What a consent platform does, in brief
A consent management platform (CMP) is the software behind your cookie banner. It shows visitors a choice, blocks analytics and advertising scripts until they agree, remembers what each visitor chose, and keeps a log you can export if anyone asks for proof.
For a Thai business website, the right tool is one that does those four jobs reliably, in Thai and English, without slowing the site down.
You have three ways to get there: a hosted SaaS platform, a WordPress plugin, or a lightweight custom banner built into the theme. None is automatically correct. The choice depends on how many tracking tools you run, how many sites you manage and who will maintain it. This guide sets the criteria first, then compares the routes. For the legal background on consent, start with our overview of PDPA in Thailand for website owners. We have no partnership with any vendor named here.
Eight criteria for a PDPA consent tool
These criteria come straight from how consent is supposed to work under the Act: freely given, specific, informed and as easy to withdraw as to give. The rules themselves, including how consent wording on forms should read, are covered in our guide to PDPA consent forms and banners in Thailand. Score each candidate tool against the list below before you look at price.
- Thai-language bannerFull Thai text you can edit, shown automatically on Thai pages, with English on English pages.
- Automatic script blockingAnalytics and marketing scripts stay blocked until consent, including ones added later.
- Granular categoriesSeparate switches for necessary, analytics, marketing and functional cookies.
- Consent logs and exportA record of each choice with a date, which you can export.
- Google Consent ModePasses consent signals to Google tags so they adjust their behaviour.
- AccessibilityKeyboard use, readable contrast and buttons that work on small phone screens.
- Page speed impactA small script that does not delay the first paint or shift the layout.
- Where consent data is storedWhich country holds the logs, so your privacy notice can say so.
SaaS platform, WordPress plugin or custom banner: which fits?
Each route fits a different kind of business. A hotel group running Google Ads, Meta Pixel and a booking engine across several sites usually gains from a SaaS platform with automatic scanning. A single WordPress site for a clinic or law firm often does well with a plugin. A small brochure site with one analytics tag can use a light banner built into the theme, as long as someone maintains it.
| Factor | SaaS platform | WordPress plugin | Custom banner |
|---|---|---|---|
| Setup | Paste a script, configure in a dashboard | Install and configure in WordPress admin | Built by a developer into the theme |
| Cookie scanning | Usually automatic and scheduled | Varies by plugin; some scan, some rely on manual lists | Manual list kept up to date |
| Consent logs | Stored by the vendor | Stored in your database or by the vendor | Must be built and stored yourself |
| Cost model | Subscription, often per domain or traffic | Free tier plus paid upgrades, varies | Development time, then maintenance |
| Best fit | Several sites or many tags | One WordPress site | Very few scripts, stable site |
| Main risk | Recurring cost and a third-party script | Plugin conflicts and updates | Falls out of date when tags change |
Platforms that state PDPA support
Several international CMPs publish pages describing support for Thailand's PDPA. The notes below reflect what each vendor says on its own site at the time of writing; we have not ranked them. Features, plans and prices change, so confirm on the vendor's current pages before you buy, and check the Thai-language banner yourself in a trial, because not every PDPA page mentions it.
Cookiebot CMP (by Usercentrics)
Its Thailand PDPA page describes cookie consent, cookie monitoring and control, customisable banners, stored and renewed consents, and a route to set up Google Consent Mode. A WordPress plugin is also available.
CookieYes
Its PDPA Thailand page lists consent banners, automated consent management, consent logs for proof during audits, and a privacy policy generator. Treat any generated policy as a first draft for a lawyer, not finished text.
CookieHub
Its PDPA Thailand page describes collecting and documenting consent, and lists Google Consent Mode among supported frameworks.
WordPress-only options
The WordPress plugin directory has several consent plugins, some free with paid tiers. Check the last update date, active installs, support threads and whether blocking is automatic or depends on you tagging each script.
Pricing models
Vendors price in different ways: per domain, by monthly pageviews, or by the number of subpages scanned. A bilingual site with many product pages can land in a higher tier than you expect, so count your pages and traffic before comparing plans.
Setting it up without leaks
Many consent problems are installation problems, not tool problems. The banner appears, visitors click reject, and the tracking carries on because the scripts were never wired to the tool.
Common leaks
- Hard-coded tags. An old Google Analytics or Meta Pixel snippet pasted into the theme header loads before the CMP can block it.
- Tag manager fires first. In Google Tag Manager, tags set to fire on every page view run regardless of the banner unless you add consent checks or triggers.
- Plugin-injected scripts. Chat widgets, review plugins and embedded maps or videos may set cookies on their own.
- Cached pages. Aggressive page caching can serve a version of the page with the banner state of another visitor.
Google Consent Mode
Consent Mode lets Google tags read the visitor's choice and change how they behave, for example not setting advertising cookies when marketing consent is refused. If you use Google Ads or Analytics, choose a tool that supports it and confirm the default state is "denied" before any choice.
Finally, make sure the banner links to your privacy notice and that the notice lists the categories the banner shows. Our guide to writing a PDPA policy for your website covers what that notice should contain.
What does a consent tool not cover?
Vendors sometimes suggest that installing their banner makes a site compliant. It covers one part: cookies and trackers. The Act also applies to the data people type into your forms, the orders you store, the processors you share data with, and how you answer requests to access or delete data. A consent tool does nothing about any of those, and gaps there can still lead to the sanctions described in our guide to PDPA penalties and fines.
A few questions show the gap quickly. Does every form link a privacy notice and ask separately for marketing consent? Do you know where your hosting and email services store data? Could you find and delete one customer's records if asked? Our website PDPA audit checklist walks through each of these checks.
If you serve European visitors too, your banner settings may need to meet both regimes; the differences are set out in our PDPA vs GDPR comparison. And legal pages are a separate matter from privacy: whether you also need a contract with your users is covered in does your website need terms and conditions.
Getting it installed and tested
After installation, test the way a regulator or a careful customer would. Open the site in a private window, check the browser's developer tools for cookies and network requests before answering the banner, then reject everything and browse a few pages. Repeat on a phone and in Thai. Nothing optional should load.
If you would rather not do this yourself, our consent and privacy setup covers the banner, the privacy notice page and consented forms, and PDPA cookie consent is already part of our Starter package, from THB 10,000 as an indicative one-time price. We configure the tools; your lawyer reviews the legal wording. To get a price for your site, send us your brief.
More on PDPA and websites
Sources
- Cookiebot: Thailand PDPA
- CookieYes: PDPA Thailand compliance
- CookieHub: PDPA Thailand
- Google: consent mode overview
- Personal Data Protection Committee (PDPC) Thailand
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us