You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

November 25, 2024

Thailand Seeks Comments on Principles of Draft Platform Economy Act

Subscribe to Updates

Thailand has released the set of principles that will form the official draft Platform Economy Act (PEA) for a public hearing period that runs until December 15, 2024. The PEA is likely to be positioned as a general or overarching law for digital intermediary services and digital platform service businesses.

In January 2024, an early, unofficial version of the proposed law had been circulated among a limited group of operators in certain industries to get comments for the working group charged with the PEA’s development. Now, however, the proposed principles that will underpin the official draft PEA have been released publicly to gather comments, feedback, and suggestions from any interested stakeholders.

The principles of the draft PEA cover two main areas: user protection and fair competition. The key details in these two areas are outlined below.

User Protection

The main regulator supervising the law’s user protection elements will be the Electronic Transactions Development Agency (ETDA).

The draft PEA is expected to impose user protection obligations on service providers based on their nature, size, and risk level. The principles set out a three-tiered classification system for service providers that will be covered under the draft PEA, as detailed below, ordered from fewest obligations to most:

  • Intermediary Service Provider: This describes a service provider acting as an intermediary between a sender and recipient of information on a computer network, the internet, or a telecommunications network.

    Service providers likely to fall under this category include cloud service providers and web hosting providers.

    Intermediary service providers may be further categorized into the following subtypes:

    • Mere conduit service providers;
    • Caching service providers;
    • Hosting service providers; and
    • Other service providers as prescribed in ministerial regulations.

  • Online Platform: This refers to an intermediary service provider offering data storage services that connect various types of users to enable transactions or interactions between them, whether or not fees are charged. These providers may also offer additional services to facilitate the transactions or interactions.

    Service providers likely to fall under this category include social media platforms, online marketplace platforms, ride-hailing platforms, and search engines.

  • Very Large Online Platform: Online platforms that have a significant impact on the country’s economy and society are categorized as “very large online platforms.” To qualify as a very large online platform, a platform must:

    • Have annual revenue from digital platform services in Thailand exceeding THB 1 billion;
    • Have an average monthly domestic user count exceeding six million; and
    • Pose significant risks to the economy, social security, or public well-being, as determined by the Digital Platform Economy Committee based on ETDA recommendations.

    The ETDA must officially announce the list of the platforms meeting all three criteria before imposing additional obligations.

All types of service providers identified above must appoint a point of contact (POC) responsible for coordination with the ETDA, and notify the ETDA of the POC’s contact information. This requirement applies to both onshore and offshore service providers—a difference from the similar requirement under the Royal Decree on the Operation of Digital Platform Service Businesses that are Subject to Prior Notification B.E. 2565 (2022) (the “DPS Royal Decree”), which limits this obligation to offshore providers only.

The draft PEA principles also introduce a safe harbor mechanism, which exempts intermediary service providers from liability for offenses related to transmitted or stored data if they can prove “no involvement” in the offense. There are three specific safe harbor rules that apply to each type of intermediary service provider. Online platforms, as defined above, qualify as “hosting service providers” and must meet the burden of proof for hosting service providers under the safe harbor rule.

Additional Obligations for Platforms

Online platforms must also fulfill the following obligations:

  • Publication of terms and conditions (T&Cs). Under the Draft PEA, all online platforms are generally required to disclose their T&Cs, unlike under the DPS Royal Decree, which limits this obligation to certain marketplace platforms and search engines.
  • Collaboration with trusted flaggers. Online platforms must work with trusted flaggers—certified individuals who report illegal activities—by providing a dedicated channel for them to open accounts and submit reports.
  • Notice and action mechanism. Online platforms must provide a channel for complaints and reports of illegal activities on the platform.

In addition to these obligations, very large online platforms also have the following obligations:

  • Reporting of required information to the ETDA. The draft PEA requires only very large online platforms to report certain information to the ETDA. This differs from the DPS Royal Decree, under which the obligation to notify the ETDA applies to all in-scope digital platform services.
  • Preparation of an annual transparency report. Under the draft PEA, very large online platforms must prepare an annual transparency report on their digital platform services and keep it publicly accessible at all times.
  • Appointment of an independent external auditor. Very large online platforms must appoint an independent external auditor to conduct audits covering (1) IT systems and (2) compliance with legal requirements.

