You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

February 15, 2022

E-commerce Platforms Team Up with Brand Owners and Government to Fight Online Counterfeiting in Thailand

World Trademark Review

The sale of counterfeit goods online is as damaging to government efforts and consumer safety as it is to the reputation of the e-commerce platforms and brand owners involved. In this guest piece, Andy Chua, senior vice president of the IP Rights Protection Team at e-commerce giant Lazada, joins Tilleke & Gibbins’ Suebsiri Taweepon and Ploynapa Julagasigorn to discuss how stakeholders can work together to combat the growing threat of counterfeits online – with recent efforts in Thailand a prime example of effective action. This article, which was first published in World Trademark Review, is the second in a two-part series about trademark enforcement against online counterfeits.

 

Technological developments, government policy and the covid-19 pandemic have brought about significant changes to the lifestyle and behaviour of ordinary consumers. Shopping increasingly takes place on e-commerce platforms as people become more familiar with online transactions, encouraging many sellers to turn their focus to online platforms. While this shift to online retail has brought benefits for many, it has also provided additional ways for sellers of counterfeit goods to peddle their wares.

The sale of counterfeit goods online tarnishes the reputation of e-commerce platforms among users, compromises consumer trust in brand owners’ products and undermines public authorities’ efforts in enforcing anti-counterfeiting policies. This dynamic problem cannot be resolved by a single entity alone. Instead, all stakeholders need to work together to amplify their efforts in consumer and brand protection.

Collaborating against counterfeits in Thailand

We see such collaborations between stakeholders in regions such as Thailand, where the Department of Intellectual Property (DIP) has signed a memorandum of understanding (MOU) with various parties that are committed to combatting the spread of counterfeit products online. The inaugural signing ceremony for the MOU was held on 11 January 2021, with 20 initial signatories drawn from the public sector (eg, the DIP, the Department of Business Development and the Department of International Trade Promotion), rights holders, e-commerce platforms (including Lazada) and law firms (including Tilleke & Gibbins).

Since the ceremony, signatories have been actively participating in activities to ensure the effectiveness of the MOU. The first meeting of members was held on 11 March 2021, where members had the opportunity to:

  • share information on infringement activities;
  • collaborate in monitoring and reporting counterfeit products across online platforms;
  • encourage and work towards the adoption of a standard cross-platform reporting system; and
  • discuss obstacles and solutions in pursuing counterfeiters.

By the time of the follow-up meeting on 19 July 2021, a further 10 stakeholders had signed the MOU. At this meeting, members discussed the information that should be required from sellers to register on platforms and the terms that should apply between platforms and sellers. They also discussed strategies for raising public awareness of IP infringement and shared crucial information on successful anticounterfeiting cases.

In October 2021, a focus group of IP owners, law firms and online platforms met to discuss the reporting systems of different platforms, building on the challenges to effective enforcement identified at the previous meetings. Members discussed the IP infringement reporting systems that they use, listing all the documents that are required by each platform and identifying the need to set standard practices for all online marketplaces in Thailand.

The DIP has been entrusted to coordinate with stakeholders to develop guidelines on standard reporting systems. The guidelines will allow users to easily understand and comply with the requirements of any platform, making it much easier for users to work with platforms to protect their IP rights online.

Panasonic case yields positive results through cooperation

Close collaboration between e-commerce platforms, brand owners, law firms and government authorities led to several successful anticounterfeiting activities over the course of 2021.

A prime example of this was the successful raid of more than 80,000 counterfeit Panasonic batteries on 18 May 2021. The case began when Panasonic, which had been monitoring online marketplaces, found suspected counterfeit products being sold on the Lazada platform by several shops sharing the same address.

An investigation was opened, and Lazada worked closely with Panasonic to help identify the infringers. Tilleke & Gibbins then assisted Panasonic in locating and identifying the stockroom containing the counterfeit goods and in coordinating with government officers.

This collaboration led to a raid action by the Thai Police Economic Crime Suppression Division and the seizure of more than 80,000 counterfeit Panasonic batteries – the largest-ever seizure of Panasonic products in the Asia-Pacific region. The cooperation between Lazada, Panasonic, Tilleke & Gibbins and the Thai enforcement authorities resulted in the successful removal of these counterfeit products from the market to the benefit of platforms, brand owners and consumers alike.

Looking ahead

While much has been achieved, there are still several significant challenges to combatting IP infringement online. The sale of counterfeit goods on social media, for example, remains a major issue, highlighting the need for social media companies to become signatories of the DIP’s MOU.

Another problem is the way in which infringers obscure their identities by registering fake information with the platforms on which they operate. Rather than taking down individual webpages, brand owners must be able to identify stockrooms in order to uproot counterfeiters completely.

