In brief
Thailand's digital regulator – the ETDA – opened another round of public consultation on a new draft law intended to combat online scams and establish conditions for safe harbor protection for online social media providers. This new draft law will impose KYC related obligations on such providers.
As the definition of online social media is quite broad and may extend beyond traditional social media, we encourage businesses to carefully assess whether they fall within its scope. Providers of services with user-communication features may also be affected by this draft law. It is important for business operators – especially those in the advertising industry – to revisit their existing onboarding and KYC processes for advertisers and users in light of this incoming draft law.
In more detail
On 16 January 2026, the Electronic Transactions Development Agency (ETDA) opened the second round of public consultation on the (Draft) Electronic Transactions Committee (ETC) re: Measures to Prevent Technological Crimes (No. ...) ("Draft ETC Notification"), which will be issued by virtue of the Emergency Decree re: Prevention and Suppression of Technological Crimes B.E. 2566 (2023) (as amended in 2025) ("Emergency Decree") – colloquially known as the anti-mule account law.
The primary rationale behind the introduction of the Draft ETC Notification is the proliferation of fraudulent and deepfake content being used as a means to deceive the public, causing significant economic and societal harm against Thai people.
If issued in its current form, the Draft ETC Notification will apply to online social media service providers ("Social Media Providers"). The ETDA revealed, during its focus group hearing session on 28 January 2026, that the Draft ETC Notification will adopt the same definition of online social media as that under the Computer Crime Act B.E. 2550 (2007), as amended. As this definition is quite broad and may extend beyond traditional social media services, we encourage service providers to carefully assess whether they fall within its scope.
For the background on how the Emergency Decree plays out with the Draft ETC Notification, the ETC can set out in detail the standards and measures for preventing technological crimes – a duty of care-like provisions for business operators under their supervision, including Social Media Providers (Section 4/1 of the Emergency Decree). The regulated service providers who duly implement those standards and measures can shield themselves from the joint liability to victims of technological crimes (Section 8/10 of the Emergency Decree).
Core obligations to be met to qualify for safe harbor protection
This Draft ETC Notification introduces the following notable requirements to be imposed on Social Media Providers to qualify for safe harbor protection under the Emergency Decree.
| Topics | Details |
| 1. User Identification Requirement |
Social Media Providers must identify every user's account. |
| 2. User Verification Requirement |
Two tiers of requirement
|
| 3. User Data Retention Requirement |
Mandatory information retention by Social Media Providers to enable verification of advertiser identities. For example, for corporate advertisers, Social Media Providers must retain the corporate advertiser's name, the corporate advertiser's representative's name, the certificate of incorporation, and contact details. If the advertisement fee is paid by a person other than the advertiser, Social Media Providers must also retain that person's information. |
This version of the Draft ETC Notification sees the ETDA incorporating feedback received from the first consultation round of public consultation, including the removal of the previously proposed obligations to: (i) filter search terms or content groups related to information that may lead to technology-related crimes; (ii) suspend the dissemination of such information as soon as possible; and (iii) filter advertisements that contain relevant search terms or content groups. However, these obligations may return in a later phase, as identity verification has been prioritized as the first step.
Grace period before coming into full legal force
If issued in its current form, the Draft ETC Notification will come into force 180 days from the date it is published in the Government Gazette. According to the ETDA, it is anticipated that the Draft ETC Notification will be published as a binding law by Q2 of 2026. However, the ETDA may hold additional rounds of public consultation if it is deemed necessary.
Key takeaways for business operators
In light of this regulatory development, it is crucial for business operators who provide products embedding a social media feature to stay vigilant and continue to closely monitor the evolving Draft ETC Notification. We encourage service providers to carefully assess whether they fall within its scope of online social media. Social media providers (that are not only social media in the conventional sense) may also be required to comply with these KYC obligations. It is advisable for service providers to review and adjust their onboarding processes and advertiser handling practices to ensure compliance with the new requirements.
We will be closely monitoring developments in this matter and will keep you updated. Meanwhile, if you have any questions or require further information, please let us know.
* * * * *
Aue-angkul Santirongyuth and Pimpisa Ardborirak, Associates, have contributed to this legal update.