Thailand PDPA and browser fingerprinting

What the Thai PDPA says about fingerprinting

The Personal Data Protection Act B.E. 2562 (2019) is Thailand's first comprehensive data protection statute. It was enacted in May 2019 but faced repeated implementation delays during the COVID-19 pandemic. Full enforcement began on 1 June 2022. The law is deliberately modelled on the EU General Data Protection Regulation, borrowing its six lawful bases, its sensitive-data categories, and its cross-border transfer architecture, while adding locally specific requirements that in several places are more demanding than their GDPR equivalents.

The statute does not use the word 'fingerprinting'. Its definition of 'personal data' in section 3 captures 'any information relating to a person, which enables the identification of such person, whether directly or indirectly'. A browser fingerprint, the composite hash derived from a device's screen resolution, installed fonts, canvas rendering, GPU characteristics, audio context, time zone and related signals, falls within that definition the moment it is used to recognise the same visitor across sessions. As with GDPR, the hash does not need to resolve to a name or national ID number; the ability to distinguish and track an individual across interactions is sufficient.

Where Thai PDPA departs from the GDPR template most sharply is in the form of consent required before data collection begins. Section 19 of the Thai PDPA sets a higher formal bar than GDPR Article 4(11), and that difference has direct operational consequences for any fingerprinting deployment targeting Thai users.

Section 19 written-form consent: stricter than GDPR

Section 19 of the Thai PDPA is the statute's most operationally demanding provision for digital products. It requires that consent be obtained in writing or by electronic means. The PDPC's guidance clarifies that 'electronic means' in this context means a recorded affirmative action that constitutes an electronic written record, not a passive click-through or an implicit acceptance inferred from continued browsing.

Three consent mechanisms explicitly fail section 19: pre-checked boxes, where the user is opted in by default; bundled 'agree to our terms and privacy policy' flows, where fingerprinting consent is embedded in a broader acceptance; and 'soft opt-in' banners that treat closing the banner or scrolling past it as consent.

A consent mechanism that satisfies section 19 for a fingerprinting deployment typically has four components: a clear statement naming device fingerprinting as a specific processing activity; a named purpose or purposes; an affirmative action by the user, such as tapping or clicking an 'I consent' button that is visually distinct from a close or dismiss control; and a logged timestamp and version identifier stored by the controller. The GDPR 'freely given, specific, informed, unambiguous' standard covers the substance of consent. Section 19 additionally mandates the written form, which is a procedural requirement that GDPR does not impose.

The PDPC's 2024 guidance on online tracking technologies specifically addressed consent collection for tracking identifiers. It confirmed that fingerprinting signals collected before the user has completed the consent interaction are unlawful, regardless of the ultimate consent outcome, and that a fingerprint collected under a bundled-consent mechanism cannot be retroactively cured by a subsequent granular consent request.

Lawful bases: section 19 (consent) plus section 24 (non-consent grounds)

Thai PDPA splits the lawful-basis framework across two sections, an important structural difference from GDPR Article 6. Section 19 governs consent: it sets the formal requirements (written or electronic-written, specific, separate from other terms, freely withdrawable) and operates as the default basis. Section 24 enumerates the non-consent grounds on which a controller may collect personal data without seeking consent. Conflating the two, or citing 'consent under section 24', is a common drafting error that surfaces in privacy notices and DPIAs.

Section 24's non-consent grounds cover historical or statistical research and archiving, the protection of vital interests of the data subject, the performance of a contract requested by the data subject or pre-contractual steps, public-interest tasks or the exercise of official authority, the controller's legitimate interest balanced against the data subject's rights, and compliance with a legal obligation. For a commercial fingerprinting deployment, consent under section 19 is by far the most common basis. Legitimate interest is available for narrowly scoped anti-fraud and security purposes, subject to a documented balancing test.

Section 26 imposes a separate, stricter regime for sensitive personal data. Biometric data is explicitly listed as a sensitive category in section 26. A fingerprint that is derived from or used to generate a biometric identifier, for example a fingerprint combined with facial recognition or used to reconstruct a biometric template, falls under section 26 and requires explicit consent in addition to satisfying the written-form requirement of section 19. Health data, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, and trade union membership are also listed as sensitive categories. Any fingerprinting system that infers or correlates to these categories triggers the section 26 regime.

Cross-border transfers under section 28

Section 28 of the Thai PDPA restricts transfers of personal data to destinations outside Thailand. A transfer is permitted if: (a) the destination country has been granted an adequacy decision by the PDPC; (b) the controller has put in place appropriate safeguards, such as binding corporate rules, standard contractual clauses approved by the PDPC, or a certification scheme accepted by the PDPC; or (c) the data subject has given explicit informed consent to the specific transfer.

As of 2026, the PDPC's adequacy whitelist is still being developed. The most current position recognises countries that already hold EU adequacy decisions, including the EEA member states, the United Kingdom, Japan, South Korea, New Zealand, Canada, and Israel, as offering an acceptable level of protection. Countries that are not on the EU adequacy list, including the United States, Singapore, China, India, and most ASEAN nations, are not on the Thai adequacy whitelist and cannot receive fingerprint data under the adequacy route alone.

