Modern websites rely on tracking technologies to understand visitor behaviour, measure marketing performance, improve user experience, and generate leads. Tools such as Google Analytics, Meta Pixel, advertising cookies, and third-party tracking scripts allow businesses to evaluate campaigns and deliver more relevant advertising.
However, these technologies can also collect or process information relating to identifiable individuals. For businesses operating in Thailand, this raises important questions under the Personal Data Protection Act B.E. 2562 (2019), commonly known as the PDPA.
Installing a tracking script may appear to be a routine marketing or technical decision. In practice, its legal implications depend on the information collected, the purposes of processing, the parties receiving the information, and the lawful basis relied upon.
A cookie banner alone does not necessarily resolve these issues. Businesses must also consider transparency, consent where required, third-party disclosures, international data transfers, security, and the ability to demonstrate compliance.
This guide explains the principal legal considerations for website owners, e-commerce businesses, marketing agencies, and companies using analytics and advertising technologies in Thailand.
How the PDPA Applies to Website Tracking
Thailand does not have a standalone cookie law that comprehensively regulates every tracking technology. Instead, website tracking activities must be assessed under the general requirements of the PDPA when they involve personal data.
Personal data generally means information relating to an identifiable individual, excluding information about deceased persons specifically covered by the statutory definition.
Depending on how a tracking system operates, relevant information may include:
- Online identifiers and cookie IDs associated with identifiable users.
- IP addresses and device-related identifiers.
- Pages visited and interactions with website content.
- Advertising and conversion events linked to an individual or profile.
- Location or behavioural information that can identify a person directly or indirectly.
- Information submitted through forms and subsequently linked to online activity.
Not every cookie or technical identifier necessarily constitutes personal data in every circumstance. The assessment depends on the information involved and whether an individual can be identified directly or indirectly.
Businesses should therefore evaluate their actual tracking configuration rather than assuming that all cookies are harmless or that every cookie automatically requires the same treatment.
Who is responsible for compliance?
A company operating a website will often act as a data controller when it determines the purposes and means of processing personal data collected through that website.
However, the legal roles of analytics providers, advertising platforms, website developers, and marketing agencies depend on their actual activities and contractual arrangements.
A service provider may act as a data processor for certain activities, while another provider may independently determine purposes and means of processing. Businesses should assess these relationships individually instead of relying exclusively on labels in standard contracts.
Understanding the Different Types of Cookies and Tracking Technologies
Website operators should maintain an inventory of the technologies installed on their websites and understand what each technology does.
Strictly necessary cookies
Strictly necessary cookies support functions that users request or that are essential to the website’s operation. Examples may include session management, authentication, shopping cart functionality, and security-related functions.
Where processing is necessary for a relevant service or another applicable lawful basis is available, separate consent may not be required. Nevertheless, businesses must still assess the applicable PDPA obligations and provide appropriate transparency.
Analytics and performance cookies
Analytics tools help businesses understand website traffic, identify popular pages, measure conversion rates, and improve website performance.
Depending on their configuration, these tools may collect identifiers, browsing events, or other information associated with visitors. Businesses should examine whether personal data is processed and identify an appropriate lawful basis.
Where consent is the required basis, analytics tracking should not begin before valid consent is obtained.
Advertising and retargeting cookies
Advertising technologies can track interactions with websites to measure campaign effectiveness, build audiences, or deliver personalised advertisements.
For example, a visitor might view a product page before later seeing an advertisement for the same product on a social media platform.
Because such tracking is not ordinarily necessary to deliver the website functionality requested by the visitor, businesses should pay particular attention to consent requirements, transparency, and the information shared with advertising providers.
Pixels, SDKs, and server-side tracking
Tracking does not depend exclusively on cookies.
A tracking pixel may transmit events to an external platform, while software development kits (SDKs), local storage, and server-side integrations may also transmit information about user activity.
Moving tracking from a browser to a server does not automatically remove the processing from the scope of the PDPA. The relevant questions remain what information is processed, why it is processed, who receives it, and which legal requirements apply.
When Is Consent Required?
Consent is one of the lawful bases recognised under the PDPA, but it is not the only possible basis for processing personal data.
