1. Introduction

Autonomous Digital Consent Governance in Thailand refers to the legal framework governing how individuals give, refuse, modify, withdraw, and control consent through digital platforms and automated technologies.

It concerns the legal validity of consent generated through:

Artificial intelligence (AI) platforms.

Automated contractual systems.

Electronic signatures and digital authentication.

Mobile applications and online services.

Biometric identification systems.

Smart contracts and blockchain networks.

Automated banking and financial transactions.

Digital healthcare and telemedicine platforms.

Data collection, processing, and commercialisation systems.

The central legal question is whether an electronic or automated expression of agreement represents the individual's genuine, informed, voluntary, and legally recognisable intention.

Thailand does not have a single statute specifically regulating autonomous digital consent. Instead, the subject is governed by several interconnected laws, particularly the Civil and Commercial Code (CCC), Electronic Transactions Act B.E. 2544 (2001), Personal Data Protection Act B.E. 2562 (2019), Consumer Protection Act B.E. 2522 (1979), and Computer-Related Crime Act B.E. 2550 (2007).

The objective is to ensure that technological automation does not eliminate individual autonomy, contractual fairness, privacy, or civil responsibility.

2. Legal framework governing digital consent

A. Civil and Commercial Code

The Thai Civil and Commercial Code provides the fundamental principles governing consent and contractual relationships.

Relevant principles include:

Section 149 – Juristic acts: A juristic act involves a voluntary expression of intention intended to establish, modify, transfer, preserve, or extinguish legal relations.

Section 150 – Illegality and public order: Juristic acts contrary to legal prohibitions or public order and good morals may be void.

Sections 154–156 – Declaration of intention: These provisions address the relationship between expressed intention and defects in the declaration, including mistake and fraud-related issues.

Sections 159–160 – Fraud: Fraud affecting consent may make a juristic act voidable under the applicable conditions.

Sections 171–172 – Interpretation and consequences: These provisions assist in determining the meaning and legal consequences of declarations of intention.

Sections 354–361 – Offer and acceptance: These provisions govern the formation of contracts through offers and acceptances.

Application: When a person clicks an acceptance button, signs electronically, or approves an AI-generated transaction, the court must consider whether the action constitutes a legally meaningful declaration of intention.

A computer system cannot automatically establish genuine consent merely because it records a successful transaction.

B. Electronic Transactions Act B.E. 2544 (2001)

The Electronic Transactions Act is particularly important for autonomous digital consent.

Its relevant provisions include:

Section 7: Information cannot be denied legal effect merely because it is in electronic form.

Section 8: Electronic information may satisfy legal requirements concerning writing, subject to statutory conditions.

Section 9: Electronic signatures may satisfy signature requirements where the applicable identification and reliability conditions are met.

Section 10: Electronic information may be admissible as evidence, with its evidential weight assessed according to relevant reliability factors.

Section 13: Offers and acceptances may be expressed through electronic data messages.

Section 15: Attribution of electronic data messages to an originator.

Section 16: Circumstances in which an electronic message is regarded as that of the originator.

Section 18: Acknowledgement of receipt of electronic data messages.

Application: An electronically recorded agreement can be legally enforceable even without a traditional handwritten signature, provided the statutory requirements and applicable contractual rules are satisfied.

C. Personal Data Protection Act B.E. 2562 (2019)

The PDPA is central to digital consent governance because it regulates the collection, use, and disclosure of personal information.

Important provisions include:

An important distinction is that consent is not the only lawful basis for processing personal data. Processing may also be permitted under the statutory exceptions and other lawful bases specified by the PDPA.

Consequently, a company cannot justify every form of data processing simply by relying on an acceptance button.

D. Consumer Protection Act B.E. 2522 (1979)

The Consumer Protection Act protects consumers against misleading commercial practices, unfair contractual conditions, and deceptive representations.

Its relevance to digital consent includes:

Misleading consent buttons.

Hidden subscription conditions.

Automatic renewal without adequate disclosure.

Deceptive online advertisements.

Unfair digital service agreements.

Unauthorised additional charges.

A digital platform cannot rely on technically recorded acceptance to legitimise a misleading or unfair consumer transaction.

E. Computer-Related Crime Act B.E. 2550 (2007)

This legislation is relevant where digital consent disputes involve computer-related offences, unauthorised access, alteration of electronic information, or fraudulent digital activities.

