The five PDPA signals on a homepage are a privacy-policy link, a cookie consent tool, trackers that wait for consent, no ad or analytics cookies on first load, and a channel for rights requests. This piece is for owners, web teams and DPOs: how to check each one yourself, which part of the Thai PDPA or TDPG 4.0 guidance it rests on, and the usual fix.
- PDPA section 23 requires notice before or at the time of collection; a privacy-policy link that is easy to find is the first thing outsiders see.
- Sites using analytics or ad cookies need a consent tool with nothing pre-ticked, and withdrawal must be as easy as giving consent (s.19 para 5).
- TDPG 4.0 item C48 says online behavioural advertising must rely on consent, so pixels should not fire before the visitor accepts.
- Access requests must be completed within 30 days of receipt (s.30), so the site has to say where to send one.
- An outside check only sees the web page. It says nothing about back-office compliance and is not a legal opinion.
Before a customer types a phone number into your form, before a reporter writes about your company, before an official decides whether a complaint is worth pursuing, they all do the same thing: they open your homepage. Nobody outside sees your record of processing or your processor contracts. Everybody sees the website.
That makes the homepage the one PDPA document the whole country can read at any time, and read quickly. In under a minute you can tell whether a company has set things up, or whether an ad pixel was installed two campaigns ago and nobody has looked at it since.
This piece walks through five signals you can check from outside. Each is tied to the Personal Data Protection Act B.E. 2562 (2019), the PDPA, or to the TDPG 4.0 guidelines, with a do-it-yourself check and a fix a web team can usually ship within a week.
What can a homepage reveal about PDPA compliance?
Five things: whether there is a privacy-policy link, whether there is a cookie consent tool, whether ad and analytics trackers wait for consent, whether the server sets non-essential cookies on first load, and whether people have a way to exercise their data rights.
| Signal | How to check it yourself | Source | Weight |
|---|---|---|---|
| 1. Privacy-policy link | Scroll to the footer and look for Privacy or Privacy Policy | PDPA s.23 | Law |
| 2. Cookie consent tool | Open the site in a private window and see if you are offered a choice | PDPA s.19 · TDPG C20 | Law + guidance |
| 3. Trackers before consent | Open developer tools, Network tab, before clicking anything; look for ad domains | PDPA s.19 · TDPG A7, C48 | Law + guidance |
| 4. Non-essential cookies on load | Application tab, Cookies: are _ga or _fbp present before you answer the banner? | PDPA s.19 · TDPG cookie categories example | Law + guidance |
| 5. Rights-request channel | Look for a request link, a DPO email or a data-protection contact form | PDPA s.23 (5) (6) · s.30 | Law |
If you would rather not open developer tools, use the free website check at /scan. Paste your website and get a PDPA and security report in about 30 seconds. It reads the homepage HTML and the cookies in the server's first response, checks exactly the five items in the table, and adds security items from the NCSA WSS 1.0 website standard.
Each report has a shareable link in the form /scan?d=yourdomain and prints cleanly to PDF. There is no sign-up and nothing is stored. Pages rendered entirely by script are reported as "cannot be checked from outside" instead of being marked as failures.
Signal 1: where should the privacy-policy link be?
Wherever people can see it before or while their data is collected. PDPA section 23 does not just say "have a policy"; it says when the notice must reach the person. If your homepage sets cookies or has a form, the notice has to be findable from the homepage too.
In collecting the Personal Data, the Data Controller shall inform the data subject, prior to or at the time of such collection, of the following details, except the case where the data subject already knows of such details:
Section 23 lists six items: the purpose; when data must be given under law or contract and what happens if it is not; the data collected and how long it is kept; who it may be disclosed to; contact details of the controller and any DPO; and the data subject's rights. A good policy page answers all six, not just the headings.
TDPG 4.0 gives an example that matches a common mistake. A company placed its notice on the homepage only, then found that many customers arrived from search engines straight onto other pages and never saw it. The fix it describes is linking the notice from every page that collects data.
Even though the absence of a Privacy Notice at that particular point may not violate the requirements under the PDPA law if notification is sufficiently provided at another point, as a matter of best practice, having a Privacy Notice at every point accessible to the customer will better enhance fairness and transparency for the data subject
How to check it
- Scroll to the bottom of the homepage and look for "Privacy Policy" or its Thai equivalent.
- Open a product page or article straight from a search result and check the same link is in its footer.