For transfers to non-whitelist destinations, a controller must rely on approved safeguards. The PDPC has indicated it will accept standard contractual clauses modelled on those approved under GDPR, but the Thai-specific SCC template has not been published as a finalised instrument as of the date of this review. Controllers routing fingerprint hashes to US-based ad-tech vendors, fingerprinting vendors headquartered in Singapore, or cloud infrastructure in non-adequate countries should treat every such transfer as requiring a documented safeguards mechanism.

PDPC enforcement: the 2024 scale-up

The PDPC spent the first two years after the June 2022 full-enforcement date primarily issuing guidance, conducting audits, and resolving complaints through informal resolution. The enforcement posture shifted materially in 2024.

The PDPC issued formal administrative fines against multiple SMEs and one major bank in 2024. The SME cases involved failures in consent collection mechanisms, including use of pre-checked boxes and bundled consent for data collected via mobile applications, which the PDPC characterised as non-compliant with section 19. The bank case involved cross-border data transfers to a vendor in a non-adequate country without documented safeguards under section 28, as well as a failure to appoint a DPO despite the bank's core activities involving large-scale systematic monitoring of customer behaviour. Administrative fines in these cases reached up to THB 3 million per violation.

In parallel with the administrative fine programme, the PDPC issued sector-specific guidance on online tracking technologies. The guidance confirmed that browser fingerprinting, canvas fingerprinting, and device identifier collection are all subject to the section 19 consent requirement when used for purposes beyond strictly necessary service delivery. The guidance also addressed the cross-border routing of tracking data and stated that routing tracking identifiers to vendors in non-adequate countries without section 28 safeguards is an independent violation, separate from any consent failure.

A third enforcement context emerged through sector regulatory cooperation. The PDPC worked with the Bank of Thailand and the Securities and Exchange Commission of Thailand in 2024 to coordinate enforcement of data protection obligations in the financial-services sector, where device fingerprinting is widely used for fraud detection and transaction monitoring. The coordinated approach signals that fingerprinting-related violations in fintech and banking are a priority for the 2025 to 2027 enforcement cycle.

DPO requirements under Thai PDPA

The Thai PDPA requires appointment of a Data Protection Officer in three circumstances: the controller or processor is a public authority; the core activities of the controller or processor require regular and systematic monitoring of personal data on a large scale; or the core activities involve processing sensitive personal data under section 26 on a large scale.

For fingerprinting deployments, the 'regular and systematic monitoring on a large scale' trigger is the most relevant. A platform that processes fingerprint signals from millions of users to power fraud detection, analytics, or advertising is likely conducting exactly the kind of large-scale systematic monitoring that requires a DPO. The PDPC has not published numerical thresholds for 'large scale' as of the date of this review, but has indicated in guidance that the same contextual assessment used under GDPR is appropriate: factors include the number of data subjects, the volume of data, the geographic extent of the processing, and the duration and frequency of the processing.

Children and parental consent

The Thai PDPA draws two age thresholds for personal data processing. For children under 10 years of age, parental or guardian consent is required for all processing. For persons under 20 years of age who are not legally emancipated, the statute requires parental or guardian consent for certain categories of processing, and the PDPC's guidance extends this to online tracking and device fingerprinting where the controller has reason to believe the user may be a minor.

A fingerprinting deployment that cannot distinguish adult from minor users should apply parental-consent requirements by default to any session that appears to originate from a device pattern associated with younger users, or should implement age-gate flows before any fingerprinting signal is collected.

How Benny the Doorman fits into a Thai PDPA-aware deployment

Benny is a fingerprinting SDK and hosted API, not a consent management platform. That separation is deliberate: consent collection and the section 19 written-form interaction must live in the controller's own CMP or consent flow, and the fingerprint call should only be triggered once the CMP records a compliant written consent for the relevant purpose.

For a Thai PDPA-aware deployment, three integration steps are critical. First, defer the call to Benny's fingerprint API until a section 19-compliant written consent has been recorded. The consent interaction must present fingerprinting as a named, specific purpose and capture an explicit affirmative action, not a passive dismissal or pre-checked box. The consent record, including timestamp and version, should be stored by the controller independently of Benny. Second, for purposes that qualify as legitimate interest, such as narrowly scoped anti-fraud and account-takeover detection, document the balancing test before deployment and keep that data flow architecturally separate from any consent-based purposes. Third, if your Benny deployment involves cross-border transfer of fingerprint hashes to Benny's API infrastructure, note that Benny's processing is performed on infrastructure hosted in Chennai, India.

India is not on the Thai PDPC's adequacy whitelist as of 2026. A Thai controller routing fingerprint data from Thai users to Benny's India-hosted infrastructure must either obtain explicit informed consent from each user for that specific cross-border transfer, or put in place section 28 safeguards such as standard contractual clauses. Benny can provide a data processing agreement and supporting contractual documentation on request to assist controllers in meeting their section 28 obligations. Controllers should obtain independent legal advice on whether the available safeguards satisfy current PDPC requirements before relying on them.