It may become relevant when a person alleges that an account was accessed without permission, that electronic records were manipulated, or that a fraudulent party used another person's digital identity to create apparent consent.

3. Essential principles of autonomous digital consent

3.1 Informed consent

Consent must be based on sufficient information about the relevant transaction or data-processing activity.

For example, an application collecting location information should explain:

What information is collected.

Why it is collected.

How it will be used.

Whether it will be shared with third parties.

How long it will be retained.

Whether the individual can withdraw consent.

3.2 Voluntary consent

Consent must not be obtained through coercion, deception, manipulation, or inappropriate pressure.

An application that prevents users from accessing an unrelated service unless they agree to unnecessary personal-data processing may raise issues under section 19 of the PDPA.

3.3 Specific consent

Consent must relate to identifiable purposes.

A general statement such as accepting all present and future uses of personal information may not satisfy the requirements of the PDPA.

3.4 Electronic authentication

Electronic authentication helps establish who performed a particular action.

Examples include:

OTP verification.

Digital signatures.

Password authentication.

Biometric verification.

Multi-factor authentication.

Verified electronic communication.

However, authentication and consent are different legal concepts. Proving that a particular person accessed an account does not necessarily prove that the person understood and voluntarily accepted every contractual or privacy condition.

3.5 Withdrawal of consent

Section 19 of the PDPA recognises the right to withdraw consent.

A data controller must provide a withdrawal mechanism that is as easy as the method used to give consent, subject to the applicable legal requirements.

Withdrawal does not automatically invalidate a previously concluded contract or erase processing that is independently lawful under another statutory basis.

4. Autonomous digital consent and artificial intelligence

AI introduces new questions concerning the relationship between human intention and automated decision-making.

Consider a financial platform that automatically accepts a customer's digital consent and subsequently uses AI to analyse their financial information.

Several legal issues may arise:

Whether the customer understood the processing purposes.

Whether the platform obtained valid consent.

Whether the AI system exceeded the authorised processing purpose.

Whether the customer can withdraw consent.

Whether the organisation can establish the authenticity of the electronic acceptance.

Whether the system's design unfairly influenced the customer's decision.

Under the PDPA, automated decision-making is not governed solely by consent. The applicable rules, including those concerning data-subject rights and sensitive personal data, must be considered alongside the lawful basis for processing.

Important distinction: AI cannot independently create legal consent on behalf of a person merely by predicting that the person would probably agree.

5. Six major areas of civil liability

The legal responsibility may fall on the platform operator, data controller, service provider, contracting party, or another responsible person depending on the facts and applicable legislation.

6. Important judicial decisions and case laws

Important judicial clarification: Thailand has relatively limited reported litigation directly concerning consent under the PDPA. The available legal materials distinguish between decisions involving electronic signatures, contractual acceptance, and personal-data consent. The following cases are therefore a combination of directly relevant electronic-transaction authorities and analogous decisions. They should not all be treated as direct precedents on AI consent.

Case 1. Supreme Court Decision No. 8089/2556

Subject: Legal recognition of electronic signatures

This decision is identified among the Thai Supreme Court decisions addressing electronic signatures and electronic documents.

Legal significance:

Electronic signatures can receive legal recognition under the Electronic Transactions Act.

Electronic records should not be rejected merely because they are created electronically.

The legal significance of an electronic signature depends on the applicable statutory requirements.

Application to autonomous consent: A digital platform may rely on electronic records to demonstrate contractual acceptance, but it must establish the connection between the relevant individual and the recorded act.

Case 2. Supreme Court Decision No. 6757/2560

Subject: Electronic documentation and evidentiary recognition

This decision is also identified in Thai electronic-signature legal materials as an example of judicial treatment of electronic signatures.

Legal significance:

Electronic documents can have legal evidentiary significance.

The electronic form of a document does not, by itself, invalidate its legal effect.

Electronic documentation must be considered within the statutory framework governing authenticity and reliability.

Application: Businesses using automated consent platforms should preserve reliable electronic records showing the identity of the user and the transaction to which the user agreed.

Case 3. Supreme Court Decision No. 4249/2563

Subject: Electronic signatures and digital documentary evidence

This decision is cited among Thai Supreme Court authorities addressing electronic signatures.