- Click through and look for the company name, contact details and a list of data subject rights.
- Repeat on a phone; some sites bury footer links inside a menu several taps deep.
Signal 2: does every website need a cookie banner?
Not every one. A site that only uses cookies it needs to work, such as a shopping basket or a language setting, may not need to ask at all. The moment you add an analytics tool or an advertising pixel, you are collecting data that relies on consent, and that consent has to come first.
The Data Controller shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior to or at the time of such collection, use, or disclosure, except the case where it is permitted to do so by the provisions of this Act or any other laws.
So a banner is not decoration. It is the mechanism that makes section 19 consent actually happen. A banner with a single OK button, or one with every category already switched on, does not do that job, because the visitor has no real choice.
Consent must not be requested in a manner that is pre-set in advance; silence, or a pre-ticked box, is not considered clear consent.
The part people forget is withdrawal. Section 19 paragraph five lets people withdraw at any time, and it must be as easy as giving consent. If accepting took one click on a banner, withdrawing should not require an email to the legal team.
The data subject may withdraw his or her consent at any time. The withdrawal of consent shall be as easy as to giving consent
How to check it
- Open the site in a private (incognito) window so old cookies do not hide the result.
- See whether a banner appears, and whether Reject is as visible as Accept.
- Open the settings and check that categories are separated and non-essential ones are off by default.
- After accepting, try to change your mind, for example through a Cookie settings link in the footer.
The direct fix is a banner where Accept and Reject are the same size on the same layer, with categories to choose from and a record of who chose what and when. The AIPDPA banner works this way: visitor choices are logged on Cloudflare D1 without storing IP addresses and feed a consent register that keeps per-person proof and withdrawal history. Setup is on the cookie banner page for developers; design principles are in the cookie consent banner guide.
Signal 3: do ad pixels fire before the visitor says yes?
This is where most sites fail without knowing it. The banner looks fine, yet Meta Pixel, TikTok Pixel or Google Analytics is already sending data as the page loads, before anyone has read the banner. Having a banner does not mean the trackers are listening to it.
TDPG 4.0 explains that the online identifiers these tools use can be personal data, and states plainly that online behavioural advertising cannot rely on legitimate interest.
online identifiers that may be considered personal data may also include MAC addresses, advertising IDs, pixel tags, account handles, and device fingerprints.
C48 Online Behavioural Advertisement, or targeted advertisement, is a form of targeted advertising that relies on data specific to an individual, especially profiling data that enables the advertiser to know detailed personal data about the target, which cannot use the legitimate interest basis and must use the consent basis.
How to check it
In a private window, press F12, open the Network tab and load the page without touching the banner. Type facebook, tiktok, google-analytics or clarity into the filter box. Anything that shows up before you click Accept means the tracker has already run.
The fix is to make your tag manager (Google Tag Manager, for instance) obey the banner, so ad and analytics tags fire only on an accept signal. With Google tools, set Consent Mode to denied by default and update it when the visitor accepts. Any pixel pasted straight into the page source, outside the tag manager, has to be moved first.
Signal 4: what do cookies set on first load tell you?
They show what the site took before the visitor had a say. Some cookies arrive with the server's very first response, without waiting for any script. If that list contains names like _ga, _gid, _fbp, _hj or _ttp, analytics or advertising cookies are already in place, whatever the visitor later clicks.
TDPG 4.0 sorts cookies into categories and suggests designing consent around those categories. Necessary cookies sit in one group; analytics and advertising cookies sit in others. Setting the second group on first load defeats the point of letting people choose.
In the case of requesting cookie consent, multiple types of cookies are often used, which can be divided into various categories, such as Necessary Cookies, Analytics/Performance Cookies, and Advertising Cookies.
How to check it
In a private window, open the site, press F12 and go to the Application tab (Chrome) or Storage (Firefox), then Cookies. Read the list before answering the banner. Names like session, csrf or lang are usually necessary; names starting with _ga or _fbp belong to analytics and ad tools.
A frequent cause is server-side tagging, or a content-management plugin that sets cookies itself without asking the banner. The fix is for the web team to trace where each cookie comes from and tie every non-essential one to the consent result.
Signal 5: how can a customer ask to see their own data?
There has to be a visible route. Section 23 (5) and (6) require you to give contact details for the controller and any DPO and to tell people their rights. If the site has no request link, no DPO email and no data-protection form, an outsider can conclude in seconds that the company is not ready to receive requests.
