Website Cookie Consent and Thailand PDPA Compliance Guide 2026

Website cookie management and user data protection are core compliance requirements under Thailand's Personal Data Protection Act (PDPA). Simply displaying a banner is not enough—the technical backend must actually prevent tracking until users consent. This guide covers what cookies require consent, PDPA's specific requirements, how to implement proper controls, and how to verify your site is genuinely compliant.

What Are Cookies and Why Consent Matters

Cookies are small data files stored on a visitor's device to maintain state and track activity. While some cookies are essential for basic functionality, many collect behavioral data for analytics and advertising. Under Thailand's PDPA, websites must obtain explicit, prior consent from users before storing or accessing non-essential cookies. Consent must be active and documented, not implied or assumed from page use.

• Cookies are small data files stored on user devices; some are essential for functionality while others track behavior
• Essential cookies (authentication, security) work without explicit consent under most regulations
• Non-essential cookies (analytics, retargeting, profiling) require prior, documented user agreement
• Implied consent—silence, page scrolling—does not satisfy PDPA or similar data protection laws S1_CODE:

Cookie Categories and Consent Requirements

Cookies fall into distinct categories, each with different consent rules. Necessary cookies support basic functionality and can operate without prior consent. Analytics cookies require informed opt-in before the tracking script loads. Marketing and third-party cookies demand explicit prior written consent and detailed disclosure of purpose, data retention, and third-party vendors.

• Necessary—Session IDs, CSRF tokens, security; no consent needed for website functionality
• Analytics—Tracking page views, user engagement; explicit opt-in required before firing
• Marketing—Retargeting pixels, social media tracking; prior, informed consent mandatory with vendor disclosure
• Third-party—Ad networks, external tracking; require additional consent and clear disclosure of data sharing S2_CODE:

Understanding Thailand's PDPA and Cookie Regulations

Thailand's Personal Data Protection Act (PDPA), enforced since 2019, establishes strict requirements for website operators handling personal data. The law treats cookies as personal data collection if they identify individuals—even browser IDs count. Website owners must disclose the purpose of data collection and obtain explicit consent before capturing identifiable or behavioral data via cookies. The law also grants users rights to access, correct, and delete their personal information.

• Website operators must disclose specific purposes and lawful basis for collecting cookies and personal data before collection begins
• Consent must be affirmative, explicit, and not inferred from silence, scrolling, or continued page use
• Cookie data and browser identifiers qualify as personal data under PDPA, triggering disclosure and consent requirements
• Users have the statutory right to request access, deletion, and correction of personal information collected via cookies S3_CODE:

Implementing a Cookie Consent Banner Properly

An effective cookie consent banner discloses which cookies are used, their purpose, and retention period. Users must be able to accept or reject each cookie category independently—not just click "Accept All." The banner must appear and block script execution before any tracking code loads. Many non-compliant sites load tracking first, then show a banner—this defeats PDPA's purpose.

• Display the banner before any tracking pixels, analytics tags, or marketing scripts load
• Allow granular opt-in/out per cookie category, not just a single "Accept All" button
• Describe clearly in plain language the purpose, data collected, and retention period for each cookie type
• Provide an easy "Withdraw Consent" or "Manage Preferences" link on every page S4_CODE:

Technical Implementation and Script Loading Control

Proper technical implementation requires conditional script loading: do not execute tracking code until the user explicitly consents. Store the consent state in localStorage or a first-party cookie, then conditionally execute analytics scripts based on that state. Many sites fail here by loading tracking code immediately and only hiding the banner after the fact—this violates PDPA because users had no choice before data collection began.

• Store consent state in localStorage upon banner submission
• Check localStorage before executing any tracking function to gate script execution
• Load Google Tag Manager or other third-party tags only after consent state permits
• Log consent events server-side with timestamp and user identifier for audit and regulatory proof S5_CODE:

PDPA Compliance Checklist for Website Owners

Website operators should conduct a complete compliance self-audit. Publish a detailed privacy policy that lists all cookies, third-party vendors, data purposes, retention periods, and user rights. Verify that the consent banner loads and prevents script execution before any tracking fires. Confirm users can withdraw consent anytime. Maintain server-side logs of when consent was given.

• Publish a comprehensive privacy policy listing all cookies, purposes, vendors, and data retention schedules
• Test the banner to confirm tracking scripts do not fire until consent is recorded
• Verify users can withdraw consent easily from any page
• Maintain database logs showing timestamp, consent state, and accepted/rejected cookie categories S6_CODE:

Testing and Verifying True Compliance

A compliance banner without technical enforcement is not genuine compliance. Test your site's actual behavior: open DevTools (F12), switch to the Network tab, reload the page, and immediately reject all cookies. Look for requests to google-analytics.com, facebook.com/tr, or similar tracking domains. If these requests appear after rejection, your site is violating PDPA.

• Open DevTools (F12) > Network tab, reload the page, and immediately reject all cookies
• Scan for HTTP requests to google-analytics.com, facebook.com/tr, or similar—these must not fire before consent
• Check the Application/Storage tab to see what cookies and localStorage values are set
• Test after each code deployment to ensure no tracking scripts were accidentally re-enabled S7_CODE:

Common Compliance Mistakes and How to Avoid Them

Common mistakes include loading tracking scripts before displaying the consent banner, or assuming page scrolling implies consent (it doesn't under PDPA). Others hide the "Reject All" button or make it less prominent than "Accept All." These failures invite complaints and investigation by the Personal Data Protection Committee, and damage user trust.

• Mistake: loading tracking scripts before displaying the banner → fix by adding a pre-consent script block
• Mistake: assuming page navigation implies consent → only count explicit button clicks
• Mistake: not disclosing third-party vendors → list them in privacy policy
• Mistake: burying "Reject All" → make both buttons equally visible S8_CODE: