Children's Data in Thailand: Whose Consent Counts, the Child's or the Parent's?

A school wants student photos for its newsletter. A game app lets children sign up. A bank opens savings accounts for primary-school pupils. All three hide the same question: who gets to decide about a child's personal data?

Thailand's Personal Data Protection Act B.E. 2562 (2019), the PDPA, answers it in section 20. But that is only half the answer. The other half comes first: does this activity need consent at all? If it does not, section 20 never comes into play.

The Office of the Personal Data Protection Committee (the PDPC Office) has published answers that touch both halves, one for a bank with young customers and one for the teacher-evaluation body. This article sets those answers beside the statute, then adds the school and app examples in the Thailand Data Protection Guidelines 4.0 (TDPG).

Who consents for a child under section 20?

It depends on two things: the child's age, and whether the matter is something a minor may do alone under the Civil and Commercial Code. Section 20 paragraph one splits it into two cases.

In plain terms: for a child of ten or under, the person exercising parental power consents. For an older minor, if the matter is not one the minor may do alone under sections 22 to 24 of the Civil and Commercial Code, you need that person's consent on top of the minor's. If it is a matter the minor may do alone, the minor can consent.

When is consent not needed even though the data subject is a child?

A common mistake: the moment an organisation sees children's data, it drafts a parental consent form for everything. Yet section 24 of the PDPA offers several other lawful bases. If one of them fits, no consent is needed, and section 20 is never reached.

A bank, referred to as Bank M, asked the PDPC Office whether opening a deposit account for a minor required consent. The Office said account opening can rest on the contract basis in section 24 (3). Whether the minor has capacity to contract is a Civil Code question, not a PDPA one.

The passage says that because the minor's deposit account does not use consent as its lawful basis, relying instead on section 24 (3), section 20 does not have to be followed. A consultation answer is the Office's opinion to the party that asked. It is not a ruling or a court judgment.

Education has a parallel. The teacher-evaluation office asked about teachers submitting classroom videos, with students visible, for their professional assessment. The PDPC Office treated this as collection under a statutory mandate, under section 24 (4) or (6), so no consent was required.

No consent does not mean no notice. The Office went on to recommend that students and parents be told before collection, that only what is needed be collected, and that the files be deleted once they are no longer needed.

Marketing to young customers: whose consent?

The same Bank M consultation covers this. Offering a new product has nothing to do with the account contract, so the contract basis does not reach it, and no other section 24 basis fits. The bank should therefore seek consent. The question is from whom.

In English: given a minor's maturity in making marketing decisions and the impact of those decisions, the Office considered that consent for marketing to minors should also be obtained from the person exercising parental power. Issue 4 goes further. Even offers of existing or related products, such as an ATM card or mobile banking, should carry parental consent if they are not necessary for the original contract.

Note the word "should" rather than "must". Still, a business that follows this opinion will find it far easier to defend itself if a parent complains. For marketing to adult customers, see Marketing to existing customers.

What extra care applies to scanning a child's face or fingerprint?

Face and fingerprint data used to verify identity is biometric data, a sensitive category under section 26 of the PDPA. Unless an exception applies, explicit consent is required, and when the data subject is a child, section 20 sits on top of that. Bank M asked about face verification for minors in its app, and the answer reads:

Put simply: the bank must look for a basis in section 26 paragraph one (1) to (5); failing that, it needs explicit consent, and a minor's consent must follow sections 19 and 20.

TDPG 4.0 gives several school examples, and they all turn on one point: consent must be freely given, and if refusing leaves the child worse off, the consent fails. TDPG is an industry guideline, not law, and these are illustrations in the guideline, not Thai cases.

The canteen example teaches that a parent's signature alone is not enough; the alternative has to be genuinely as convenient. A controller that collects biometric data in breach of section 26 paragraph one faces an administrative fine of up to five million baht under section 84. For sensitive data hiding in everyday operations, read Sensitive data you hold without knowing.

How should apps and online services for children be designed?

TDPG item C51 explains the extra care: minors often cannot grasp the purpose and detail of processing as well as adults, and the future impact is hard for them to judge, so consent from a child may fall short of section 19. The guideline then suggests tools.

TDPG items C53 and C54 add that the EU's GDPR sets an age of 16, or 13 where national law so provides, and that many social media services refuse accounts to under-13s. Those numbers belong to the GDPR and to platform policies, not to the PDPA. The only age line in the Thai Act is ten, in section 20 (2), plus minority itself.

C54 also recommends a data protection impact assessment (DPIA) whenever you genuinely must rely on a minor's consent. See DPIA: when and how.

A sign-up flow built around section 20

• Ask for date of birth or age band before anything else, then branch: ten or under goes straight to a parent; older minors go to a joint path when the matter is not one they may do alone.
• Separate the consent request from other text and write it in language a child can follow, as section 19 paragraph three already requires for everyone.
• Record who clicked consent in the capacity of parent, and keep that evidence.
• Offer a parent mode that switches off features collecting more than needed, such as location or profile sharing.
• Do not tie the core service to marketing consent, in line with the freedom principle in section 19 paragraph four.
• Make withdrawal as easy as giving consent, for both child and parent.

Beyond consent, where else must the parent be involved?

Many organisations assume section 20 ends with the consent form. Its last paragraph extends the same rule much further.

In practice that means three things. Privacy notices for children must reach the person who decides for them. Withdrawal must be accepted from a parent. And your channel for data subject requests must accept requests from parents, with a check that the requester really has authority to act for the child. See Answering data subject requests on time.

Checklist for schools, apps and businesses with young customers

1. Find every point where children's data is collected (forms, apps, cameras, scanners, events) and log it in your section 39 record. See Data mapping in one week.
2. For each point, ask whether a section 24 basis fits. If so, skip consent but still give the section 23 notice.
3. Where consent is needed, separate children aged ten or under from older minors, and note whether parental consent is also required.
4. For marketing to minors, also obtain parental consent, following the PDPC Office's opinion to Bank M.
5. For a child's biometric, health or other sensitive data, obtain explicit consent, separate from other consents, with an alternative that is not worse.
6. If you must rely on a minor's own consent, run a DPIA as TDPG recommends.
7. Give parents a way to withdraw consent and exercise rights for the child, with a check on their authority.

The hardest part of this checklist is tracking who consented to what, and when. The AIPDPA consent register keeps that history entry by entry, both grant and withdrawal, and risky activities can move straight into a DPIA in the same system. See the demo account, no sign-up needed.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)