Why This Matters
• Advertisers across all platforms must submit government ID or passport starting November 2026, with verification valid for one year.
• Platforms now share financial liability for fraudulent ads—up to 500,000 THB per case—if they fail to verify advertiser identity.
• All data about who advertised what stays on file for 90 days after ads end, giving police a clear trail to follow.
Starting in November, if you want to run an ad on Facebook, TikTok, YouTube, or any major social platform operating in Thailand, expect a new friction point: proving who you actually are. The Thai government's latest regulatory overhaul no longer treats social media platforms as neutral bulletin boards. They are now law enforcement partners tasked with verifying every person or company posting paid content—before the ad goes live.
This shift stems from a hard reality: online scam rings have hollowed out trust in digital advertising. Between late 2025 and early 2026, the Royal Thai Police coordinated with Meta Platforms to remove over 52,000 suspicious pages peddling illegal gambling, predatory lending schemes, and fabricated job offers. Yet scammers keep adapting. Women aged 21 to 30 remain the favorite targets, often hit by romance cons, counterfeit product ads, and phishing links disguised as legitimate promotions. The Anti-Online Scam Operation Center (AOC 1441), which has operated 24/7 since 2023, intercepts thousands of fraudulent transactions monthly—but that's firefighting, not prevention.
The government has decided to move upstream.
The Rule: From Anonymity to Accountability
The Electronic Transactions Development Agency (ETDA) published the new framework on May 5, 2026, in the Royal Gazette. It takes force on November 5, 2026. The core mandate: any social media platform that collects advertising payments inside Thailand must implement Know Your Customer (KYC) protocols before any advertisement goes live.
This means platforms must choose one of two verification paths. First, document-based verification: submit a government-issued ID—national ID card, passport, or corporate registration certificate—and undergo facial recognition to confirm the photo matches. Second, digital identity verification: use a certified Digital ID system meeting standards set by the Electronic Transactions Committee. Either way, platforms are responsible for confirming the advertiser's identity against reliable external databases.
Once verified, that advertiser remains cleared for 12 months. After expiration, they re-verify. Advertisers verified within the past year can skip re-verification, but platforms must maintain records proving the dates of authentication.
The scope is deliberately broad. A Thai small business owner, a foreign e-commerce company, a multinational tech firm—all fall under the same rule if their ads target Thai users. A Singapore-based retailer running geo-targeted campaigns in Bangkok must comply. A Hong Kong cryptocurrency exchange advertising to Thai investors must comply. A London-based fashion influencer promoting affiliate products in Thai must comply. Platforms have no discretion to exempt foreign operators. That includes their home jurisdictions: Facebook, Google, TikTok, and Twitter each must build onboarding systems that handle multi-jurisdiction KYC requirements simultaneously.
The Data Layer: Investigation Trails
Compliance goes beyond verification. Platforms must retain advertiser data—full names, contact information, and payment details—for at least 90 days after an ad stops running. That 90-day window is deliberate. It gives law enforcement time to identify victims, gather evidence, and obtain judicial orders to access the data. The Anti-Money Laundering Office (AMLO), empowered under the 2025 cybercrime decree, can now freeze suspicious bank accounts immediately upon receiving a complaint and return recovered funds directly to victims without waiting for court proceedings.
This represents a philosophical shift in how Thailand views platform responsibility. Platforms are no longer intermediaries claiming ignorance about their advertisers. They are custodians of records that law enforcement needs to pursue scammers—and they will be held accountable if those records are missing or falsified.
The Enforcement Muscle: Joint Liability and Real Consequences
Compliance is not voluntary. The regulatory framework sits within the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes (No. 2) B.E. 2568, enacted in 2025. That decree introduced the concept of joint liability: if a bank, telecom provider, or online platform fails to meet government cybersecurity mandates or refuses to cooperate with investigations, they can be held financially responsible for victim losses—up to 500,000 THB per case.
The math is unforgiving. A platform that fails to verify a single advertiser and that ad defrauds 100 people does not face 100 separate liability claims. It faces the risk of regulatory sanctions, service suspension orders, criminal referrals, and reputational damage that makes operations in Thailand untenable. For Meta, Google, TikTok, and others, the cost of non-compliance exceeds the cost of building compliant systems.
Mobile operators are already subject to mandatory real-time SMS filtering to block scam messages. Banks face penalties for knowingly operating "mule accounts"—bank accounts opened or leased for money laundering. The new advertiser verification rule completes the ecosystem: financial institutions, telecom networks, and social media platforms now share overlapping enforcement obligations.
