Home › Insights (Thai) › Online defamation
Anonymous accounts · Criminal Code Section 96 and Computer-related Crime Act Section 18People defamed by an anonymous account often assume that they must know the poster’s name before they can go to the police, and they worry that the three-month limitation period will run out while the poster remains unidentified. Thai law addresses both points. A complaint can be lodged without knowing who the offender is, the limitation period starts only once the injured person knows both of the offense and of the offender, and the poster is traced through the powers of competent officials under the Computer-related Crime Act.
Last updated
Key points
An “avatar account” (Thai: เฟสอวตาร) is a Facebook or other social media account created without showing the user’s real identity. When such an account posts defamatory statements about someone, the injured person can file a police complaint at once even without knowing who posted, under Section 2 (7) of the Criminal Procedure Code (ประมวลกฎหมายวิธีพิจารณาความอาญา). The three-month limitation period under Section 96 of the Criminal Code (ประมวลกฎหมายอาญา) starts once the offender is known, and the poster is traced through the powers in Section 18 of the Computer-related Crime Act B.E. 2550 (2007) (พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550) together with the data that service providers must retain under Section 26.
An avatar account is a social media account that uses a name, photo and details that do not belong to the real user. Anonymity does not make the offense disappear. A user who posts statements defaming another person to third persons commits defamation under Section 326 of the Criminal Code, and a public post also amounts to defamation by publication under Section 328.
“Avatar account” (เฟสอวตาร) is the term Thai social media users use for a Facebook account that does not show its owner’s real identity. Accounts of the same kind exist on X, TikTok, Instagram and in LINE groups under pseudonyms. Some are created to express opinions without being recognized; others are created specifically to attack a particular person. The law does not prohibit pseudonyms. What the law punishes is the content of the statement.
Section 326 of the Criminal Code provides that “whoever imputes anything to another person before a third person in a manner likely to impair the reputation of that other person or to expose that other person to hatred or contempt” commits defamation.1 Every element of this section turns on the act and the statement; none requires the offender to reveal a real name. A user of an avatar account who posts a defamatory statement for others to read therefore fulfils every element in the same way as a user posting under a real name. The difference lies in proving who used the account, which is a question of evidence, not a question of whether an offense was committed.
When the post is on a public page or in a group open to many people, the act also amounts to defamation by publication under Section 328 of the Criminal Code, which carries a heavier penalty than Section 326. This section is explained in the article Defamation by publication under Section 328 (Thai). A charge under Section 14 of the Computer-related Crime Act2 must be considered separately, because Section 14 (1) expressly excludes defamation under the Criminal Code. A charge under that Act therefore depends on whether the statement is distorted, forged or false computer data of another kind described in Section 14. The relationship between the two laws is explained in the article Defamation and the Computer-related Crime Act (Thai).
A statement that does not name the injured person directly can still be defamatory if readers understand whom it refers to. Many avatar accounts refer to the injured person by a nickname, a job title or details known to people in the same circle. This point is explained in the article Is a post that insults someone without naming them defamation?
The injured person can file a complaint at once even without knowing who uses the avatar account. Section 2 (7) of the Criminal Procedure Code defines a complaint as an allegation that an offense has been committed, whether or not the offender is known. Defamation is a compoundable offense, and the inquiry official may conduct an inquiry only once a complaint has been made, under Section 121, paragraph two.
Section 2 (7) of the Criminal Procedure Code defines a “complaint” as an allegation made by the injured person to an official that an offense has been committed, “whether or not the offender is known”, which has caused damage to the injured person, with the intention that the offender be punished.3 This wording directly answers the question most often asked by people defamed by avatar accounts. Not knowing the poster’s name does not make the complaint defective. The injured person may identify the accused as the user of the named account, together with the URL of the account and of the post.
The complaint is especially important in defamation cases because defamation is a compoundable offense. Section 121, paragraph two of the Criminal Procedure Code provides that “in the case of a compoundable offense, no inquiry shall be made unless a complaint has been duly lodged”.4 In practice, before a complaint is made the inquiry official has no basis to begin an inquiry, and there is no case on which to ask competent officials under the Computer-related Crime Act to call for data from service providers. Waiting until the offender is known before filing a complaint therefore means the tracing mechanism never starts.
