On May 11, 2026, Thailand’s Ministry of Social Development and Human Security released a draft Child Protection Act (“CPA”) for public review. The draft CPA would completely repeal and replace the current Child Protection Act B.E. 2546 (2003). This represents the most comprehensive overhaul of Thailand’s child protection framework in over two decades, reflecting the government’s stated objective of modernizing the law to address evolving social challenges—including those arising from digital technology—and to promote greater coordination among government agencies, local authorities, and civil society. The public review period closes on June 9, 2026.

Key changes introduced by the draft CPA that could have significant implications for businesses, particularly online platform providers, media companies, and entities operating child-related services in Thailand, are set out below.

Expanded Definition of “Child”

Under the current CPA, a “child” is defined as a person under the age of 18, excluding those who have attained legal majority through marriage. The draft CPA removes the marriage exception entirely, broadening the scope of the law’s protections to include all individuals under 18 without exception.

Replacement of “Abuse” with Broader Concept of “Violence”

The current CPA uses the term “abuse/cruelty,” which covers acts causing harm to a child’s liberty, body, or mind; sexual offenses against children; and using children in harmful or immoral activities. The draft CPA replaces this with the broader concept of “violence,” which encompasses any act or omission causing harm to a child’s body, mind, or development; abandonment or neglect; improper exploitation; and sexual abuse. Notably, the new definition adds developmental harm as a recognized category of injury and captures all forms of misconduct regardless of the child’s consent.

New Standalone Definition of Sexual Abuse, Including Online Conduct

One of the most significant additions in the draft CPA is the introduction of a standalone definition of “sexual abuse” or “sexual harassment.” This definition covers:

• Sexual offenses under the Penal Code and the Anti-Prostitution Act;
• Physical touching, gestures, speech, or any other act intended to involve a child in sexual activity; and
• Acts committed whether in the child’s physical presence or through electronic media or any other medium.

The explicit reference to electronic media is a clear signal that the draft CPA is designed to reach online grooming, solicitation, and exploitation of children conducted through digital platforms, messaging applications, social media, and other online services.

New Offenses with Particular Relevance to Media and Online Platforms

The draft CPA introduces several provisions that are particularly relevant to media companies and online platform providers.

• Simulated Violence Involving Children. Any person who creates, advertises, or disseminates—through mass media or information communication technology of any type—simulations of events in which children are subjected to violence, where a child participates in the simulation, commits an offense punishable by imprisonment of up to six months, a fine of up to THB 60,000, or both. An exception applies where the simulation is conducted to gather evidence in legal proceedings.
• Harmful Disclosure of Children’s Data. Any person who advertises or disseminates—through mass media or information communication technology of any type—data concerning a child or guardian that causes damage to the child’s reputation, dignity, or interests, or for the purpose of seeking improper benefit, commits an offense punishable by imprisonment of up to six months, a fine of up to THB 60,000, or both. Unlike the current CPA, which required an element of “intent to cause harm,” the draft CPA broadens the scope by covering dissemination that results in harm or is done for improper personal benefit, potentially lowering the threshold for liability.

Introduction of Corporate Criminal Liability

The draft CPA introduces a new provision on corporate criminal liability that does not exist under the current CPA. Where a juristic person (e.g., a company) commits an offense and such offense results from the order or act of a director, manager, or any person responsible for the juristic person’s operations, or from such person’s failure to act when they had a duty to do so, that individual is personally liable for the criminal penalty prescribed for the offense.

Key Takeaways and Next Steps for Businesses

Businesses in Thailand—particularly online platform providers, social media companies, content-sharing services, media organizations, and entities providing child-related services—should note the following key implications of the draft CPA: (1) online sexual abuse via electronic media is now expressly defined; (2) content liability is broadened for platforms hosting harmful content involving children; (3) corporate officers face personal criminal liability for organizational offenses; and (4) entities handling children’s data must comply with the Personal Data Protection Act and the draft CPA’s confidentiality requirements, with criminal penalties for non-compliance.

Businesses affected by these changes are encouraged to begin reviewing their policies, content moderation practices, and compliance frameworks in anticipation of the new requirements. They are also encouraged to submit comments during the public review period, which closes on June 9, 2026.t