Businesses must identify an appropriate lawful basis for each processing purpose. Depending on the circumstances, other bases may apply, such as contractual necessity, legal obligations, or legitimate interests, subject to their respective requirements.
Consent should not be treated as a universal solution for every website activity. Equally, businesses should not assume that legitimate interests automatically justify behavioural advertising or all analytics activities.
When consent is required, it must satisfy the applicable legal conditions. These include providing appropriate information, obtaining a genuine and informed choice, and ensuring that withdrawal is possible under the applicable rules.
A compliant consent process should be designed around the actual processing activities rather than simply copying a generic consent statement.
What should a cookie banner include?
A well-designed cookie banner should help visitors understand their options and make meaningful choices.
Consider implementing the following features:
- A clear explanation of the website’s use of cookies and similar technologies.
- Separate categories for necessary, analytics, and advertising technologies where appropriate.
- An accessible mechanism for accepting or refusing optional tracking.
- A preference-management interface for selecting permitted categories.
- Information about relevant purposes and third-party providers.
- A straightforward method for changing preferences or withdrawing consent.
- Records demonstrating the choices made and the applicable consent configuration.
The precise requirements depend on the processing activities and applicable law. The interface should make the consequences of each choice understandable without relying on confusing language or misleading design.
Why a Cookie Banner Alone Is Not Enough
One common compliance mistake is to install a cookie banner while allowing every tracking script to run immediately when a page loads.
If a particular technology requires prior consent, displaying a banner after that technology has already started collecting information does not, by itself, resolve the problem.
Businesses should examine the technical behaviour of their websites, including scripts embedded in page templates, tag management systems, advertising integrations, and third-party plugins.
A practical compliance process should address the following areas.
Script control
Configure the website so that technologies requiring consent remain inactive until the appropriate choice has been recorded.
Preference management
Ensure that a visitor’s refusal or withdrawal is reflected in the website’s actual tracking behaviour, including relevant tags and integrations.
Consent records
Maintain appropriate records of consent where required, including the relevant choice, purpose, and applicable version of the consent notice.
Policy consistency
Ensure that the cookie notice, privacy notice, website functionality, and actual data processing practices accurately describe the same activities.
Ongoing testing
Recheck the website following changes to its content management system, marketing tools, plugins, or advertising configuration.
These measures help demonstrate that compliance is implemented operationally rather than existing only as a written policy.
Third-Party Analytics and Advertising Platforms
Many businesses depend on external providers for visitor analytics, campaign measurement, conversion tracking, and audience management.
These arrangements can introduce additional legal considerations because information may be transmitted outside the website owner’s direct technical environment.
Before implementing a third-party tracking service, businesses should establish:
- What information the service collects or receives.
- The purposes for which the information is used.
- Whether the information can identify or be linked to an individual.
- The provider’s role under the relevant data protection arrangement.
- Whether information is disclosed to other parties.
- Where information is stored or processed.
- What retention, security, and deletion arrangements apply.
- Whether international transfer requirements are relevant.
A provider’s general statement that its service complies with privacy laws does not automatically establish that the website owner’s implementation is compliant.
The business must assess its own processing activities and responsibilities.
Contractual considerations
Where a provider processes personal data on behalf of a controller, the parties should assess whether an appropriate data processing agreement is required and ensure that the agreement addresses the applicable legal obligations.
Depending on the relationship, relevant provisions may cover processing instructions, confidentiality, security measures, incident notification, subcontracting, assistance with data subject requests, and the return or deletion of information.
Where the provider acts independently for certain purposes, a different contractual and legal analysis may be necessary.
International Data Transfers and Cross-Border Processing
Businesses using international analytics and advertising services should determine whether personal data is transferred to or made available in another country.
For example, a Thai business may operate a website hosted locally while using analytics, cloud infrastructure, or advertising platforms that process information internationally.
The location of the website’s server does not, by itself, establish where all personal data is processed.
Where a transfer of personal data outside Thailand falls within the relevant PDPA provisions, the business should assess the applicable requirements under Section 28 or Section 29, as relevant, together with any applicable exceptions, safeguards, or implementing rules.
Businesses should document the relevant data flows and determine which transfer arrangements apply to their specific circumstances.
