Social Media Marketing Law
in Thailand

1. Thailand's Digital Landscape Context and Scale of Digital Marketing in Thailand

Thailand is one of Southeast Asia's most digitally active societies. With over 61.21 million internet users — representing 85.3% of the total population — and an average daily online usage of 8 hours and 6 minutes per person, the country ranks among the highest globally for time spent online. Social media penetration is correspondingly high: Facebook (91%), LINE (90.7%), Messenger (80.8%), TikTok (78.2%), and Instagram (66.4%) collectively dominate the digital marketing landscape.

For businesses operating in Thailand, social media and digital channels are no longer optional additions to a marketing strategy — they are primary commercial channels reaching the majority of Thai consumers. This commercial significance, however, comes with an expanding and increasingly enforced body of digital marketing law. Regulators including the Electronic Transactions Development Agency (ETDA), the Office of the Consumer Protection Board (OCPB), the Personal Data Protection Committee (PDPC), and the Royal Thai Police's Cyber Crime Investigation Bureau have all increased enforcement activity against digital marketing violations in recent years.

2. Computer Crime Act B.E. 2550 — SPAM and False Data Key Provisions Applicable to Digital Marketing

The Computer Crime Act B.E. 2550 (2007) (พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550) as amended by the Computer Crime Act (No. 2) B.E. 2560 (2017), establishes three provisions of primary relevance to digital marketing practitioners: Section 11 (SPAM), Section 14 (false data), and Section 12 (aggravated computer offenses).

2.1 Section 11 — Unsolicited Messages (SPAM)

The first prohibited act under Section 11 is concealing or falsifying the source of a message transmitted via a computer system. Any marketing communication that disguises the true sender identity — including the use of anonymous email services to mask brand identity, or the use of fake social media profiles for commercial outreach — falls squarely within this prohibition. The penalty is a fine not exceeding 100,000 Thai Baht.

The second prohibited act is sending data that causes annoyance or nuisance to another person, without providing that person with a reasonable opportunity to refuse receipt of further messages. In practice, this means that any email marketing, SMS marketing, or direct messaging campaign on social media platforms must include a clearly visible and functional Unsubscribe or opt-out mechanism. Failure to provide this opt-out exposes the sender to a fine not exceeding 200,000 Thai Baht.

2.2 Section 14 — Entering False Data into Computer Systems

Section 14 of the Computer Crime Act B.E. 2550 creates criminal liability for entering forged, false, or distorted computer data into a computer system. This provision is highly relevant to digital marketing because it encompasses a broad range of commercial communications that involve false or misleading claims:

• Forged or false data: Publishing fabricated product reviews, fake endorsements attributed to non-existent customers, or falsified user-generated content. Penalty: imprisonment not exceeding 5 years or a fine not exceeding 100,000 Thai Baht, or both.
• Data likely to cause public panic: Sharing false information about public health, product safety scares, or market conditions that may cause public alarm — even if done for promotional purposes.
• Data that damages national security, the economy, or critical infrastructure: False claims that affect financial markets, banking confidence, or critical service providers.

For digital marketers, Section 14 most commonly arises in the context of fabricated product reviews or testimonials, fake influencer endorsements, falsified before-and-after comparisons, and misleading health or efficacy claims entered into product listing systems or social media platforms.

2.3 Section 12 — Aggravated Penalties

While Section 12 aggravated penalties are primarily designed for serious cybercrime rather than routine marketing violations, they serve as a reminder that computer-related offenses in Thailand can attract custodial sentences and substantial fines — and that the Computer Crime Act is not merely an administrative instrument.

2.4 Practical Compliance Requirements Under the Computer Crime Act

1. Sender identification: Every marketing communication — email, SMS, LINE broadcast, social media direct message, or digital newsletter — must clearly identify the actual sender or brand responsible for the communication. Anonymous or disguised sender information is a direct violation of Section 11.
2. Mandatory opt-out mechanism: All unsolicited or broadcast commercial messages must include a functional Unsubscribe or opt-out option. Best practice is to include this in a prominent, accessible location in every communication, not buried in fine print.
3. No fabricated content: Do not create, publish, or circulate fabricated reviews, false endorsements, or misleading testimonials in any digital channel. This applies equally to content posted on owned channels, paid placements, and influencer content commissioned by the brand.