Legal significance:

Electronic signatures are recognised within the Electronic Transactions Act framework.

Electronic documents may be relevant evidence in civil proceedings.

The method used to identify the signatory and demonstrate approval is important.

Application: A company cannot establish the validity of every digital consent merely by producing a database entry. The surrounding evidence and reliability of the authentication method remain important.

Note on Cases 1–3: The publicly available legal reference identifies these decisions as electronic-signature authorities but does not establish that the courts decided the substantive validity of autonomous or AI-generated consent. Their relevance here is limited to electronic-document recognition.

Docusign+1

Case 4. Supreme Court Decision No. 2162/2567

Highly relevant electronic-consent analogy

Subject: LINE messages as legally enforceable electronic evidence

This is one of the most important Thai decisions for understanding digital contractual acceptance.

Facts:

A lender transferred money to a borrower on multiple occasions. Before most transfers, the lender sent LINE messages explaining the amount of the loan and asking the borrower to type an acceptance message.

The borrower replied with the Thai equivalent of "agreed".

Later, a dispute arose concerning whether the transactions were loans or joint business investments.

Judgment:

The Supreme Court distinguished between the individual transactions:

Transfers 2–18 were supported by messages describing the loans and the borrower's affirmative replies.

The LINE exchanges constituted electronic evidence satisfying the applicable written-evidence and signature requirements.

The first transfer lacked the required written evidence.

The nineteenth and twentieth transfers lacked the borrower's affirmative acceptance.

Consequently, only the sufficiently documented loans were enforceable under section 653 of the CCC.

Legal principles:

Electronic conversations can establish contractual intention.

A typed affirmative response can operate as an electronic signature.

The content of the communication matters.

An electronic transaction must be examined individually.

A bank-transfer record alone does not necessarily prove the underlying agreement.

Relevance to autonomous digital consent: An automated consent interface must preserve the actual content of the user's approval, rather than merely recording that a transaction occurred.

ThaiLawOnline+1

Case 5. Supreme Court Decision No. 1263/2567

Subject: Unwritten loan and enforceability of digital financial arrangements

Facts:

A lender had previously entered into a documented loan arrangement with a borrower. After repayment, the lender transferred an additional amount of money without obtaining fresh written evidence of the subsequent loan.

The lender relied partly on possession of the borrower's land title deed.

Judgment:

The Supreme Court treated the subsequent transfer as a separate loan. Without written evidence signed by the borrower, the lender could not enforce the subsequent loan under section 653 of the CCC.

The lender was also required to return the title deed.

Legal principles:

Previous consent does not automatically establish consent to a later transaction.

Each transaction must have its own legally sufficient evidentiary basis.

Possession of security documents does not replace the statutory requirements for enforceability.

Relevance: An AI platform cannot assume that a customer who accepted an earlier transaction has automatically accepted a subsequent transaction with different terms.

ThaiLawOnline

Case 6. Supreme Court Decision No. 1112/2566

Subject: Ambiguous electronic communications and contractual intention

Facts:

A claimant transferred approximately THB 7.8 million and relied on LINE conversations to establish that the money was a loan.

However, the communications were ambiguous and referred to pursuing money and a possible joint investment in luxury cars.

Judgment:

The Supreme Court did not consider the communications sufficient to establish the alleged loan under section 653 of the CCC.

The electronic communications did not clearly demonstrate that the money had been advanced as a loan.

Legal principles:

Electronic communication must establish the actual nature of the agreement.

Ambiguous messages cannot automatically establish contractual acceptance.

The context and substance of the communication are important.

Relevance: AI-generated consent summaries must not convert an ambiguous user response into a definitive legal agreement.

ThaiLawOnline

Case 7. Supreme Court Decision No. 3622/2568

Subject: Electronic acceptance and the meaning of a digital response

Facts:

A lender transferred money and communicated with the borrower through LINE. The borrower responded with expressions of thanks, including a sticker, but the subsequent communication did not clearly establish that the additional transfer was a loan.

Judgment:

The Supreme Court distinguished between an electronic record and legally sufficient evidence of a particular agreement.

Although electronic communications can satisfy requirements for written evidence and signatures, the content must establish the relevant legal transaction.

A thank-you message or sticker did not establish acceptance of the later loan.

Legal principles:

An electronic response is not automatically contractual acceptance.

Context matters when interpreting digital communication.

