The short answer
Under Thailand's Personal Data Protection Act, consent is needed when you process personal data for a purpose that no other lawful basis covers. On a typical business website that means two things: a fair cookie banner, and consent wording on your forms.
First, analytics, advertising and personalisation cookies should stay off until a visitor opts in through a banner that makes accepting and rejecting equally easy. Second, contact and quote forms need a link to your privacy notice, and if you want to send marketing to the people who fill them in, a separate, unticked checkbox for that.
Strictly necessary cookies and the use of form data to answer the enquiry itself do not usually need consent. The rest of this guide covers where the line falls, what the Act asks for in wording and design, and how to keep proof. For the full picture of the law, from scope to penalties, read our overview of PDPA in Thailand. This article is practical guidance, not legal advice; have a Thai lawyer review the final legal text.
Consent or another lawful basis?
A common mistake is asking for consent for everything. Section 24 of the PDPA lists the situations where you may collect personal data without consent, and several of them fit ordinary website activity better than consent does:
- Contract: processing needed to perform a contract with the person, or to take steps they asked for before entering one. Using a quote form's details to prepare and send the quote fits here.
- Legal obligation: keeping records the law requires, such as tax invoices for an online order.
- Legitimate interests: your reasonable interests, provided they do not override the person's rights. Basic security logging on the website is a typical example.
- The Act also lists vital interests, public tasks, and historical, research or statistical purposes, which rarely apply to a business website.
Why it matters: consent can be withdrawn at any time. If you rely on consent to fulfil an order and the customer withdraws it, you are left without a basis to process data you actually need. Use consent where it genuinely fits, which on most websites means non-essential cookies, marketing emails and messages, and sharing data with partners for their own purposes. Sensitive data such as health information, which clinics collect, has stricter rules of its own under Section 26 and usually needs explicit consent.
What does valid consent look like under the PDPA?
Section 19 sets out how consent must be requested, and getting it wrong carries the risks set out in our guide to PDPA penalties and fines. In plain words, for a website:
- Explicit and recorded. Consent is given in writing or through an electronic system. A click on a clearly labelled button or checkbox counts; silence or scrolling does not.
- Separate from everything else. The request must be clearly distinguishable from other terms. A single box that agrees to your terms of service and to marketing emails at once does not meet this.
- A clear purpose. Tell people what the data is for, in language that is easy to understand and not misleading.
- Freely given. The Act asks you to take the utmost care that consent is not a condition of a service when the data is not needed for that service. Refusing marketing should never block someone from sending an enquiry.
- Easy to withdraw. People can withdraw consent at any time, and withdrawing should be as easy as giving it.
If you also serve European visitors, you will notice these rules are close to the GDPR's. Our PDPA GDPR comparison sets out where they differ.
How should a PDPA cookie banner work?
Group cookies into categories visitors can understand. Strictly necessary cookies keep the site working: security, load balancing, remembering the language choice or the items in a cart. They run without consent. Analytics, marketing (advertising pixels and remarketing) and personalisation cookies wait for a yes.
Block first, then load
A banner that records a choice but lets the Meta pixel or Google Analytics fire anyway is decoration. Non-essential scripts must be held back until the visitor accepts that category. If you use Google tags, such as the analytics covered in our GA4 setup guide for small businesses, Google's consent mode lets them adjust their behaviour to the consent state your banner passes to them; it still needs a banner that collects a real choice.
Wording examples
English: "We use necessary cookies to run this site. With your permission we would also like to use analytics cookies to understand how the site is used and marketing cookies to show relevant ads. [Accept all] [Reject all] [Choose]"
Thai: "เว็บไซต์นี้ใช้คุกกี้ที่จำเป็นเพื่อให้เว็บไซต์ทำงานได้ และขออนุญาตใช้คุกกี้เพื่อการวิเคราะห์และการตลาด [ยอมรับทั้งหมด] [ปฏิเสธทั้งหมด] [ตั้งค่า]"
Link both versions to your cookie notice. Ours is our cookie policy, which lists each cookie, its purpose and how long it lasts.