A complaint stating only that “someone insulted me on Facebook” is not enough. The complaint must show an intention that the offender be punished. A daily-log entry made only for the record may not count as a complaint, so the injured person should state clearly that they wish to pursue the case. The difference between a complaint and a daily-log entry is explained in the article How to file a police complaint for online defamation (Thai).
The period for filing a defamation complaint is three months under Section 96 of the Criminal Code, running from the date on which the injured person knows of the offense and knows the offender. Supreme Court Judgment No. 1011/2532 holds that both kinds of knowledge must exist together and that the period does not run from the date of the post, but everything remains subject to the limitation periods in Section 95.
Section 96 of the Criminal Code provides that, in the case of a compoundable offense, if the injured person does not lodge a complaint “within three months from the date on which the offense and the offender became known to the injured person”, prosecution is barred by prescription.5 The Supreme Court explained this wording in Supreme Court Judgment No. 1011/2532: the three months run from the date on which the injured person knows of the offense and knows the offender, “both together”, and the law does not provide for the period to run from the date on which the defendant committed the offense.6 Supreme Court Judgment No. 1086/2552 applies the same principle the other way round: where the injured person learned of the offense and of the offender on the same day and neither lodged a complaint nor filed a case within three months, the case was barred.7
This principle bears directly on avatar-account cases. For an injured person who has seen the post but does not yet know who uses the account, the three-month period has not started. It starts once the offender is known, for example on the date the inquiry official reports the results of the check of data from the service provider, or the date the offender admits the act. There are, however, three exceptions and cautions.
First, Section 96 opens with the words “subject to Section 95”. Even if the three-month period has not started, the case must still fall within the limitation period for criminal prosecution under Section 95, which runs from the date of the offense and varies with the penalty. Not knowing the offender therefore does not extend the time indefinitely.
Second, “knowing the offender” is a fact that must be proved. If the injured person has said elsewhere that they know whose account it is, for example in a reply post naming someone or in telling other people, the accused may rely on that conduct to argue that the injured person knew the offender from that date. This risk can be avoided by lodging a complaint within three months from the date the post was seen, without waiting to be certain who uses the account, because Section 2 (7) already allows a complaint to be made.
Third, the three-month period concerns the complaint, or a case filed by the injured person directly. Once a complaint has been lodged in time, Supreme Court Judgment No. 1011/2532 held that even if the case is filed after three months, it is not barred so long as it is still within the limitation period under Section 95, as shown in the summary of the judgment quoted in note 6.
The user of an avatar account is traced through the powers of competent officials under Section 18 of the Computer-related Crime Act, who may call for computer traffic data and subscriber information from service providers. An inquiry official may ask them to use this power in a defamation case under Section 18, paragraph two, and service providers must retain the data for not less than ninety days under Section 26.
Section 18, paragraph one gives competent officials powers “only as necessary for the purpose of using them as evidence relating to the commission of an offense and of identifying the offender”. Three of these powers bear directly on avatar accounts: (1) to send a written inquiry to, or summon, persons involved to give statements or submit evidence; (2) to call for computer traffic data from a service provider; and (3) to order a service provider to deliver subscriber-related information that must be retained under Section 26, or to preserve that information in advance.8 The powers in (4) to (8), such as accessing or seizing a computer system, require an application to the court for an order of permission under Section 19 first.
Defamation under the Criminal Code is not an offense under the Computer-related Crime Act, but Section 18, paragraph two already covers it. The provision applies “in respect of criminal offenses under other laws in which a computer system, computer data or a computer data storage device has been used as an element or as part of the commission of the offense”, and in such cases the inquiry official may ask competent officials to act under paragraph one, as set out in note 8. Defamation committed through Facebook or another platform therefore meets this condition. Section 18, paragraph three requires a person who receives a request under (1), (2) and (3) to act without delay, and in any event within seven days from receipt of the request, or within a period set by the competent official of not less than seven days and not more than fifteen days.
The data used for tracing does not last indefinitely. Section 26, paragraph one requires service providers to “retain computer traffic data for not less than ninety days from the date on which the data entered the computer system”, and where necessary a competent official may, as a special case, order retention for more than ninety days but not more than two years. Paragraph two requires subscriber information, to the extent necessary to identify the subscriber, to be retained for not less than ninety days after the service ends.9 Ninety days is a minimum. A provider may keep data longer under its own policy, but the injured person should not count on that. Once more than ninety days have passed, the chance that the traffic data for that post still exists diminishes.