Extraterritoriality

The principles of the draft PEA address the proposed extraterritorial scope of the law, with the draft PEA applying to platforms meeting criteria similar to those in the DPS Royal Decree—such as offering payments in Thai baht or displaying all or part of their content in Thai. Very large online platforms located outside Thailand that meet any of the criteria will be deemed to serve users in Thailand and will have to report the prescribed information to the ETDA.

Fair Competition

In the area of fair competition, the draft PEA aims to regulate “gatekeepers” (typically market actors that have significant control or influence over access to goods, services, or markets) by outlining both the criteria for being designated as a gatekeeper and the obligations that apply to parties that have been so designated. The main regulator supervising the fair competition elements of the law is the Trade Competition Commission of Thailand (TCCT).

Designation of Gatekeepers

In deciding whether to designate a platform as a gatekeeper, the Platform Economy Committee will:

  1. Determine if the platform qualifies as a core platform service (CPS). Ten types of services are classified as CPSs, including online search engines, online social networking services, and virtual assistants.
  2. Consider whether the CPS meets all relevant gatekeeper criteria. Currently, this includes three proposed qualitative criteria—(1) having a significant impact on Thailand’s economy or society, (2) being an important gateway for business users to reach end users, and (3) having an entrenched and durable position—as well as additional quantitative criteria.

CPS providers must conduct a self-assessment if they meet the qualitative and quantitative gatekeeper criteria and must report the prescribed information to the Digital Platform Economy Committee, which will review the submitted information and announce the list of designated gatekeepers.

Gatekeeper Obligations

After being included in the list announced by the Digital Platform Economy Committee, designated gatekeepers will be subject to additional obligations under the draft PEA. The details of these obligations are still uncertain but pertain largely to two main issues:

  • Required and prohibited actions. Two sets of rules under this ex-ante approach (imposing rules that focus on preventing potential issues or risks before they occur) concern:
    • Most favored nation (MFN) clauses. Designated gatekeepers must not set prices or conditions or take actions that discriminate against or restrict users offering similar products or services to those the designated gatekeepers provide on their platforms.
    • Anti-steering provisions. Designated gatekeepers must allow users to freely communicate with or promote their products or services to consumers without additional charges, whether through the platform or through other channels provided by the service provider.
  • Modification of T&Cs. Designated gatekeepers must allow at least 15 days for user feedback before modifying T&Cs. A summary of the feedback and any amendments must be submitted to the TCCT. This obligation applies only to designated gatekeepers, which is different from the similar obligation under the DPS Royal Decree.

Status

Comments on the principles of the draft PEA will be accepted until December 15, 2024. All input gathered from stakeholders will be presented to the Council of State, which will then evaluate the principles’ appropriateness, assess potential impacts, and contribute to the development of the final draft PEA.

For more information on compliance with Thailand’s requirements for digital platform services, please contact Tilleke & Gibbins’ digital platform specialists Athistha (Nop) Chitranukroh at [email protected], Pornpan Wichawut at [email protected], Rada Lamsam at [email protected], or Karnravee Jitvilai at [email protected].