- Equal buttonsAccept all and Reject all at the same level, same size and similar prominence.
- Granular choiceA settings view with a switch for each category: analytics, marketing, personalisation.
- Nothing pre-tickedEvery optional category starts switched off.
- No implied consentNo 'by continuing to browse you agree'. Scrolling and closing the banner are not a yes.
- Scripts blockedAnalytics and ad tags do not load until their category is accepted.
- Language matchThe banner appears in Thai on Thai pages and English on English pages.
- Easy to reopenA cookie settings link in the footer so visitors can change their mind.
- Fits the phoneThe banner does not cover the menu, the booking button or the whole screen on a small phone.
Consent on contact and quote forms
A PDPA consent form on a website is usually not a separate document at all. It is a few lines under your contact, booking or quote form. A sound pattern looks like this:
- A short notice line above the submit button: "We use your details to reply to your enquiry. See our privacy notice for how we handle your data." The link opens your notice in a new tab.
- A separate, unticked checkbox for marketing: "Send me occasional news and offers by email. I can unsubscribe at any time."
- If you share data with a partner for their own use, another separate checkbox that names the purpose.
Note what is missing: there is no required "I agree to the privacy policy" box. Answering the enquiry rests on the steps the person asked for, not on consent, and a forced tick blurs that. Ask only for the fields you need; a restaurant booking rarely needs a date of birth.
In Thai, the marketing line might read: "ต้องการรับข่าวสารและโปรโมชันทางอีเมล (ยกเลิกได้ทุกเมื่อ)". The notice you link to should cover every point the Act lists; our guide to writing a PDPA privacy policy walks through them. Offline, the same principles apply to paper PDPA forms at a clinic reception or a showroom sign-up: separate boxes, a clear purpose, and a copy of the notice available.
Records, withdrawal and minors
Keeping records
If a customer or the PDPC asks, you should be able to show when and how someone agreed. For cookies, a consent tool can store a record for each choice: an anonymous ID, the date and time, the categories accepted and the version of the banner text shown. For forms, save the checkbox value and the wording beside it with the submission, plus the date. When you change the wording, keep the old version so older records still make sense.
Handling withdrawal
Withdrawal must be as easy as giving consent. In practice: a footer link that reopens cookie settings, an unsubscribe link in every marketing email, and a named inbox or form for other requests. When someone withdraws, stop the processing that relied on consent from that point, update your mailing list, and tell them if withdrawal affects anything they receive. Withdrawal does not undo processing already done lawfully before it.
Minors
Section 20 adds rules for minors. Where a minor could not validly give consent alone under the Civil and Commercial Code, consent must also come from the person with parental responsibility, and for a child under ten it must come from that person. If your site targets families, schools or young customers, ask a lawyer how to verify age and collect parental consent before you launch the form.
Tools and a final check
You do not need to build a banner from scratch. A consent management tool handles the banner, script blocking, records and the settings link; choosing a PDPA platform that supports Thai and English is covered in its own guide. Once it is installed, test it: open the site in a private window, reject everything, and confirm in your browser's developer tools that no analytics or ad requests go out. Then accept and check they appear. Our PDPA website audit checklist covers this test alongside the rest of the site.
PDPA-ready builds are part of what we do: cookie consent, a privacy notice page and forms with properly separated consent. Our Starter package, from THB 10,000 (indicative, one-time), already includes PDPA cookie consent, and our page on consent and privacy setup explains the full service. We configure the pages and tools; the legal text should be reviewed by a Thai lawyer. If you would like this done on a new or existing site, ask for a price for your project and the written quote will set out the final figure.
Reviewed by
Who builds your site
Litesh Dhir
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish.
More about usKeep reading
Sources
- Ministry of Digital Economy and Society: Personal Data Protection Act B.E. 2562 (2019), Sections 19, 20, 24 and 26
- Personal Data Protection Committee (PDPC)
- Google: Consent mode overview