Marketing to Existing Customers in Thailand: When You Need Consent, and When You Don't

Picture an online appliance retailer. It has a list of past buyers, followers on its LINE Official Account, and an advertising pixel on its website. Next month it launches a promotion. Marketing wants to message everyone and retarget visitors who browsed without buying.

Legal tends to give the safe answer: get consent from everyone. That is not wrong, but it shrinks the usable list dramatically. Marketing tends to assume the opposite: they are already our customers, so we can send. That is right only some of the time.

The workable answer sits between the two. This article goes through the common situations one by one and shows which lawful basis fits, using the text of Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA), the TDPG 4.0 guidelines, and a consultation answer published by the Office of the Personal Data Protection Committee (PDPC Office).

We already sold to this customer. Can we just send promotions?

Not on that reasoning alone. Data collected to deliver goods, issue receipts or provide after-sales service sits on the contract basis in section 24 (3), which covers only what is necessary to perform the contract. A new sales pitch is not something the original contract needs.

With the contract basis off the table, the remaining options in section 24 for an ordinary business doing marketing come down to two: legitimate interest under section 24 (5), or consent under section 19.

Marketing teams tend to skip the word "except". Legitimate interest works only after the business has weighed its interest against the customer's rights and found that it is not overridden. If nobody did that weighing and nobody wrote it down, it will be hard to defend the choice once a complaint arrives.

Which offers can rely on legitimate interest?

Offers that build on what the customer already has, and that the customer would reasonably expect to receive. The TDPG 4.0 chapter for sales and marketing teams gives two plain examples.

A published PDPC consultation answer points the same way. Bank J. asked whether it needed consent to offer loans to deposit customers, and to offer ATM cards and mobile banking to existing account holders. The answer split the two cleanly.

A loan is a new product unrelated to the deposit contract, so the contract basis fails, and with no other basis in section 24 the bank must ask for consent under sections 19 and 20. Even for other deposit products, the opinion said to look for another basis first and to seek consent if none exists. ATM cards and mobile banking, which attach to the existing account, were treated differently:

In English: for products connected to the customer's existing product, such as an ATM card or mobile banking, the bank may consider legitimate interest under section 24 (5), weighing the customer's expectations and the proportionality between the bank's interest and the customer's fundamental rights. The same answer recommends documenting a Legitimate Interests Assessment (LIA) in the section 39 record and telling customers they can object to marketing under section 32. Other answers from the same volume are covered in our round-up of PDPC consultation answers.

TDPG says direct marketing needs consent. Why is there any room for another basis?

Read only the first sentence of TDPG 4.0 item C35 and you would conclude that direct marketing always needs consent. The same item goes on to give its reason, and that reason is what explains item C39.

C35 ties the consent requirement to two facts: the contact intrudes on privacy, and people do not expect it. Item C39, in the same section, deals with the case where neither fact is present.

Side by side, the two items do not conflict. C35 states the rule and its reason; C39 says that where the reason is absent, legitimate interest "may" be used, and its next sentence keeps direct sales offers and targeted advertising built on individual data under consent. MS17 on existing customers applies the same test: the offer must fall within what that customer group would reasonably expect.

TDPG does not say who carries a burden of proof. Still, a business relying on C39 or MS17 should write down why the contact is not highly intrusive and why customers would expect it, because those are the conditions both items set out.

A practical way to apply this: the more you rely on individual data to decide what to offer to whom, the more you need consent. Telling customers about products that extend what they already own, without mining their behaviour, is the space where legitimate interest can carry the weight.

The customer declined consent. Can we fall back on another basis?

Not for the same activity. The Bank J. answer addresses this head-on.

In English: once the bank has chosen consent and the customer has refused, the bank can no longer use section 24 (5) to collect, use or disclose that customer's data for the same activity. This has a direct design consequence. If a sign-up form bundles everything under one "send me news" checkbox and the customer leaves it blank, the business loses even the messages it might have sent on legitimate interest. Separate the activities first, then ask for consent only where consent is genuinely needed.

What does valid marketing consent look like?

Section 19 sets several conditions. Four matter most to a marketing team: the request must be explicit, state its purpose, be kept separate from other text, and be as easy to withdraw as it was to give.

• Keep the marketing checkbox apart from acceptance of the sales terms, and never make a purchase conditional on it (section 19 paragraph four).
• Use opt-in and let customers choose item by item, as TDPG MS14 recommends.
• Name the channels you will use, such as email, phone or post. TDPG C36 recommends spelling them out and letting customers pick.
• Every marketing message needs an easy way to unsubscribe, per TDPG C37.
• Keep evidence of who consented, when, through which form and to which wording. TDPG C38 says consent details should always be recorded.

TDPG MS15 adds a point marketers rarely think about: even with consent, the controller still has to respect necessity, transparency and fairness. Consent is not a free pass for intrusive targeting. Our guide to consent that holds up has sample wording.

Do advertising cookies and retargeting need consent?

They should, when the cookie or pixel tracks people across websites to build a profile or serve individually targeted ads. TDPG 4.0 sets the foundation in its very first chapter: online identifiers such as cookies can be personal data.

In its chapter on lawful bases, TDPG then draws a sharper line for behavioural advertising than for direct marketing in general.

Item C49 goes on to say that profiling from cookie data, IP addresses or location is intrusive and often beyond what people reasonably expect, so consent has to be collected with extra care, and data subjects can also object to profiling.

What a sound cookie banner looks like

TDPG offers a cookie categorisation that works as the skeleton of a banner.

The practical rule that follows: necessary cookies can run; analytics and advertising cookies should wait until the visitor accepts. The reject option should be as easy to find as the accept button, because section 19 requires withdrawal to be as easy as giving consent.

Set-up steps are in our cookie banner guide. To see which cookies your site loads before anyone clicks accept, run the free website scan.

A customer says "no more promotions". What exactly do we have to do?

Stop using the data for direct marketing immediately and set the record apart. Section 32 (2) gives the right to object to direct marketing at any time, and section 32 paragraph three allows a controller to reject an objection only in cases under (1) (a), (1) (b) or (3). Direct marketing is not among them, so there is nothing to argue.

In practice, setting the data apart means keeping a suppression list that every sending system checks: email, LINE OA, SMS, and any custom audiences uploaded to ad platforms. Simply deleting the name from the marketing database is not enough; the next list import may bring it straight back.

If the customer also asks for erasure, section 33 (3) grants that right when the customer has objected to direct marketing under section 32 (2). How to handle the request and which deadline applies are covered in answering data subject requests on time.

Agencies and messaging platforms: who is responsible for what?

The brand is always a controller. TDPG MS18 says product owners and brands, SMEs included, act as data controllers. Agencies, CRM vendors and platforms are mostly processors, though for some steps they may be controllers in their own right or joint controllers.

When an agency runs ads or sends SMS for you, section 40 paragraph three requires an agreement with the processor, and your suppression list has to reach the agency too. TDPG C38 adds that you should check the recipient is trustworthy, notify the disclosure, and keep consent details on record. See our processor agreement guide.

For SMS and other telecom-based marketing, TDPG MS22 takes the view that both the tracking stage and the targeting stage need clear consent, and that the telecom regulator's own rules apply alongside the PDPA.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)