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

December 26, 2025
The Bank of Thailand (BOT) has released the Guidelines for Digital Fraud Management, which took effect on December 17, 2025, incorporating certain amendments to the draft guidelines issued in March 2025. These official guidelines aim for end-to-end digital fraud prevention, with a particular focus on mule accounts, to enhance trust and security in Thailand’s financial system. The guidelines apply to “financial service providers,” including: Financial institutions and special financial institutions under the Financial Institution Business Act; and Operators of Inter-institutional Fund Transfer System e-money services and e-fund transfer services under the Payment Systems Act. Besides commercial banks and e-money operators that offer fund-transfer services, other providers may adopt requirements based on risk proportionality and baseline standards set out in the guidelines (for instance, an e-money operator that does not offer e-fund transfer services could consider implementing a fraud monitoring and detection system according to the risk level of its service). The guidelines establish the following key requirements: Policy and oversight. Directors and senior executives of financial service providers must adopt appropriate “end-to-end” fraud management policies and KPIs to manage digital fraud, covering prevention, monitoring, detection, management, resolution, and support for affected customers. The fraud management policy must be regularly reviewed, and whenever there is a situation or change that significantly affects the efficiency of the fraud management. Any significant update to the policy must first be approved by the board of the financial service provider. The BOT also encourages providers to collaborate in establishing industry standards aligned with applicable laws and regulations to ensure consistency and best practices across the sector. Fraud management processes. Financial service providers must establish a clear framework for managing digital fraud throughout the customer lifecycle—from customer onboarding to service termination—covering at least the following processes: Know your customer (KYC) and customer due diligence (CDD):
Read More
December 15, 2025
Thailand is taking steps to energize its startup scene by drafting the Startup Promotion Law. This draft law aims to remove obstacles, open new funding opportunities, and provide coordinated government support. The goal is to make it easier for Thailand-based startups to grow and compete on a global stage. Why Is This Law Needed? For many years, Thai startups have operated under traditional company law frameworks that were not designed with high-growth businesses or with fundraising opportunities in mind. Restrictions on issuing bonds, offering shares to outside investors, and repurchasing shares for employee incentive programs made it challenging for emerging companies to access capital and accelerate their growth. The draft Startup Promotion Act seeks to remove these obstacles and foster a more competitive, entrepreneur-friendly environment in Thailand. Who’s in Charge? Two main organizations will oversee the startup ecosystem: Startup Promotion Committee: This group, to be appointed by the National Science, Research, and Innovation Policy Council, will set national strategies, policies, and budget; design promotional campaign and incentives; and propose further legislative amendments to promote startups. National Innovation Agency (NIA): Under the draft act, the NIA will be the main contact for startups and will serve as the secretariat office of the Startup Promotion Committee, coordinating data, advising startups, maintaining the public registry, and providing funding and investment (grants, repayable grants, loans, and equity) under committee criteria and, where applicable, cabinet approval. What Startups Are Eligible for Benefits? To be officially recognized and access benefits, a company must: Be a private limited company less than 10 years old at the time of application. Existing companies that already exceed the 10-year threshold may still apply for startup statues within one year of the law’s enactment, as long as they otherwise still qualify for the new regime. Have average annual revenue not
Read More
December 12, 2025
Tilleke & Gibbins has updated the Cambodia, Myanmar, Thailand, and Vietnam chapters in Multilaw’s Global Data Protection Guide, which collects expert advice from Multilaw member firms in 90 jurisdictions around the world (including a Laos chapter, which is also authored by Tilleke & Gibbins). The guide provides answers to key issues concerning the fast-developing data protection and privacy laws around the world, and helps data protection officers and in-house counsel understand how the regulatory regime for data protection can affect their organizations in various jurisdictions. Each section of the guide identifies the main laws that govern data protection in that jurisdiction, and gives a detailed overview of the legal principles in place as well as the enforcement authorities responsible for overseeing compliance. The guide also covers issues related to data subject rights, data protection officers, impact assessments, data breach notification requirements, and cross border data transfers. The use of personal data in marketing is also considered, with specific information on electronic marketing rules, cookies, and marketing to businesses and consumers. Multilaw, of which Tilleke & Gibbins is a longtime member, is a global network of carefully selected independent law firms able to provide expert legal advice in complex environments around the globe. The full guide is available for free on the Multilaw website.
Read More
December 11, 2025
On December 10, 2025, the National Assembly of Vietnam passed a new Cybersecurity Law, which will take effect on July 1, 2026. The new Cybersecurity Law was developed based on the consolidation of the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. While the final approved version of the new Cybersecurity Law has not yet been published, according to official reports, the following notable requirements are confirmed to be included: The new Cybersecurity Law dedicates a specific article to prohibited acts related to cybersecurity, under which it strictly prohibits posting or disseminating information online that propagandizes against the Socialist Republic of Vietnam. The law also prohibits, among other things, (i) the appropriation, trading, seizure, or intentional disclosure of information classified as state secrets, work secrets, business secrets, personal secrets, family secrets, and private life; (ii) intentionally eavesdropping, recording, or filming online conversations without authorization; and (iii) the use of artificial intelligence (AI) or new technologies to conduct prohibited acts. The Ministry of Public Security (MPS) has the authority to require enterprises providing telecommunications, internet, and online services, as well as system administrators, to remove information violating cybersecurity laws from systems under their management. The MPS is also assigned responsibility for ensuring information security in cyberspace and data security, establishing mechanisms for IP address identity management, verifying digital account registration information, and issuing warnings and sharing information on cybersecurity threats. Information systems are classified into five levels (similar to the 2015 Law on Network Information Security) based on the degree of harm to national security and social order if an incident occurs. The MPS is the lead agency assisting the government in state management of cybersecurity. The Ministry of National Defense is responsible for managing military information systems, and the Government Cipher Committee manages cryptographic and cipher
Read More