A privacy notice should also accurately explain relevant recipients and transfers where required. However, transparency alone does not replace any separate legal requirements governing international transfers.
Retention, Security, and Data Minimisation
Tracking systems can accumulate substantial amounts of information over time. Without appropriate controls, businesses may retain identifiers and behavioural records longer than necessary or make them accessible to more parties than required.
The PDPA requires organisations to consider applicable data protection principles, including purpose limitation, data minimisation, retention, and security.
Practical safeguards include:
- Collecting only the information reasonably necessary for the stated purpose.
- Reviewing retention settings for analytics and advertising systems.
- Restricting administrative access to tracking platforms.
- Protecting account credentials and enabling appropriate authentication controls.
- Reviewing the security of third-party integrations.
- Removing unnecessary tags and obsolete tracking scripts.
- Establishing procedures for handling privacy requests and security incidents.
Businesses should also consider whether their tracking configuration exposes personal data through URLs, event parameters, form submissions, or other unintended channels.
For example, transmitting names, email addresses, or other identifiable information to an analytics platform without an appropriate assessment can create avoidable compliance and security risks.
What Happens If a Website Is Not Compliant?
Failure to comply with applicable PDPA requirements can expose a business to regulatory, civil, and operational consequences, depending on the circumstances.
Potential areas of concern include:
- Processing personal data without an appropriate lawful basis.
- Obtaining consent that does not satisfy the applicable legal requirements.
- Providing incomplete or misleading privacy information.
- Disclosing personal data to third parties without the necessary legal justification.
- Failing to implement appropriate security measures.
- Failing to meet applicable data subject rights or other statutory obligations.
The PDPA provides for different forms of liability and enforcement, subject to the relevant provisions and facts of each case.
The commercial consequences may also extend beyond formal legal proceedings. Businesses may need to suspend marketing campaigns, reconfigure their websites, investigate unexpected data flows, renegotiate provider arrangements, or respond to customer concerns.
For organisations operating across multiple jurisdictions, a tracking configuration that appears acceptable under one framework may still require a separate assessment under Thai law.
A Practical PDPA Website Tracking Checklist
Businesses can use the following checklist as a starting point for reviewing their website tracking arrangements.
Website technology
- Inventory all cookies, pixels, tags, SDKs, and tracking integrations.
- Identify the information collected by each technology.
- Document the purposes for which the information is processed.
- Identify relevant third-party recipients and providers.
Legal compliance
- Determine the appropriate lawful basis for each processing purpose.
- Review whether consent is required and, where applicable, whether it is valid.
- Check that privacy and cookie notices accurately describe actual practices.
- Assess relevant international data transfers.
- Review contracts with analytics and advertising providers.
Technical implementation
- Prevent tracking technologies requiring consent from activating prematurely.
- Ensure that consent preferences are respected across relevant pages and tags.
- Provide an accessible method to change or withdraw consent where applicable.
- Maintain appropriate consent and configuration records.
- Test the website after significant technical changes.
Governance and maintenance
- Assign responsibility for website privacy compliance.
- Review tracking technologies periodically.
- Establish a process for approving new marketing scripts.
- Train marketing, IT, and website management teams.
- Update documentation when providers, purposes, or data flows change.
Completing this checklist does not guarantee compliance. It provides a structured way to identify gaps and determine which legal and technical measures may be necessary.
Conclusion
Website analytics, cookies, and advertising pixels are valuable business tools, but their use can raise important data protection questions under Thailand’s PDPA.
Businesses should look beyond the presence of a cookie banner and examine how their tracking technologies operate in practice. This includes identifying the information collected, establishing appropriate lawful bases, managing consent where required, reviewing third-party relationships, and assessing international data transfers.
A structured approach helps businesses maintain useful analytics and marketing capabilities while reducing unnecessary legal and operational risks.
For organisations operating in Thailand, a periodic review of website tracking is an important part of broader digital compliance. As websites evolve and new tools are introduced, privacy documentation, technical settings, and contractual arrangements should evolve with them.
Legal disclaimer: This article provides general information about Thai data protection law as of October 2026. It does not constitute legal advice. The appropriate compliance measures depend on the facts, processing activities, applicable laws, and current regulatory requirements of each business.