E-commerce platforms, IP owners, law firms and government authorities are continuing to work together to identify and develop solutions to these issues. In spite of the challenges, close and active collaboration between these stakeholders will pave the way to making the Internet uninhabitable for counterfeiters.

RELATED INSIGHTS​ 

August 6, 2025
Thailand’s Digital Government Development Agency (DGA) has released drafts of two pivotal documents to guide Thai government agencies in adopting cloud technology and classifying data for cloud usage. These draft guidelines, open for public hearing through August 12, 2025, are part of the national “Go Cloud First” policy, which aims to accelerate digital transformation, improve efficiency, and ensure robust data security across the public sector. The new standards will have significant implications for both government agencies and cloud service providers operating in Thailand. Highlights of the draft guidelines are presented below. Government Cloud Usage Guidelines Cloud-first transformation: All government agencies are directed to prioritize cloud solutions for new IT projects, in line with the cabinet’s “Go Cloud First” policy. Cloud model selection: Agencies must assess their needs and select the most appropriate cloud deployment model—public, private, hybrid, or community cloud—based on the sensitivity of the data and operational requirements. Service types: The guidelines provide criteria for choosing between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), emphasizing the importance of using standard, non-customized services where possible. Cost management: Agencies are required to plan and separate cloud-related expenses, ensuring transparency and efficient budget allocation. Cloud migration: The guidelines outline the steps for migrating to the cloud and highlight the role of cloud service providers in facilitating the process, including supporting innovation and enabling smooth exit strategies. Procurement compliance: All cloud procurement must comply with public sector procurement laws and regulations. Only providers meeting government-mandated standards can be selected. Security and shared responsibility: The guidelines clarify the division of security responsibilities between cloud providers and government agencies. While providers manage infrastructure security, agencies remain responsible for data, application, and access controls. Legal framework: Agencies must comply with the Digital Government Administration Act, Cybersecurity
August 1, 2025
Thailand’s Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) in five cases of noncompliance by public and private entities. The enforcement actions reflect a growing commitment by the PDPC to penalize noncompliance across all sectors, regardless of organizational type or size. The total amount imposed to date was approximately THB 21.5 million (approx. USD 654,690), underscoring the financial risks tied to PDPA violations. The five cases—one involving a state agency and the remainder in the private sector—are summarized below. Case 1: State Agency Providing Online Services to the Public The order in this case stemmed from a cyberattack on a state agency’s web app, resulting in personal data of 200,000 data subjects being leaked to and sold on the dark web. The software developer was also found to have implemented no privacy by design, lacked an access control system, had no data breach prevention measures, and failed to conduct risk assessments or review existing security measures. Key noncompliance identified: Lack of appropriate security measures Weak password protection No risk assessment or ongoing review of security measures No data processing agreement with software developer that acted as data processor The state agency and the developer were each fined THB 153,120 (approx. USD 4,670). Case 2: Private Hospital This case involved a hospital that engaged an individual contractor to destroy patient medical record documents. However, the contractor stored the documents at their own premises, failed to follow the required destruction protocols, and ultimately used the medical records to wrap sweets, resulting in the leak of over 1,000 records during the destruction process. The contractor also failed to notify the hospital of the data breach. Although there was a
August 1, 2025
On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities. Below are some key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with
August 1, 2025
On July 21, 2025, Thailand’s National Cyber Security Agency (NCSA) released a draft amendment to the Cybersecurity Act B.E. 2562 (2019) for public hearing, aiming to address the rapid evolution of technology and increasing complexity of cyber threats. The proposed changes to the country’s cybersecurity framework would extend regulatory oversight to cloud service providers and data center operators hosting data for critical information infrastructure (CII) organizations regulated under the Cybersecurity Act. The NCSA will accept comments on the draft until August 5, 2025. Following the close of the public consultation period, the draft amendment will be subject to further revision during the legislative process. Key proposed amendments are discussed below. Expanded Critical Infrastructure Scope The Cybersecurity Act currently applies only to state agencies, supervising or regulating organizations, and designated CII organizations as announced by the National Cyber Security Committee (NCSC). It defines CII organizations as public or private organizations related to or providing national security, significant public services, banking and finance, information technologies, telecommunications, transportation and logistics, energy and public utilities, or public health. The draft amendment expands the scope of CII organizations to include public and private organizations related to or providing industrial work (to be further defined in subregulations) as well as service providers that store or possess data for CII organizations, such as cloud and data center service providers. CII organizations must comply with cyber threat reporting requirements and are subject to the NCSA’s interception powers. Updated Definitions and New Terminology The draft amendment more clearly distinguishes between “cyber threats” (which have yet to occur but have the potential of causing damage or impact) and “cyber incidents” (which have already occurred and have caused or are expected to cause damage or impact). The draft amendment also expands the definition of “cybersecurity” to explicitly cover both prevention