In brief
On 5 May 2026, the Electronic Transactions Committee (ETC) issued its second subordinate law to combat online scams and establish conditions for safe harbor protection for online social media providers. The regulation will take effect on 1 November 2026.
Social media providers receiving advertising payments must verify the identities of advertisers, whether they are individuals or corporate entities, in Thailand and, potentially, offshore. Moreover, they must retain advertiser and, where applicable, third-party payer information for at least 90 days after the advertising period ends.
Social media providers are encouraged to revisit their onboarding and KYC processes for advertisers. Other businesses should also assess whether they fall within the broad definition of "social media."
In more detail
After placing the draft for public consultation earlier this year, the ETC issued the Notification on Measures to Prevent Technology-Related Crimes for Social Media Service Providers (No. 2) ("ETC Notification") on 5 May 2026. The ETC Notification will take effect on 1 November 2026.
This requirement is part of the Emergency Decree re: Prevention and Suppression of Technological Crimes B.E. 2566 (2023) (as amended in 2025) ("Emergency Decree") – colloquially known as the anti-mule account law.
Neither the ETC Notification nor the Emergency Decree expressly defines the term "social media service provider." However, during the public consultation process, the Electronic Transactions Development Agency (ETDA) indicated that the term should be interpreted consistently with the definition under the Computer Crime Act B.E. 2550 (2007). As a result, services that allow users to interact with each other, create or share content, or otherwise communicate online may fall within the scope of a social media service provider under the ETC Notification and Emergency Decree.
Key requirements include:
1. Advertiser identity verification
Social media service providers receiving advertising payments must verify advertisers' identities before publishing advertisements, unless the advertiser was verified within the previous one year.
The verification process must be conducted in accordance with the prescribed requirements. As this requirement applies to the verification of advertisers' identities, whether they are individuals or corporate entities located in Thailand or, potentially, offshore, the verification process should be tailored to the nature and characteristics of each category of advertiser.
2. Retention of advertiser information
Service providers must collect and retain the prescribed advertiser information for at least 90 days following the end of the advertising period.
Where advertising fees are paid by a third party, information relating to the third party must also be collected and retained.
Failure to comply with the ETC Notification could lead to the loss of safe harbor provisions under the Emergency Decree and could expose them to joint liability for damages arising from technology-related crimes.
Next steps
Social media providers should revisit their advertiser onboarding procedures and data retention practices to comply with the requirements, including choosing the appropriate verification methods.
Other business operators who may have products or services with potential social media features should assess whether they fall within the scope of the online social media services governed by these requirements.
* * * * *
Pimpisa Ardborirak, Phocharaphol Yingamphol, and Pirun Suttiprapha, Associates, have contributed to this legal update.