Advertising Fees
Where advertising fees are paid by someone other than the advertiser, the same identity data must be collected and retained for the payer. This closes a potential gap that could otherwise allow anonymous funding of advertising through intermediaries.
Penalties and Risk Exposure
The Notification does not create a standalone criminal offence specifically for non-compliance with the advertiser KYC requirements. The principal risk for non-compliant platforms arises under Section 8/10 of the Emergency Decree, under which a social media service provider may be required to share responsibility for damage arising from a technology crime unless it can demonstrate compliance with the applicable preventive standards prescribed by the Electronic Transactions Committee. In addition, related offences under the Emergency Decree, including those involving the misuse, collection, possession, or disclosure of identifiable personal data for the purpose of a technology crime, may carry imprisonment of up to five years or fines of up to THB 500,000 in aggravated cases.
What Platforms and Advertisers Should Do Now
For social media platforms:
- Confirm whether your service falls within the ETDA’s social media classifications, including the S-Commerce category.
- Build advertiser-onboarding KYC workflows capable of collecting and verifying required identity information before campaigns go live.
- Implement annual re-verification controls and procedures for identifying third-party payers.
- Ensure data-retention systems and audit trails are in place, and review PDPA alignment for any new categories of personal data collected.
For advertisers and agencies:
- Expect platforms to request identity documentation as part of advertising onboarding and prepare relevant corporate and personal identification in advance.
- Where agencies or intermediaries place advertising on your behalf, review whether the third-party payer provisions apply and ensure the relevant party is properly documented.
- Foreign businesses running campaigns targeting Thai users should factor verification timelines into campaign planning.
For legal advice on digital platform compliance, technology crime obligations, or any other regulatory matters in Thailand’s technology sector, please contact our Technology, Crypto, and Web3 team at [email protected].
This article is provided for general information purposes only and does not constitute legal advice. While care has been taken to ensure accuracy at the time of writing, laws and regulatory instruments may change. Specific advice should be sought for individual circumstances.
