Thailand’s Personal Data Protection Act is the legal floor Metric Routecore teaches against. If you instrument sites from Bangkok — or you process personal data of people in Thailand — the statute is not a slide at the end of a vendor webinar. It is why your consent taxonomy exists.
Personal data is broader than an email field
Online identifiers, device data, and behavioural records used to single someone out sit inside the definition most teams actually care about. “It is only a cookie ID” is not a serious argument. If a vendor can retarget that ID, treat it as personal data until counsel tells you otherwise in writing.
Purpose and lawful basis are not the banner headline
PDPA expects purpose limitation and a lawful basis. Consent is the basis advertising tags almost always rely on. Legitimate interest is sometimes discussed for narrow security or fraud uses. Stretching it to cover lookalike audiences is how desks get into trouble. In the PDPA Analytics Clinic we ask learners to write the basis next to each tag. Empty cells are the point of the exercise.
Retention is a tag setting, not a policy PDF
If your notice says analytics data is kept for thirteen months and your GA4 property is set to the longest available window “because we might need it,” the notice is decorative. Consent-based tracking analytics includes matching retention in the product to retention in the text.
Cross-border sending
Many pixels leave Thailand the moment they fire. That is a transfer. Your notice should say so in language a person can read, and your vendor list should be real. We do not run a transfer-impact assessment as a service; we will tell you when your container is clearly sending data to places you have not named.
Rights you must be able to honour
Access, correction, and withdrawal of consent are not only a DPO workflow. Withdrawal must reach the tag map. If a person rejects after previously accepting, your CMP and your server forwarder both need to stop. A form that emails the DPO while the pixels keep firing is not compliance.
Read the statute with your counsel. Use this page as a map of where analytics work collides with it. Then come to the clinic if you want that collision marked on your own container.