A system must distinguish acknowledgement from agreement.

Relevance: An autonomous digital consent system should distinguish between actions such as opening a notice, acknowledging receipt, expressing thanks, and actually agreeing to a legal condition.

ThaiLawOnline

Case 8. Thai First-Instance Personal Data Protection Decision – March 2024

Subject: Disclosure of sensitive personal information without explicit consent

Facts:

An individual brought proceedings against an insurance company and its representatives concerning the collection, use, and disclosure of blood-alcohol test results and a photograph of the individual undergoing the test.

The information was disclosed to a family member who was the insured party. The disclosure allegedly caused reputational harm and other adverse consequences.

Legal issue:

Whether the insurance company could rely on its contractual relationship with the insured person to justify the processing and disclosure of another individual's sensitive personal information.

Legal significance:

Blood-alcohol test results may constitute sensitive personal data under section 26 of the PDPA.

The legal basis for processing must be examined separately from the existence of an insurance contract.

Disclosure to a third party requires an appropriate legal justification.

Consent and other statutory exceptions must be analysed according to the specific processing activity.

Relevance: An automated insurance platform cannot assume that consent from one contractual party authorises the processing of another person's sensitive personal data.

Important qualification: This was a reported first-instance decision, not a Supreme Court precedent. The published account does not provide a verified Supreme Court case number.

Tilleke & Gibbins

7. Civil liability for invalid autonomous digital consent

Thailand's legal framework provides several potential routes for civil liability.

A. Liability under section 77 of the PDPA

A data controller or processor that causes damage through a breach of the PDPA may be liable to compensate the affected data subject.

The liability framework does not require proof of ordinary negligence or intention in the same manner as a conventional fault-based claim. The statutory defences must also be considered.

B. Punitive damages under section 78

The court may award punitive damages where the statutory conditions are satisfied.

Such damages cannot exceed twice the amount of actual compensation.

C. Contractual liability

Where an organisation obtains consent through an invalid or misleading process, contractual disputes may arise concerning:

Whether a valid contract was formed.

Whether the declaration of intention was affected by fraud or mistake.

Whether contractual obligations were performed.

Whether the contract is voidable or unenforceable under the relevant provisions.

D. Tort liability

Under sections 420 and following of the CCC, a person who unlawfully and wrongfully injures another person may incur tort liability if the necessary elements are established.

Examples include:

Unauthorised disclosure of personal information.

Identity misuse.

Unlawful biometric-data processing.

Financial loss caused by wrongful digital actions.

Privacy-related harm.

E. Liability for automated systems

An organisation cannot necessarily escape legal responsibility by arguing that an AI system independently performed the relevant activity.

The court must examine the conduct of the responsible parties, their statutory duties, the system's design and operation, and the causal connection with the damage.

8. Special legal issues in autonomous digital consent governance

8.1 AI-generated consent

AI systems may generate consent forms, explain contractual conditions, and communicate with users.

The main legal concern is whether the person actually understands the terms presented by the AI.

For example, an AI chatbot may tell a customer that a service requires access to location data when the service could operate without it.

Such conduct may raise issues under section 19 of the PDPA and consumer-protection principles.

8.2 Biometric consent

Biometric information, including facial recognition and fingerprints used for identification, may fall within the sensitive personal data protections of section 26.

Organisations should ensure that:

Explicit consent is obtained where required.

The purpose is clearly communicated.

Access is appropriately restricted.

Biometric information is protected against unauthorised disclosure.

Applicable withdrawal and retention obligations are respected.

8.3 Smart-contract consent

Smart contracts can automatically execute transactions after specified digital conditions are fulfilled.

However, execution does not necessarily establish that the underlying agreement was validly formed.

For example, a blockchain transaction may automatically transfer digital assets after a user clicks an approval button. A subsequent dispute could concern whether the individual understood the transaction, whether the approval was authentic, or whether the smart-contract conditions reflected the actual agreement.

The CCC and Electronic Transactions Act remain relevant to determining legal enforceability.

8.4 Consent involving minors

Section 20 of the PDPA establishes special requirements for consent involving minors and persons with limited legal capacity.

Digital platforms dealing with children must consider:

Age verification.

Parental responsibility.

Legal capacity.

Appropriate consent procedures.

Protection against manipulative digital interfaces.