(5) information, address, and the contact channel details of the Data Controller, where applicable, of the Data Controller's representative or data protection officer;
The channel matters because the deadline runs from the day a request is received. For requests to access and obtain a copy of data, section 30 paragraph four sets a maximum of 30 days. A request sitting unread in a general inbox still uses up those days.
the Data Controller shall fulfill the request without delay, but shall not exceed thirty days from the date of receiving such request.
A good fix is a dedicated request page linked from the footer and the policy, a form that asks only for what you need to verify identity, and a named owner who can see the due date. The AIPDPA rights-request page gives you a public link and a QR code for the shop counter, counts the 30 days automatically and sends reminders at 7 days and at 1 day. For handling each request type, see the data subject requests guide and answering rights requests within 30 days.
What can an outside check not see?
Quite a lot, and it is worth being plain about it. A homepage check sees only what the browser receives. It cannot see how long you keep data, who you share it with, or whether requests are answered on time. Passing all five shows a tidy shop front; it does not certify that the company complies with the PDPA.
The HTML the server sends has almost no links; everything is built after scripts run. A tool that does not run scripts should not claim things are missing, so /scan reports these items as "cannot be checked from outside". Look at the page yourself.
If the banner code is not in the homepage HTML, the report may say no consent tool was found even though visitors see one. Confirm in a private window.
Both are present, but that does not prove the trackers wait. Check the Network tab before clicking Accept.
The first-response check only sees cookies the server sets. Cookies written later by JavaScript need the Application tab.
You still need a record of processing, processor contracts, retention periods and someone who actually answers requests. No outside tool can see those.
Several checks failed: what should you fix first?
Start with whatever is sending data out without a legal basis right now, then fill in what is missing. For a small team with limited time, this order works well:
- Stop ad pixels and analytics that fire before consent (signals 3 and 4); every new visit sends data out again.
- Install a banner where Reject is as prominent as Accept, and tie every tag to its result (signal 2).
- Link the privacy policy from every footer and under every form, and check it covers the six section 23 items (signal 1).
- Open a rights-request channel and name someone who knows access requests have 30 days (signal 5).
- Re-run /scan after each fix and whenever marketing adds a new tool, and keep the report link as a record of when you checked.
That last step matters more than it looks. Sites that once passed often slip back because someone added a campaign pixel without telling anyone. A monthly re-check takes minutes and lets you spot the problem before an outsider does.
If your cookies are used to retarget past visitors, the next read is on choosing a lawful basis for marketing: do you need consent every time you message past customers.
Frequently asked questions
Does the PDPA require every website to have a cookie banner?
The PDPA never mentions cookies, but section 19 requires consent before or at the time of collection where no other basis applies. A site using analytics or advertising cookies therefore needs a way to ask, which in practice is a banner. A site using only cookies needed to function may not need to ask.
We have a banner. Why does the report say trackers fire before consent?
Because the banner and the trackers are separate pieces. Many sites install a banner but leave Meta Pixel or Google Analytics code pasted directly into the page, where it runs as soon as the page loads. Every tag has to be tied to the banner result through a tag manager or Consent Mode.
Must the privacy-policy link be on every page or only the homepage?
Section 23 requires notice before or at the time of collection; it does not name pages. TDPG 4.0 accepts that a missing link at one point may not breach the law if notice is given sufficiently elsewhere, but recommends as best practice having it at every point customers can reach. A footer link does this on every page.
The report says "cannot be checked from outside". Is that a fail?
No. It means the page is built entirely by script, so the HTML from the server has no links to read, and the tool does not claim anything is missing. Open the site yourself and check for a policy link and a rights-request channel.
If all five checks pass, are we PDPA compliant?
No. These five are only what a web page shows. You still need a record of processing activities, processor contracts, security measures, retention periods and people who answer rights requests on time, none of which an outside tool can see.
How is the deadline counted when a request arrives at a general company inbox?
Section 30 paragraph four counts 30 days from the date the access request is received, and it does not distinguish between channels. A request left unread in an unmonitored inbox can therefore run out of time. A dedicated channel with a named owner who sees the due date avoids that.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 19 · Section 23 · Section 30
- TDPG 4.0 (Thailand Data Protection Guidelines) — guidance, not law — A7 · C20 · C23 · C48 · E9
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)