Thailand Mandates Advertiser Identity Verification for Social Media Platforms泰國要求社群媒體平台強制驗證廣告主身份

根據泰國電子交易委員會於 2026 年 5 月 5 日在政府公報發布的《社群媒體服務提供者科技犯罪防制措施公告（第2號）》，為了防範詐欺與騙局等科技犯罪，線上社群媒體平台服務提供者於刊登廣告前，將必須對所有付費廣告主進行身分驗證。該公告將於發布後 180 天（即 2026 年 11 月 1 日）起正式生效。

該法規引入「認識廣告主」（KYA）框架，類似於金融領域中的「認識客戶」（KYC）機制。該公告要求社群媒體提供者在驗證廣告主時，必須使用以下任一方法：

1.     基於文件的驗證：審查政府核發的身分文件（例如：國民身分證、護照或法人登記證明書），交叉比對廣告主與該身分文件之間的關聯（例如：與附有照片的身分證件進行人臉比對），並確保身分文件可透過可靠來源核實。

2.     數位身分驗證：使用保證等級不低於電子交易委員會所規定之身分驗證系統。

若廣告主於過去一年內已完成驗證，則無需重新驗證。該驗證之有效期間為一年。此外，平台必須蒐集並保存廣告主資訊，包括全名（自然人或法人）、身分識別號碼及聯絡資料（地址、電話號碼），保留期間自廣告服務開始起，且於廣告關係終止後至少保存九十日。上述義務亦適用於第三方付款人，例如廣告代理機構。

泰國更嚴格的監管作法，反映出其對線上詐騙、虛假投資推廣，以及日益猖獗的跨境詐騙活動的高度關切；這些詐騙活動愈來愈多依賴社群媒體廣告系統來鎖定消費者。透過要求在刊登廣告前進行身分驗證，泰國政府旨在大幅提高詐騙者透過線上社群平台匿名運作的難度。

新的規範預期將對在泰國營運的社群媒體公司及數位廣告平台產生重大合規義務。業者需在180天的實施期間內，建立使用者導入程序、身分驗證系統，以及安全的資料保存機制。同時，蒐集與儲存身分證明文件及生物辨識資訊等敏感個人資料，也可能在泰國《個人資料保護法》（PDPA）之下引發額外的合規問題，包括對合法基礎、目的限制、資料安全及資料主體權利的要求。在泰國境外儲存驗證資料的平台，必須確保對敏感個人資料的國際傳輸提供足夠的保護措施。

線上平台應該評估他們是否屬於「線上社群媒體服務提供者」的範圍，並識別他們的哪些廣告主類別受制於身分驗證要求。受影響的平台應該評估他們目前的廣告主驗證能力、找出合規差距，並開始設計技術解決方案和營運流程，以確保在 2026 年 11 月法規生效前準備就緒。

Under the new Notification on Measures for Prevention of Technology Crime for Online Social Media (No. 2),[1] which aims to prevent technology crimes such as fraud and scams, published by the Electronic Transactions Commission in the Government Gazette on 5 May 2026, online social media platform providers will be required to verify the identity of all paying advertisers before advertisements can be published. The notification takes effect 180 days after publication (i.e., on November 1, 2026).

The regulation introduces a “Know Your Advertiser” (KYA) framework similar to know-your-customer (KYC) measures used in the financial sector. The notification requires social media providers to use either of the following methods when verifying advertisers:

1.     Document-based verification: Examine government-issued identity documents (e.g., national ID, passport, or juristic person registration certificate), cross-check the connection between the advertiser and the identity documents (e.g., facial comparison with photo ID), and ensure that the identity documents are verifiable against reliable sources.

2.     Digital identity verification: Use an identity verification system with a level of assurance no lower than that prescribed by the Electronic Transactions Commission.

If an advertiser has already been verified within the last year, re-verification is not required. Verification remains valid for one year. In addition, platforms must collect and retain advertiser information, including full name (individual or legal entity), identification numbers and contact details (address, phone number), from the start of the advertising service and for at least 90 days after the advertising relationship ends. These obligations also extend to third-party payers, such as advertising agencies.

Thailand’s tighter approach reflects growing concern over online fraud, fake investment promotions, and cross-border scam operations that increasingly rely on social media advertising systems to target consumers. By requiring identity verification before advertisements can be placed, the Thai government aims to make it significantly harder for scammers to operate anonymously through online social media platforms.

The new requirements will likely create significant compliance obligations for social media companies and digital advertising platforms operating in Thailand. Businesses will need to establish onboarding procedures, identity authentication systems, and secure data-retention measures within the 180-day implementation period. At the same time, the collection and storage of sensitive personal data, such as identification documents and biometric information, may raise additional compliance concerns under Thailand’s Personal Data Protection Act (PDPA), including requirements for lawful basis, purpose limitation, data security, and data subject rights. Platforms storing verification data outside Thailand must ensure adequate safeguards for international transfers of sensitive personal data.

Online platforms should assess whether they fall within the scope of “online social media service provider” and identify which categories of their advertisers are subject to the identity verification requirements. Affected platforms should evaluate their current advertiser verification capabilities, identify compliance gaps, and begin designing technical solutions and operational processes to meet the November 2026 effective date.

[1] please refer to https://ratchakitcha.soc.go.th/documents/113758.pdf for the original publication

#泰國中文律師 #泰國律師事務所  #thailaw #thailawyer #ThaiLawFirm #IBCFirm #泰國華語律師 #泰國台灣律師 #泰國個人資料保護法 #ThailandPDPA #PDPA