3. Consumer Protection Act B.E. 2522 — Online Advertising Standards Prohibited Advertising and Regulatory Enforcement

The Consumer Protection Act B.E. 2522 (1979) (พระราชบัญญัติคุ้มครองผู้บริโภค พ.ศ. 2522) and its amendments establish the foundational legal framework for advertising in Thailand, including online and social media advertising. The Act is administered by the Office of the Consumer Protection Board (OCPB) under the Prime Minister's Office, which has active powers of investigation, injunction, and prosecution.

3.1 The Four Categories of Prohibited Advertising

3.2 Penalties Under the Consumer Protection Act

In addition to criminal and administrative penalties, the OCPB has the authority to order the advertiser to (i) immediately cease the prohibited advertisement; (ii) publish corrections or clarifications at the advertiser's expense; and (iii) in cases of widespread consumer harm, publish a formal public apology. These reputational consequences can be more commercially damaging than the fines themselves for consumer-facing brands.

4. Digital Footprint and PDPA Obligations Personal Data Processing in Digital Marketing

A Digital Footprint is the data trail generated by every form of online activity — browsing history, search queries, social media interactions, purchase behavior, device identifiers, and geolocation data. For digital marketers, Digital Footprint data is the analytical foundation of targeted advertising, customer segmentation, and campaign optimization. Under Thai law, however, collecting, processing, and using this data constitutes processing of personal data and is therefore subject to the Personal Data Protection Act B.E. 2562 (2019) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562).

4.1 Business Value of Digital Footprint Data

• Consumer behavior analysis: Understanding purchase triggers, content preferences, and channel engagement patterns to inform marketing strategy and budget allocation.
• Customer Persona development: Building accurate and statistically validated representations of target audiences for content creation and paid media targeting.
• User Experience (UX) optimization: Improving website and app interfaces based on observed user interaction data, reducing friction in the conversion funnel.
• Campaign ROI measurement: Attributing revenue to specific marketing touchpoints through multi-touch attribution models based on tracked digital interactions.

4.2 PDPA Compliance Obligations for Digital Marketers

The PDPA B.E. 2562 applies to any collection, use, or disclosure of personal data relating to an identified or identifiable natural person. Because most Digital Footprint data (browser cookies with user IDs, IP addresses associated with accounts, behavioral profiles linked to login data) constitutes personal data under the PDPA, digital marketing practices that rely on this data must satisfy PDPA requirements.

1. Legal basis for processing: Marketers must identify a valid legal basis under Section 24 of the PDPA B.E. 2562 for each processing activity. For marketing purposes, consent (Section 19) is typically the primary basis. Consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes and bundled consents are not valid consent under the PDPA.
2. Cookie Consent: Websites targeting Thai users must display a Cookie Consent notice and obtain active consent from users before deploying non-essential cookies (analytics, marketing, social media tracking pixels). Essential cookies (those strictly necessary for the website to function) may be used without consent, but all other cookie categories require opt-in.
3. Privacy Notice: Before collecting personal data, a clear and accessible Privacy Notice must be provided to data subjects explaining: what data is collected, the purposes of processing, the legal basis, the retention period, and the data subject's rights under the PDPA.
4. Data Subject Rights: Marketing databases must be capable of responding to data subject requests for access, correction, deletion, withdrawal of consent, and data portability within the timeframes specified by the PDPA.
5. Data Retention Limits: Personal data collected for marketing purposes must not be retained beyond the period necessary for the stated marketing purpose or the period covered by the consent obtained.

5. Practical Compliance Checklist for Digital Marketers Pre-Publication Legal Review — 8 Points

Before publishing or broadcasting any digital marketing communication in Thailand, the following eight compliance points should be verified. This checklist draws on the Computer Crime Act B.E. 2550, Consumer Protection Act B.E. 2522, PDPA B.E. 2562, Copyright Act B.E. 2537, and Trademark Act B.E. 2534.

6. E-Commerce Laws and Related Obligations Electronic Transactions, Distance Selling, and Business Registration

Digital marketers operating e-commerce channels in Thailand must also comply with a set of laws governing the conduct of electronic commerce, consumer rights in distance selling, and business registration requirements.

