In the digital age, where social media has become a part of daily life, sharing family stories through various online platforms has become common. Many families share stories of their children, expressing pride, concern, or even worry when a child is unwell, by posting photos and messages on Facebook, Instagram, TikTok, or other platforms. This act is called “sharenting.” Although done with love and good intentions by parents, when it involves a child’s personal data, it might unknowingly lead to a violation of Personal Data Protection Act (PDPA).
Sharenting, a combination of “Share” and “Parenting,” refers to parents posting photos, videos, or information about their children on social media. While done with good intentions such as recording memories, exchanging experiences, raising awareness, or generating income, this practice carries significant risks.
The main concerns include violating children's privacy, creating safety risks, impacting their mental health, and enabling commercial data use without their consent. UNICEF warns that sharenting may violate children’s rights in the digital world and urges parents to think carefully before sharing their children’s information online.
In Thailand, the Child Protection Act B.E. 2546 (2003) provides key legal protection for children. Section 22 requires that any action toward a child must prioritize the child’s best interest and avoid unfair discrimination. Section 27 prohibits advertising or spreading information, media, or images intended to cause harm, contempt, hatred, or negative impact to a child or their parents. Additionally, the Personal Data Protection Act B.E. 2562 (2019) classifies children's health data as personal data requiring special attention, as children may lack the capacity to make decisions or protect their own rights. If the child’s data qualifies as sensitive personal data requiring special protection under Section 26—such as information about physical or mental health, medical treatment, medical history, genetic data, or medical service usage—its use or disclosure must be handled with even greater care and caution.
A request of consent to collect and use children’s personal data is complex, as minors lack the full legal capacity to provide valid consent. Under PDPA Section 20, consent for minors must be obtained from a parent or legal guardian. If the child is under ten years old, consent must be obtained solely from the person exercising parental power. Although parents have the authority to give consent on behalf of the child, this authority must be based on the “best interests of the child.”, a fundamental principle in child rights law that prioritizes the child’s benefit and well-being.
However, the PDPA provides an exception for “personal or household activities” under Section 4(1), which may not be subject to the law. Nevertheless, this exception has important limitations. The activity must be “truly personal or household.” Even if family members share information publicly, the activity may not be exempt.
Cases that may be exempt under Section 4(1) include:
Cases that are not exempt under Section 4(1) include:
Regarding the issue of taking and sharing photos or information about children, which many worries might violate the PDPA, if the action is for family activities or personal benefit and not for commercial purposes, it is not considered a violation of the law. However, the problem remains that Thai law has not clearly defined the scope of “family activities” or “personal benefit”. This leads to ambiguity in interpretation.
Under the European Union’s GDPR, Article 2 and Recital 18 establish an exemption for “purely personal or household activities.” This exemption is clearly defined in practice. The European Data Protection Board (EDPB) has clarified that household activities do not include the posting of personal data on publicly accessible social media. Public sharing on social media is therefore subject to the GDPR. There is clear legal interpretation that the so-called “household exemption” only applies to truly private activities—not those that involve disclosure to the public. This interpretation was affirmed by the Gelderland Court in the Netherlands (Case No. Rb. Gelderland - C/05/368427), which involved a family member posting photos of a child without parental consent. The court ruled that although family photos are generally considered personal, the public nature of social media and the absence of consent meant that the GDPR applied. Thus, the posting of the child’s image was not covered by the household exemption.
A case study from France, a pioneer in Sharenting legislation with its Children’s Image Rights Law 2024, aims to mitigate risks and enhance existing protections under the Child Influencers law. the French data protection authority (CNIL) advises against public sharing of children’s images and mandates consent from both the child and the other parent before posting. Furthermore, Iceland has developed clear, practical guidelines for children's data protection, with The Icelandic data protection authority (Persónuvernd) creating accessible resources to inform children of their rights. Iceland also enforces stricter data protection for children than adults, allows children at least 13 years old to give their own consent, and extends protection to guardians and caregivers, reflecting modern societal realities.
Sharenting, or sharing children’s personal information—especially health data—on social media, is a growing global concern that Thailand must urgently address to protect children in the digital age. Though often driven by good intentions, this practice can breach the PDPA and compromise children’s privacy. Any content involving children should be shared only when truly necessary and in their best interest, with careful thought given to potential long-term impacts. It’s also essential to protect identifiable details such as names, schools, or addresses, apply strict privacy settings, and maintain open communication with children and parents to build mutual understanding and respect for children’s digital rights.
Source Reference:
