Thailand has introduced new requirements for online social media platforms to verify the identity of paying advertisers before publishing their advertisements. On May 5, 2026, the Electronic Transactions Commission published the Notification on Measures for Prevention of Technology Crime for Online Social Media (No. 2) in the Government Gazette. The notification, which aims to prevent technology crimes such as fraud and scams, takes effect 180 days after publication (i.e., on November 1, 2026).

Mandatory Advertiser Identity Verification

Online social media service providers must verify the identity of every advertiser before publishing an advertisement. Verification remains valid for up to one year from the most recent verification date.

The notification requires social media providers to use either of the following methods when verifying advertisers:

• Document-based verification: Examine government-issued identity documents (e.g., national ID, passport, or juristic person registration certificate), cross-check the connection between the advertiser and the identity documents (e.g., facial comparison with photo ID), and ensure that the identity documents are verifiable against reliable sources.
• Digital identity verification: Use an identity verification system with a level of assurance no lower than that prescribed by the Electronic Transactions Commission.

Advertiser Data Collection and Retention

Service providers must collect and retain certain data—including name, identification number, and contact details—from the start of the advertising service and for a minimum of 90 days after the end of the advertising service relationship. The same requirements apply where there is a third-party payer, such as an ad agency.

Implications for Affected Businesses

The notification raises two key areas of concern for affected businesses:

• Social media platforms must implement know-your-advertiser (KYA) onboarding as described above, including document upload and identity matching processes. The 180-day implementation window requires immediate technical and operational planning.
• The collection and retention of national ID cards, passport copies, and other personal data triggers data protection obligations under Thailand’s Personal Data Protection Act, including requirements for lawful basis, purpose limitation, data security, and data subject rights. Platforms storing verification data outside Thailand must ensure adequate safeguards for international transfers of sensitive personal data.

Online platforms should assess whether they fall within the scope of “online social media service provider” and identify which categories of their advertisers are subject to the identity verification requirements. Affected platforms should evaluate their current advertiser verification capabilities, identify compliance gaps, and begin designing technical solutions and operational processes to meet the November 2026 effective date.