6.1 Electronic Transactions Act B.E. 2544 (2001)

The Electronic Transactions Act B.E. 2544 (พระราชบัญญัติว่าด้วยธุรกรรมทางอิเล็กทรอนิกส์ พ.ศ. 2544) provides the foundational legal recognition of electronic contracts, electronic signatures, and electronic records in Thailand. Key implications for digital marketers include:

• Electronic contracts are legally binding: Offers and acceptances made through website checkout flows, app subscription agreements, and social commerce transactions are legally enforceable contracts once the statutory requirements of contract formation are met.
• Electronic signatures are recognized: Digital signatures and other forms of electronic authentication used in e-commerce transactions are legally valid under the Act, provided they meet the reliability requirements specified in the Electronic Transactions Act B.E. 2544.
• Offer and acceptance timing: The Act specifies rules for when electronic offers expire, when acceptance takes effect, and how revocation operates in an electronic environment — all of which affect the terms that can be enforced from a promotional campaign.

6.2 Consumer Rights in Distance Selling

Consumers who purchase goods or services through distance selling channels (online, telephone, catalogue) in Thailand benefit from a 7-day right of return under OCPB notifications on distance selling. This right applies to goods purchased without the consumer having the opportunity to physically inspect the goods before purchase. Digital marketers designing promotion terms must ensure that return policies disclosed in advertising are consistent with this statutory minimum entitlement.

6.3 E-Commerce Business Registration

Businesses selling goods or services online in Thailand — whether through their own website, a mobile application, social media storefront, or marketplace platform — are required to register as an e-commerce business with the Department of Business Development (DBD) under the Ministry of Commerce. The registration requirement applies to businesses earning annual revenue from online channels exceeding the threshold specified by the Ministry of Commerce. Failure to register carries administrative penalties.

7. Copyright and Trademark in Social Media Marketing Intellectual Property Obligations for Digital Campaigns

7.1 Copyright Act B.E. 2537 — Content Licensing

The Copyright Act B.E. 2537 (1994) (พระราชบัญญัติลิขสิทธิ์ พ.ศ. 2537) protects original creative works — including photographs, videos, music, written text, graphic designs, and software — from the moment of creation, without any registration requirement. For digital marketers, the most common copyright exposure points are:

• Stock photography and video: Using images or footage found through internet searches without verifying and obtaining the appropriate license. Images published on websites are not in the public domain by default — they remain protected under the Copyright Act B.E. 2537.
• Background music in video content: Using copyrighted music tracks in brand videos, Reels, TikToks, or YouTube content without a synchronization license. Social media platforms' internal music libraries provide pre-cleared tracks for personal use, but commercial use by brands may require separate licensing.
• User-Generated Content (UGC) repurposing: Resharing or incorporating consumer-posted content into brand marketing without obtaining the original creator's written permission. Even a public post does not grant the brand a license to use that content commercially.
• Competitor content: Reproducing or adapting a competitor's website copy, product descriptions, or advertising materials — even as part of a comparison campaign — constitutes copyright infringement.

7.2 Trademark Act B.E. 2534 — Brand Identity Protection

The Trademark Act B.E. 2534 (1991) (พระราชบัญญัติเครื่องหมายการค้า พ.ศ. 2534) protects registered trademarks — including word marks, logos, slogans, and trade dress — from unauthorized use in the course of trade. Digital marketing scenarios that can generate trademark liability include:

• Keyword advertising (Search Engine Marketing): Bidding on a competitor's registered trademark as a paid search keyword without authorization can constitute trademark infringement or passing off under Thai law, particularly where the resulting ad is likely to cause consumer confusion.
• Hashtag use: Using a competitor's trademarked brand name as a hashtag in commercial content to divert social media search traffic toward competing products.
• Product comparison advertising: Thai law permits truthful comparative advertising but prohibits comparisons that create confusion between products or that unfairly denigrate a competitor's brand — both of which may also engage trademark and unfair competition principles.

8. Influencer Marketing — Disclosure and Liability Sponsored Content, KOL Obligations, and Brand Liability

Influencer marketing — the commissioning of Key Opinion Leaders (KOLs), content creators, or social media personalities to promote a brand's products or services — is a dominant form of digital marketing in Thailand. The legal framework governing influencer marketing draws on the Consumer Protection Act B.E. 2522, OCPB advertising guidelines, and the Computer Crime Act B.E. 2550 (for false information provisions).

8.1 Mandatory Disclosure of Commercial Relationships

Any content published by a third party (influencer, blogger, reviewer, or social media user) that promotes a brand's products or services in exchange for payment, free products, discounts, affiliate commissions, or any other form of commercial consideration must be clearly disclosed as sponsored or paid content. The OCPB has confirmed that failure to disclose a commercial relationship in promotional content constitutes deceptive advertising under the Consumer Protection Act B.E. 2522.

