PDPA Cookie Consent & Consent Mode v2 Setup (Thailand)

This page describes technical implementation. It is not legal advice. Your privacy notice and lawful bases should be reviewed by a qualified Thai lawyer or your data protection officer.

The problems we usually find

A banner that does nothing. The cookie banner appears, but GA4 and ad pixels load before anyone clicks.
A banner that blocks everything forever. Tags are blocked even after the visitor accepts, so analytics and ad conversions quietly collapse.
Pixels hard-coded outside Tag Manager by a plugin or theme, which the consent tool never controls.
No way to change your mind. PDPA expects withdrawing consent to be as easy as giving it; many sites have no link to reopen the banner.
Thai visitors get an English-only banner, which undermines the idea of informed consent.

What we implement

Tag inventory. We list every tag and cookie your site sets, where it is loaded from, and which purpose it serves.
Consent platform. We configure a consent management platform (or a lightweight custom banner for small sites) in Thai and English, with categories that match your actual tags.
Google consent mode v2. Default states are set before any Google tag loads, and updated from the visitor's choice for analytics_storage, ad_storage, ad_user_data and ad_personalization.
Non-Google tags. Meta, TikTok and LINE tags are fired only from Tag Manager triggers that respect consent.
Consent records and withdrawal. A persistent "cookie settings" link and a record of what each visitor chose and when.
Testing. We verify behaviour before and after accept and decline, on desktop and mobile, in Tag Assistant and the browser network panel, and give you the test log.

The reasoning behind these choices — what is required, what is optional, and what is overkill — is set out in our long-form article PDPA Thailand for analytics: what you actually need.

Keeping measurement useful after consent

Consent reduces the data you can collect; it should not destroy it. With consent mode configured properly, Google can use modelled conversions for visitors who decline, and your consenting visitors are measured fully. We also review server-side options (see server-side GA4) where they make sense, while keeping them within what visitors agreed to.

Frequently asked questions

Does PDPA require a cookie banner?

PDPA requires a lawful basis for processing personal data. For non-essential cookies such as analytics and advertising, that basis is generally consent, which in practice means a consent banner with a real choice. Confirm the specifics for your business with a Thai legal adviser.

What is Google consent mode v2?

It is Google's way for its tags to adjust their behaviour based on the visitor's consent choice, using four signals: analytics_storage, ad_storage, ad_user_data and ad_personalization. Advertisers who use Google's ad measurement and audience features in regions that require consent are expected to send these signals.

Will consent reduce my reported conversions?

Usually somewhat, because visitors who decline are not tracked with cookies. Consent mode allows Google to model part of that gap. A correct setup is still better than an incorrect one that may expose you to compliance risk.

Which consent platform do you recommend?

It depends on your site count, languages and budget. For a single site a simple, well-configured banner is often enough; groups with many sites benefit from a commercial consent management platform. We are not paid by any vendor.

PDPA cookie consent & Google consent mode v2 setup