Online safety & content laws in Thailand (2026)

The Electronic Transactions Commission notification published in the Royal Gazette on 4 July 2025 mandates social media platforms to remove content flagged by the MDES as false, misleading, or facilitating a technology crime within 24 hours of official notice — including weekends and holidays. Platforms that fail to comply lose safe-harbour protections and face criminal liability for offences such as fraud and lèse-majesté.

Published in the Government Gazette on 12 April 2025 and effective the next day, the amendment to the 2023 Emergency Decree narrows the categories of business operators subject to its obligations, reduces some compliance burdens, and formalises coordination mechanisms among banks, telecom providers, and law enforcement to combat online scams.

Thailand's Personal Data Protection Committee imposed the maximum 7 million Baht administrative fine on an undisclosed major e-commerce platform for failing to appoint a Data Protection Officer, maintaining inadequate security measures that caused data leaks to call-centre scammers, and failing to report breaches — the first enforcement action since the PDPA's full entry into force in 2022.

The Royal Decree on Digital Platform Service Businesses B.E. 2565 (published in the Government Gazette on 23 December 2022) took effect, requiring all platforms serving Thai users — including overseas providers — to notify the Electronic Transactions Development Agency before commencing operations and to file annual compliance reports; non-compliance carries fines up to THB 100,000 and up to one year imprisonment.

Published in the Government Gazette on 16 March 2023, this emergency decree — prompted by an explosion in call-centre fraud and online financial scams — imposed legally binding obligations on banks, telecom operators, and social media platforms to cooperate with authorities in rapidly freezing suspect accounts, cancelling SIM cards, and removing fraudulent content, creating Thailand's first integrated cross-sector cybercrime response framework.

Following two postponements since the 2019 enactment, the Personal Data Protection Act fully entered into force on 1 June 2022, after the Personal Data Protection Committee was formally constituted on 11 January 2022 and subordinate regulations were issued; all data controllers and processors became immediately subject to consent, purpose-limitation, data-subject-rights, and breach-notification obligations.

At the height of Thailand's 2020 pro-democracy protests, authorities ordered the blocking of Change.org after it hosted a petition to have the king declared persona non grata, and courts ordered Facebook to restrict 1,765 posts — nearly all alleging Section 112 (lèse-majesté) violations — representing the largest single wave of politically motivated online content suppression under the Computer Crime Act framework.

Thailand's first dedicated Cybersecurity Act established the National Cyber Security Committee (chaired by the Prime Minister) and the National Cybersecurity Agency (NCSA), designated Critical Information Infrastructure sectors requiring mandatory security standards, and granted authorities sweeping investigative powers — including access to private systems — during declared cyber threats.

Adopted unanimously by the junta-appointed National Legislative Assembly in December 2016 and published in the Royal Gazette on 24 January 2017 (in force 24 May 2017), the amendment criminalised dissemination of 'false or distorted' information damaging national security or public order, empowered MDES to order content removal, introduced some court-supervised takedown procedures, and imposed tougher penalties — significantly expanding the state's online censorship authority.

The National Legislative Assembly approved legislation on 3 June 2016 dissolving the Ministry of Information and Communication Technology and replacing it with the MDES in September 2016, consolidating the ETDA, oversight of telecom and broadcasting entities, and internet content enforcement under one ministry as the centrepiece of the 'Thailand 4.0' digital economy strategy.

King Bhumibol Adulyadej granted royal assent to the Computer Crime Act on 10 June 2007 (in force 18 July 2007), establishing criminal offences for unauthorised computer access, data interference, and the distribution of 'inappropriate' or harmful online content; the Act became the primary legal instrument for internet censorship — including lèse-majesté enforcement online — and remains the backbone of Thailand's online content regulation after amendment in 2017.