During the 3rd UPR cycle in November 2021, Thailand received at least 44 recommendations related to freedom of expression, peaceful assembly and association, of which it supported approximately half, including nine specifically addressing digital rights (51.87, 51.88, 51.89, 51.91, 51.93, 51.94, 52.49, 52.54 and 52.55). These included calls to enact a data protection framework consistent with principles of necessity and proportionality, prevent the misuse of cyberspace, and ensure that laws do not unduly restrict freedom of expression and peaceful assembly. Accepted recommendations remained broad in nature; more specific recommendations calling for reform or repeal of the Computer Crimes Act and Section 112 (lèse-majesté) were merely noted.

During the period under review, Thailand has continued to weaponise the Computer Crimes Act, criminal defamation, Section 112, and to a lesser extent Section 116 (sedition) against individuals exercising their right to freedom of expression online. The data protection framework has fallen short of international standards in both scope and enforcement. The ASEAN Regional Coalition to #StopDigitalDictatorship, as well as Freedom House and Manushya Foundation’s Freedom on the Net reports have classified Thailand as “Not Free” for five consecutive years. Thailand’s 3rd UPR cycle concluded before generative AI tools became widely available in late 2022, and no AI-specific recommendations were made, even though AI is now actively deployed by Thai state authorities in contexts with severe and documented human rights consequences.

This assessment shows that Thailand has failed to implement the accepted 3rd cycle digital rights recommendations. Between 18 July 2020 and 31 August 2026, 2,000 individuals were politically prosecuted across 1,348 cases. Meta restricted over 11,400 items in Thailand across 2025 following government requests, with Section 112 as a central basis; YouTube and TikTok reported near-100 per cent compliance with Thai content removal orders. In August 2025, the National Broadcasting and Telecommunications Commission mandated biometric liveness detection for SIM registration; in January 2026, the Electronic Transactions Committee released a draft notification requiring mandatory identity verification for all social media accounts. A forensic investigation published in July 2022 confirmed Pegasus spyware infections affecting at least 30 activists, human rights defenders and other civil society figures in Thailand between October 2020 and November 2021.