A practical limitation to keep in mind is that these provisions confer powers on competent officials; they do not give the injured person a right to obtain data from service providers directly. The Act contains no provision allowing a private injured person to apply to the court to compel a service provider to disclose the poster before filing a case. Many large platform providers are also located outside Thailand, so obtaining data from them depends on each provider’s policy on responding to requests and on channels of cooperation between authorities, and the time taken is uncertain. The injured person should therefore prepare other evidence in parallel, as explained in the next section.
Proving who uses an avatar account relies on electronic data, which is admissible in evidence under Section 11 of the Electronic Transactions Act, together with circumstantial evidence such as data from service providers, the telephone number or email linked to the account, facts known only to a few people, and the offender’s admission. The court weighs this evidence according to how reliably the data was generated and stored.
Section 11, paragraph one of the Electronic Transactions Act B.E. 2544 (2001) (พระราชบัญญัติว่าด้วยธุรกรรมทางอิเล็กทรอนิกส์ พ.ศ. 2544) provides that “the admission of electronic data as evidence in legal proceedings, whether in a civil case, a criminal case or any other case, shall not be denied solely on the ground that it is electronic data”, and paragraph two requires its weight to be assessed by considering the reliability of the manner in which it was generated, stored and kept complete, and “the manner or method used to identify or indicate the sender of the data”.10 This last part goes to the heart of an avatar-account case. A screenshot of the post proves that the statement was published but not who sent it. Evidence linking the account to a person must therefore come from other sources taken together.
Evidence linking an account to a person falls into four groups. The first is data from service providers obtained by competent officials under Section 18, such as the IP address, log-in times, and the telephone number or email used to verify the account, followed by inquiries to the internet service provider to identify the subscriber at that time. The second is information appearing on the account itself, such as photos taken at a person’s premises or with a person’s device, the accounts it follows or is followed by, and posting times that match that person’s routine. The third is content known to only a few people, such as details of an internal meeting or wording in a document to which few people had access. The fourth is the offender’s admission, whether during negotiation, in private messages or at the inquiry stage.
Circumstantial evidence in the second and third groups carries limited weight on its own, because inferences drawn from writing style or knowledge of events can point to the wrong person. In a criminal case the prosecution must prove to the court’s satisfaction that the defendant actually used the account; if reasonable doubt remains, the court gives the defendant the benefit of the doubt. Evidence obtained from service providers is therefore usually the principal evidence that allows an avatar-account case to proceed. How to capture complete screenshots and URLs is explained in the article Collecting evidence of online defamation.
A person defamed by an avatar account should preserve evidence together with the URLs of the post and the account, lodge a complaint within three months from the date the post was seen under Section 96 of the Criminal Code without waiting to identify the poster, ask the inquiry official to use the route under Section 18 of the Computer-related Crime Act before the data under Section 26 expires, and refrain from publicly naming the suspected person.
On the civil side, Section 423, paragraph one of the Civil and Commercial Code (ประมวลกฎหมายแพ่งและพาณิชย์) makes a person who “asserts or circulates as a fact that which is contrary to the truth, to the injury of the reputation or credit of another” liable to pay compensation.11 Under Section 448, paragraph one, the claim is barred after one year from the day the injured person “knew of the wrongful act and of the person bound to make compensation”, or ten years from the day the wrongful act was committed, and paragraph two applies the criminal limitation period if it is longer.12 This structure mirrors Section 96 on the criminal side: not knowing the offender keeps the short period from starting, but there is a long outer limit counted from the date of the act. The calculation of damages is explained in the article Damages in defamation cases (Thai).
A person accused of using an avatar account has two levels of defense. The first is that they are not the user of the account, or did not post at the relevant time, for example because the device or account was shared. The second is that, even if they posted, the statement was an expression of opinion in good faith under Section 329 of the Criminal Code, or that the case is barred under Section 96.