Adequate disclosure requires: (i) a clear and conspicuous label such as "Sponsored," "Paid Partnership," "Advertisement," or "Paid promotion" placed prominently in the content — not hidden in hashtags at the end of a long caption; and (ii) disclosure at the outset of the content, not reserved for the end. Platform-native disclosure tools (Instagram's "Paid Partnership" label, TikTok's "Branded Content" toggle) satisfy the technical requirement but do not substitute for contractual disclosure obligations between the brand and the influencer.

8.2 Shared Liability Between Brand and Influencer

Under the Consumer Protection Act B.E. 2522, both the advertiser (brand) and the publisher of the advertisement (influencer) can face personal liability for prohibited advertising content. This means:

• Brands are liable for the content they commission, brief, and approve — even if the specific language or imagery was developed independently by the influencer, provided the brand approved or failed to exercise reasonable oversight over the final content.
• Influencers are personally liable for content they publish that contains prohibited advertising claims, including claims about products they received for review, claims made without adequate substantiation, and undisclosed paid promotions.
• Contracts matter: Well-drafted influencer agreements should allocate compliance responsibility, specify content review and approval rights, prohibit claims that have not been pre-approved by the brand's legal or regulatory team, and include indemnification provisions that address regulatory fines arising from non-compliant content.

9. Frequently Asked Questions FAQ — Social Media Marketing Law in Thailand

Q1: Does sending a LINE broadcast to existing customers require consent under PDPA?

Yes, if the broadcast involves sending marketing messages to individuals on the basis of their personal data (including their LINE ID and purchase history), this constitutes processing of personal data for direct marketing purposes. Under PDPA B.E. 2562, Section 24(7), direct marketing is a permissible basis for processing in some cases, but the data subject must have been informed of this use at the time of collection and must not have objected. For LINE Official Account broadcasts, it is best practice to obtain explicit opt-in consent at the point of LINE ID registration and to honor opt-out requests promptly.

Q2: Can we use competitor brand names in our Google Ads keywords?

Bidding on a competitor's registered trademark as a keyword in Google Ads (or other search advertising platforms) is a legally complex area in Thailand. While using a competitor's brand as a keyword to trigger ad display is not automatically infringement, the ad's content must not itself use the competitor's trademark in a manner likely to cause confusion, imply affiliation, or unfairly denigrate the competitor's brand. Legal risk is highest when the ad copy itself reproduces the competitor's mark, or when the landing page creates consumer confusion about the source of the product. Each situation requires a trademark and passing-off analysis under Thai law.

Q3: What qualifies as "exaggerated" advertising that violates the Consumer Protection Act?

Advertising is exaggerated under the Consumer Protection Act B.E. 2522 when it asserts product qualities, capabilities, or results that cannot be substantiated by objective evidence. The test is whether the claim creates a materially false impression in the mind of a reasonable consumer about the product's actual capabilities. Comparative superlatives ("Thailand's #1," "the most effective on the market") require objective substantiation such as verified market research data or independent certification. Health and efficacy claims for food, cosmetics, and supplements that imply therapeutic or pharmaceutical effects are particularly scrutinized and typically require prior Thai FDA authorization.

Q4: If our influencer publishes non-compliant content independently, is our brand liable?

The extent of brand liability for independently generated influencer content depends significantly on whether the brand briefed, approved, or had reasonable opportunity to review the content before publication. If the brand commissioned the content, provided the product for promotion, and approved the final post, it is difficult to disclaim knowledge of or responsibility for the content under the Consumer Protection Act B.E. 2522. Strong contractual protections — including pre-publication approval rights, compliance warranties from the influencer, takedown obligations, and indemnification clauses — can help allocate risk, but do not eliminate brand exposure to regulators for content published on the brand's commercial behalf.

Q5: Do we need to register our online store with any Thai government agency?

Yes. Businesses operating online stores in Thailand — regardless of whether sales are conducted through a proprietary website, a social media storefront (Facebook Shop, Instagram Shop, TikTok Shop), or a third-party marketplace — are required to register as an e-commerce business with the Department of Business Development (DBD) under the DBD Notification on Electronic Business Registration. The registration threshold and process are updated periodically; current requirements should be verified directly at the DBD website (www.dbd.go.th). Foreign-owned online businesses selling to Thai consumers may also have VAT registration obligations under Revenue Department guidance applicable to foreign e-service providers.