How to Run a Cookie Consent Banner under Thailand's PDPA A cookie consent banner is how a website asks for consent to cookies that identify or track users, which can be personal data, so the banner must meet Section 19 of the Personal Data Protection Act B.E. 2562 (2019): consent obtained before or at the time of collection, given expressly, with the purpose stated, separate from other text, in plain language, freely given, and as easy to withdraw as to give. The TDPG 4.0 guidelines recommend grouping cookies by category so users can choose each one.
An online cosmetics store puts up a cookie banner with a single 'Accept' button, while its ad pixel and analytics tool fire the moment the page loads. When a customer asks how to withdraw consent, nobody on the team can answer.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- The TDPG 4.0 guidelines treat cookie identifiers as online identifiers that can identify or single out a person.
- Consent must come before or at the time of collection, be given expressly, and state its purpose (Section 19).
- Users must be able to withdraw consent as easily as they gave it.
- Consent that does not meet Section 19 does not bind the data subject and cannot be relied on.
- TDPG 4.0 takes the view that profile-based behavioural advertising needs consent, not legitimate interests.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Audit every cookie and scriptList every cookie, pixel and tag on your site, who sets it, what it does and how long it lasts.
- Group them by purposeUse categories like the TDPG 4.0 examples: necessary, analytics or performance, and advertising cookies.
- Set a lawful basis per groupDecide which groups need Section 19 consent and which rely on another basis in Section 24, and record your reasoning in your Record of Processing Activities (RoPA).
- Design the first layerState purposes in plain language, separate from other text. A good practice is to give Accept and Reject equal prominence so the choice is genuinely free.
- Build a second layer with per-category settingsFollowing the layered approach in TDPG 4.0, let users open details and retention periods for each cookie and consent category by category.
- Fire scripts only after consentMake consent-based scripts run only once the user agrees, keep a consent log, and provide a settings link so users can withdraw at any time.
Are cookies personal data?
They can be. The TDPG 4.0 guidelines explain that online identifiers such as IP addresses, cookie identifiers, advertising IDs and device fingerprints can identify or single out individual users, especially when combined with other data.
TDPG 4.0 gives the example of cookies used to track a person across websites, which may amount to processing personal data where the identifiers are used to build a profile of that person.
What must a cookie banner include under Section 19?
Section 19 prohibits collecting, using or disclosing personal data without consent given beforehand or at the time, unless the law permits otherwise, and sets these conditions for valid consent.
- Given expressly, in writing or through an electronic system
- The purpose of collection, use or disclosure is stated
- Clearly separate from other text, easy to access, in plain language and not misleading
- The data subject's freedom to choose is respected to the utmost
- Withdrawal is as easy as giving consent, and users are told any effect of withdrawing
Which cookies need consent?
Section 24 provides bases other than consent, such as necessity for a contract (Section 24(3)) and legitimate interests (Section 24(5)), which must not be outweighed by the data subject's fundamental rights. The right basis depends on what each cookie actually does.
For behavioural advertising, TDPG 4.0 takes the view that profile-based targeting cannot rely on legitimate interests and requires consent, obtained with particular care. Where a controller discloses data on the basis of legitimate interests, TDPG 4.0 says the balancing reasoning should be recorded in the RoPA.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Only an 'Accept' button, or 'Reject' buried two clicks deep. | ✓ Section 19 requires respect for the user's freedom to choose and withdrawal as easy as consent, so give Accept and Reject equal weight. AIPDPA's cookie banner has equal-weight Accept and Reject buttons, 8 skins, and Thai and English text. |
| ✗ Ad scripts fire before the user clicks anything. | ✓ Consent must come before or at the time of collection, so consent-based scripts must wait. AIPDPA's banner does not auto-block third-party scripts; you tag your scripts so they run according to consent, and it supports Google Consent Mode v2. |
| ✗ No proof of who consented when, and a cookie policy that does not match reality. | ✓ Keep a consent log and a cookie policy that reflects the cookies you actually use. AIPDPA keeps a consent evidence log with no IP addresses stored, deletes it automatically after the 6 to 30 months you choose, and generates your cookie policy page. |
Launch a cookie banner with equal Accept and Reject buttons in minutes
AIPDPA's cookie banner supports Thai, English and Google Consent Mode v2, keeps consent evidence without storing IP addresses, and generates your cookie policy page. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Does my website need a cookie banner in Thailand?
If your site uses cookies that identify or track users on the basis of consent, Section 19 requires that consent before or at the time of collection. A cookie banner is the usual way to ask for it on a website.
Is a single 'Accept all' button enough?
Usually not. Section 19 requires respect for the user's freedom to choose, and the TDPG 4.0 examples let users accept or reject each cookie category at any time, so refusing should be about as easy as accepting.
Do strictly necessary cookies need consent?
Sections 19 and 24 do not mention cookies directly. The TDPG 4.0 examples put necessary cookies in their own category, separate from analytics and advertising; whether another Section 24 basis fits depends on what the cookie does, and you should record your reasoning.
Can advertising cookies rely on legitimate interests?
The TDPG 4.0 guidelines say no for profile-based behavioural advertising: it requires consent, and data subjects can also object to profiling.
How do users withdraw cookie consent?
Section 19 lets users withdraw at any time, as easily as they consented. A good practice is a cookie settings link available on every page, and stopping the related scripts as soon as consent is withdrawn.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 19
- Personal Data Protection Act B.E. 2562 (2019), Section 24
- Thailand Data Protection Guidelines 4.0 (TDPG 4.0), paras A7 and C48–C49 and cookie consent examples (guidance, not law)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
Equal-weight accept/reject buttons, 10 skins, Thai/English, consent evidence without storing IP, and an auto-generated cookie policy page.
Join the waitlist →See which activities rely on consent, where the proof is and who has withdrawn.
Join the waitlist →Scan your sites against the NCSA website security standard and get certificate-expiry alerts.
Join the waitlist →Websites built to be found and quoted by Google and AI.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.