8.5 Cross-border digital consent

International platforms operating in Thailand may collect personal information from Thai residents and transfer it internationally.

Section 28 of the PDPA governs cross-border transfers, subject to its applicable conditions and exceptions.

A user accepting an international platform's terms does not automatically authorise every subsequent international data transfer.

9. Practical examples of civil disputes in Thailand

10. Institutional governance and regulatory responsibilities

Several Thai institutions have important responsibilities in this area.

11. Major challenges in Thailand

A. Absence of specific AI-consent legislation

Existing laws provide important protections, but they do not comprehensively address every issue arising from autonomous AI consent interfaces.

B. Difficulty proving genuine intention

A digital record may demonstrate that an account performed an action without conclusively establishing who acted or whether that person understood the legal consequences.

C. Dark patterns

Some digital interfaces deliberately influence users through confusing buttons, hidden conditions, repeated requests, and difficult withdrawal procedures.

D. Algorithmic manipulation

AI systems may personalise consent requests according to a person's behaviour, preferences, or vulnerabilities.

This raises questions about whether consent is genuinely voluntary.

E. Accountability gaps

When multiple businesses, cloud providers, AI developers, and data processors participate in a single transaction, determining their respective legal responsibilities can be difficult.

F. Digital evidence preservation

Organisations must be capable of preserving reliable records of consent, including:

Date and time.

User authentication.

Exact consent wording.

Version of the terms.

Purpose of processing.

Subsequent amendments.

Withdrawal requests.

Relevant system logs.

12. Recommendations for strengthening Thailand's legal framework

Thailand could improve autonomous digital consent governance through the following reforms.

1. AI consent standards: Establish clear standards for AI-generated consent requests and automated contractual acceptance.

2. Human autonomy protection: Prevent AI systems from treating predicted preferences as actual consent.

3. Transparent interfaces: Require understandable, purpose-specific consent mechanisms.

4. Consent verification: Introduce stronger identity and authentication procedures for high-risk transactions.

5. Withdrawal mechanisms: Ensure that digital withdrawal is straightforward and accessible.

6. Automated decision transparency: Strengthen transparency and appropriate human involvement in decisions affecting individuals.

7. Children's digital protection: Improve safeguards for minors using autonomous digital platforms.

8. Evidence standards: Establish reliable procedures for preserving electronic consent records.

9. Corporate accountability: Clarify responsibilities among AI developers, service providers, controllers, and processors.

10. Judicial development: Encourage consistent judicial interpretation of digital intention, electronic acceptance, and automated contractual disputes.

13. Overall legal analysis

Autonomous Digital Consent Governance in Thailand represents an important development in the relationship between civil law, electronic transactions, artificial intelligence, privacy, and contractual autonomy.

The Electronic Transactions Act establishes the legal recognition of electronic documents and signatures. The CCC determines whether the parties have formed legally binding agreements. The PDPA protects individuals against unlawful processing of personal information, while consumer-protection and tort principles address additional forms of digital misconduct.

The Supreme Court's decision in 2162/2567 is particularly significant because it demonstrates that digital conversations can establish legally enforceable contractual acceptance when their content and evidentiary characteristics satisfy statutory requirements.

Conversely, decisions such as 1112/2566 and 3622/2568 demonstrate that ambiguous digital communications do not automatically establish agreement.

These principles are increasingly important when autonomous systems communicate with individuals, collect personal information, and execute transactions.

14. Conclusion

Thailand's legal framework recognises electronic consent as a potentially valid means of creating legal relationships. Nevertheless, technological automation cannot replace the fundamental legal requirement of genuine human intention wherever personal consent is legally required.

The most important principle is that digital acceptance, electronic authentication, contractual intention, and personal-data consent are related but legally distinct concepts.

Future Thai civil-law development should ensure that autonomous digital systems operate within clear standards of transparency, fairness, accountability, privacy protection, and individual autonomy.

The ultimate objective should be to create a legal environment in which digital innovation can develop without compromising the fundamental rights of individuals.

Research note: This analysis distinguishes established statutory provisions and reported judicial decisions from proposed future regulatory reforms. The PDPA litigation discussed above is limited, and the cited electronic-signature decisions do not all concern AI or personal-data consent directly. This is an academic legal analysis, not a claim that Thailand already has a comprehensive autonomous-consent doctrine.