What Advertisers Should Expect
For legitimate business owners, the new rule adds administrative overhead. If you run a small e-commerce shop on Facebook Ads, prepare to submit a government-issued ID, possibly complete a facial scan, and wait for platform approval before your campaign launches. Verification renewal will be annual. Some platforms will automate this with biometric onboarding flows built directly into their ad submission dashboards. Others may require manual document uploads and human review, extending approval timelines by days or weeks.
Foreign advertisers face additional complexity. A European fashion brand or U.S. software company running geo-targeted ads in Thailand must navigate Thai KYC requirements, which may not align with European GDPR protocols or California CCPA standards. Platforms will likely develop unified onboarding portals to manage multi-jurisdiction compliance, but advertisers should expect longer setup times, higher legal advisory costs, and potential delays during peak advertising seasons—like the year-end shopping surge.
The ETDA has signaled that it will conduct public audits and random compliance checks. Platforms failing to meet the verification standard may face service suspension orders, fines, or referral to law enforcement for prosecution under the cybercrime decree.
Platform Burden: Technical Overhaul Ahead
For social media companies, compliance is a substantial operational undertaking. Biometric verification systems must integrate into ad submission workflows. Data storage infrastructure must be upgraded to securely retain advertiser records for at least 90 days, with encryption and access controls satisfying both the Thailand Personal Data Protection Act (PDPA) and the cybercrime decree. Platforms must build processes for responding to government data requests within statutory windows without creating unmanageable friction.
The ETDA has given platforms a six-month runway—from May to November 2026—to achieve compliance. For smaller platforms, extensions may be available on a case-by-case basis if they demonstrate good-faith effort. For major platforms, no blanket deferrals will be granted.
The Bigger Picture: Thailand's 2026 Cybercrime Hardening
This advertiser verification rule is one piece of a multi-year national strategy. Amendments to the Cybersecurity Act B.E. 2562 (2019) came into force in January 2025, requiring Critical Information Infrastructure (CII) operators—energy grids, financial networks, transportation systems—to classify their data and implement minimum-security baselines. The ETDA's 2026 regulatory roadmap emphasizes "practicable, verifiable, and shared responsibility," a deliberate pivot from earlier frameworks that treated digital platforms as neutral conduits.
The new philosophy is blunt: platforms are custodians of public safety, not passive intermediaries. If a scammer uses your ad system to defraud Thai consumers, you share responsibility for the harm.
The government has also deepened international cooperation. The Royal Thai Police now maintain direct liaisons with Meta, Google, and TikTok, enabling rapid takedown requests and cross-border investigations. In the first quarter of 2026 alone, this partnership resulted in removing thousands of pages and accounts linked to organized crime syndicates operating from neighboring countries.
Impact on Residents and Expats
For expatriates and digital nomads running side businesses or freelance services in Thailand, the KYC requirement adds a compliance burden but also creates a moat against fraud. Legitimate advertisers benefit from a raised competitive bar. Scammers find it harder to impersonate your brand or launch look-alike campaigns when they cannot hide behind anonymous ad accounts.
However, the data retention mandate raises privacy concerns. Your verified identity documents will be stored by the platform for at least 90 days after your ad campaign ends, and Thai law enforcement may access that data under certain conditions. Review the platform's privacy policy and ensure you understand how your information will be handled, stored, and shared—and whether the platform's practices align with both Thai and your home country's privacy standards.
Timeline and Practical Steps
The regulation officially takes effect November 5, 2026, giving advertisers and platforms roughly six months to prepare. Expect platforms to roll out KYC onboarding flows in the coming months. If you run regular ad campaigns, initiate verification early to avoid disruptions during high-traffic periods like year-end shopping or festival seasons. Delays in verification can mean missed campaign windows.
For platform operators, investment in fraud detection AI, secure data storage, and customer support infrastructure must accelerate immediately. The ETDA will not grant blanket extensions, though accommodations for smaller platforms demonstrating good-faith effort may be considered.
The broader message is unmistakable: Thailand's digital economy is maturing, and with maturity comes regulatory sophistication. The era of anonymous, unaccountable online advertising is ending. Whether you are a multinational tech giant, a regional startup, or a local entrepreneur, the expectation is uniform—verify identity, protect users, and share responsibility for digital safety.