The identity of the offender is the first issue to examine. IP data points to an internet subscriber or a network, which may be shared by many people, such as an office or home network. An account linked to someone’s telephone number may be accessed by others if the password has leaked. These facts must be supported by evidence; a bare denial carries little weight against data from service providers.
The content of the statement is the second issue. Section 329 of the Criminal Code provides that whoever, in good faith, expresses any opinion or statement in the cases listed, such as “by way of self-justification or defense, or for the protection of a legitimate interest” or “by way of fair comment on any person or thing subjected to public criticism”, is not guilty of defamation.13 Using an avatar account does not take away the right to raise this defense, but the court may consider the choice to conceal one’s identity together with the wording and other circumstances in deciding whether the person acted in good faith. Limitation is the third issue. The accused should check when the injured person came to know the offender, applying the principle in Supreme Court Judgment No. 1086/2552. What to do on receiving a summons is explained in the article Accused of online defamation: what to do (Thai).
England allows an injured person to seek a Norwich Pharmacal order requiring a website operator to disclose an anonymous poster, as in Totalise v Motley Fool. Japan allows the injured person to request disclosure of sender information directly from the provider under Article 5 of a specific statute. The United States protects anonymous expression, as in McIntyre. Thailand relies mainly on the powers of competent officials under Section 18.
In England, the Court of Appeal in Totalise plc v The Motley Fool Ltd [2001] EWCA Civ 1897 considered a first-instance order requiring the operators of an investment discussion board to disclose an anonymous poster who had posted statements defamatory of the applicant company. Orders of this kind rest on the House of Lords’ decision in Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133, under which the court may order a person who has become involved in another’s wrongdoing, without being a wrongdoer, to disclose the identity of the wrongdoer. The issue on appeal was costs. The court held that the applicant should bear the costs of the application in the first instance and recover them from the wrongdoer later, not from the website operator, which had done nothing wrong.14
In Japan, Article 5, paragraph 1 of the Act on Responses to Infringement of Rights Caused by the Distribution of Information through Specified Telecommunications allows a person who claims that their rights have been infringed to ask the service provider to disclose sender information (発信者情報) when two conditions are met: it is clear that the distribution of the information infringed the requesting person’s rights, and the sender information is necessary for exercising a claim for damages or there is another legitimate reason for receiving disclosure.15 Japanese law thus gives the private injured person a direct right and sets the conditions to be proved in the statute itself.
In the United States, the Supreme Court in McIntyre v. Ohio Elections Commission, 514 U.S. 334 (1995) held that a state law prohibiting the distribution of anonymous political campaign literature violated freedom of speech, stating that “Anonymity is a shield from the tyranny of the majority”.16 The case concerned political leaflets, not defamation, and it does not protect defamatory statements, but it shows that US law gives great weight to the value of anonymity. Unmasking an anonymous poster in a US defamation case therefore requires balancing the injured person’s rights against freedom of expression.
| Issue | Thailand | England | Japan |
|---|---|---|---|
| Who initiates the request for the poster’s identity | Competent officials under Section 18 of the Computer-related Crime Act, at the request of the inquiry official | The injured person applies to the court (Norwich Pharmacal order) | The injured person requests the provider directly under Article 5 of the specific statute |
| Main condition | Only as necessary for evidence and for identifying the offender | The respondent became involved in the wrongdoing and the order is necessary for a remedy | The infringement of rights is clear and there is a legitimate reason, such as a damages claim |
| Effect for the injured person | A complaint must be lodged before the process can begin | Available in civil proceedings without a criminal case | Available in civil proceedings without a criminal case |
This comparison explains why an injured person in Thailand should lodge a complaint promptly even before the offender is known. In England and Japan the injured person has a civil route of their own. In Thailand the main route is tied to the criminal process and the powers of competent officials, so the complaint both preserves the right within the limitation period and opens the route to tracing.
Law and economics explains that anonymity lowers the probability that the offender will be punished and so weakens the deterrent effect of the law under Becker’s model. Nagin’s work indicates that the certainty of punishment deters more than its severity. The tracing mechanisms in Sections 18 and 26 of the Computer-related Crime Act therefore matter more than raising penalties.
