Social Media Advertising: New Advertiser Verification Requirements Take Effect Soon
A significant compliance deadline is approaching for businesses involved in social media advertising. From 1 November 2026, social media service providers offering paid advertising will be required to verify the identity of advertisers before advertisements are published in Thailand under the Notification of the Electronic Transactions Commission on Measures for the Prevention of Technology Crime for Social Media Service Providers (No. 2) (the Notification). With the effective date approaching, platforms should now move beyond legal assessment and ensure that their advertiser onboarding, identity verification, payment, and record-retention systems are operationally ready.
Advertiser Verification and Record Retention:
Where an advertisement is published in Thailand through social media and the social media service provider receives payment for the advertising service, whether from the advertiser or another person, the provider must verify the identity of the advertiser before publication. Verification may be conducted using government-issued identification that can be checked against a reliable source, together with a method of establishing the connection between the advertiser and the identification evidence, or through a Digital ID verification and authentication system meeting the applicable standards of the Electronic Transactions Commission. The requirement should therefore not be understood simply as a mandatory “face scan” rule. Importantly, verification generally does not need to be repeated where the advertiser has already been verified within the preceding one year, allowing platforms to maintain verified-advertiser systems rather than conducting a completely new verification exercise for every advertisement.
The Notification also requires platforms to retain prescribed information identifying the advertiser, including relevant identification, corporate and contact information. Where advertising charges are paid by a person other than the advertiser, information concerning the payer must also be retained. This is particularly relevant to advertising agencies, media buyers, corporate groups, and centralized advertising arrangements where the entity funding an advertising campaign may differ from the advertiser or the person operating the advertising account. The required information must generally be retained for at least 90 days after the advertising service ends.
Why the New Requirements Matter:
The Notification should be considered within the broader shared-responsibility framework under the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes. Under that framework, social media service providers may be required to participate in responsibility for losses resulting from technology crime unless they can demonstrate compliance with the applicable preventive standards or measures prescribed by the relevant regulator. Advertiser verification is therefore more than an administrative KYC exercise. Platforms should maintain systems and evidence capable of demonstrating that the required verification, information collection, and related preventive measures were properly carried out if fraudulent advertising subsequently results in losses.
Although the principal regulatory obligations fall on social media service providers, the practical impact will extend throughout the advertising ecosystem. Advertising agencies operating accounts for clients may be asked to establish the identity of the underlying advertiser, the legal entity represented, and the person funding the campaign. Foreign advertisers may face additional onboarding requirements involving passports, foreign corporate documents, authorized representatives, and cross-border payment arrangements. Businesses using agencies or regional media-buying structures should therefore review whether their documentation and authorization arrangements will allow platforms to identify the relevant parties without delaying campaigns.
Data Protection and Implementation:
The new regime also has an important PDPA dimension. Identity verification may involve national identification documents, passports, corporate representatives’ information, contact details, and potentially facial images used for verification. Platforms should therefore ensure that the collection and retention of this information complies not only with the Notification but also with the Personal Data Protection Act, including requirements concerning lawful processing, privacy information, security, access controls, and appropriate retention and deletion. A regulatory requirement to collect or retain particular information does not displace the broader obligations applicable to the processing of personal data.
Before the effective date, social media platforms should test the complete advertising workflow rather than simply adding a KYC step. This includes determining when advertising falls within the Notification, establishing appropriate verification methods for individuals and legal entities, recording when an advertiser was last verified, identifying third-party payers, maintaining the required information for the applicable period, and addressing situations involving agencies, foreign advertisers, corporate accounts, authorized representatives, and regional advertising arrangements. Advertisers and agencies should likewise review who is identified as the advertiser for each account, who actually pays the advertising charges, and whether the necessary identification, corporate, and authorization documents will be readily available. The practical deadline is therefore not simply 1 November 2026: businesses should have the necessary systems, procedures, and documentation in place before that date to avoid disruption when the requirements become mandatory.
Key Takeaways:
From 1 November 2026, paid social media advertising published in Thailand will be subject to stronger advertiser-identification requirements. Social media service providers must verify advertisers before publication, subject to the exception for advertisers verified within the preceding year, and retain prescribed identifying information for at least 90 days after the advertising service ends. Information concerning a third-party payer must also be retained where someone other than the advertiser pays for the advertising.
Although the legal obligations principally apply to social media service providers, their operational effects will extend to advertisers, agencies, media buyers, foreign businesses, and businesses using centralized payment arrangements. Most importantly, the requirements should not be treated merely as another KYC exercise: within the broader technology-crime liability framework, platforms should be able to demonstrate compliance with the required verification and preventive measures. Businesses participating in the social media advertising ecosystem should therefore review their verification, payment, record-retention, and data-protection processes now rather than waiting until the requirements become mandatory.
Author: Panisa Suwanmatajarn, Managing Partner.
Other Articles
- Social Media Advertising: New Advertiser Verification Requirements Take Effect Soon
- Thailand Revises Visa Exemption Scheme: 30-Day Stay and Revised List of Eligible Countries
- PDPA: When CCTV Becomes Biometric Processing
- PDPA: Cross-Border Data Transfer Compliance for Bank Z Under Thailand’s Data Protection Law – Key Takeaways
- PDPA: Does Removing a Name Make Data Anonymous?
- PDPA: Disclosure of Personal Data to Third Parties for Legal Proceedings