Gary Becker proposed in 1968 that offenders decide by comparing the benefit gained with the expected cost, which equals the probability of being caught and punished multiplied by the severity of the punishment.17 An avatar account lowers the probability term in this equation in the offender’s eyes. Even though the penalties under Sections 326 and 328 remain the same, the cost the offender expects falls. Daniel Nagin reviewed deterrence research in 2013 and concluded that the empirical evidence supports a deterrent effect of the certainty of apprehension more than of the severity of punishment.18 Applied to avatar-account cases, the retention period under Section 26, the response period under Section 18, paragraph three, and the speed of the complaint are the variables that determine the probability that the offender will be identified.
In psychology, John Suler described the online disinhibition effect in 2004 and identified dissociative anonymity as one factor that leads users to separate their online behavior from their real identity and to use harsher language than they would face to face.19 This observation explains why statements from avatar accounts are often severe and repeated, and why identifying the user in one case often changes the behavior of other accounts in the same group as well.
In legal philosophy, anonymity has value in two directions. On one side it is a shield for minority speakers, as the US Supreme Court said in McIntyre, drawing on the ideas of John Stuart Mill. On the other side it is a way to evade liability for damaging another person’s reputation. Thai law does not prohibit pseudonyms, limits the powers in Section 18 to what is “necessary”, and requires court permission for the more intrusive powers under Section 19. This structure balances the two values. Disclosure of identity thus occurs when an offense is alleged and disclosure is necessary for the case, not because someone simply wants to know.
Eksiam Chaisorn and the team of Eksiam & Partners Co., Ltd. advise people defamed by avatar accounts, from preserving evidence and preparing a complaint that identifies the account and the post precisely to following up requests for data under Section 18, and also advise people accused of using an avatar account on examining the evidence of who the offender is.
Frequently asked questions about avatar accounts and anonymous accounts cover what an avatar account is, filing a complaint without knowing the poster’s name, tracing the poster, the limitation period, how long service providers retain data, naming the suspected person, and claiming damages. The answers cite Sections 96 and 326 of the Criminal Code, Sections 2 (7) and 121 of the Criminal Procedure Code, and Sections 18 and 26 of the Computer-related Crime Act.
The texts of Sections 18, 19 and 26 of the Computer-related Crime Act B.E. 2550 (2007) were checked word for word against the legal database of the Office of the Council of State (searchlaw.ocs.go.th), latest consolidated version, on 23 October 2026. Sections 96, 326 and 329 of the Criminal Code, Sections 2 (7) and 121 of the Criminal Procedure Code, Section 14 of the Computer-related Crime Act and Section 11 of the Electronic Transactions Act were checked against the same database on 2 October 2026. Sections 2 (7) and 121 of the Criminal Procedure Code and Sections 423 and 448 of the Civil and Commercial Code were checked again word for word against the same database on 8 November 2026. Supreme Court Judgments Nos. 1011/2532 and 1086/2552 were checked against the Supreme Court judgment database (deka.supremecourt.or.th), and a search of the same database on 23 October 2026 using the Thai terms for “avatar”, “IP address”, “fake Facebook account” and “Facebook account name” found no Supreme Court judgment deciding directly on identifying the user of an avatar account in a defamation case, so none is cited. Totalise was read from a full copy of the judgment and is summarized without verbatim quotation. The Japanese statute was read from e-Gov Laws Search. McIntyre was read from the text reproduced from the United States Reports. Bibliographic details of the academic works were checked against Crossref in the firm’s verified source register. English renderings of Thai and foreign texts on this page are the author’s translations, not official translations. This page is a translation for information. The Thai text prevails.
Tel. · +66 81 654 5922 · contact@eksiamlegal.com · Consult via LINE
Consult us now
Whichever side of a defamation case you are on, we are ready to listen and help you assess your options
If a post, review, or message has damaged your reputation or your business’s, preserve the evidence before the statement is edited or deleted, and note that a criminal complaint for defamation must be lodged within three months from the date you learned of the offense and of the identity of the offender.
☎ Call 081 654 5922If you have received a summons or a formal notice, or are concerned that something you have already posted could become a case, reviewing the facts and the evidence before you give a statement or negotiate will let you see all of your options.
☎ Call 081 654 5922Send the details of your matter directly by email. You may attach supporting documents; there is no form to fill in.
contact@eksiamlegal.comMonday–Friday 09:00–18:00 · Your information is kept confidential