A System Too Big to Call Experimental
At the Digital Trust Thailand 2026 conference in Bangkok on June 24, organized by the Electronic Transactions Development Agency (ETDA) with the FIDO Alliance and World Bank Group, ETDA formally unveiled Digital ID 2.0 — the next phase of a national identity system that has quietly become default infrastructure for public services (ETDA press release). The numbers explain why this matters beyond Thailand's borders: cumulative accounts across ThaID, Tangrat, Mor Prom, Paotang and NDID exceeded 162 million as of April 2026, and Digital ID now authenticates access to 1,797 government e-services spanning tax filing, civil registration and healthcare eligibility (Biometric Update).
Digital ID 2.0 extends that infrastructure to three groups the first phase left out: legal entities (businesses opening accounts or signing contracts digitally), foreign residents — an estimated 4-5 million people living and working in Thailand — and "vulnerable groups," a category that in Thai policy documents typically includes stateless persons, the elderly and migrant workers. This is not a pilot. It is the deliberate closing of the last gaps in a system already treated as load-bearing.
The Legal Architecture Is Thin by Design
Thailand regulates Digital ID through the Royal Decree on the Supervision of Regulated Digital Identification Authentication and Verification Service Businesses B.E. 2565 (2022), effective June 21, 2023. It requires any private or public operator providing identity verification, credential issuance, authentication, or Digital ID network services to obtain ETDA approval, backed by a risk management plan, data protection plan and security plan (Tilleke & Gibbins). As of mid-2026, ETDA has issued 28 licences to 23 organizations — a live regime, not a paper one, as confirmed by ETDA's own published licence for Ayudhya Capital Services under this framework (ETDA licence record).
The structural feature worth naming plainly: ETDA is simultaneously the agency promoting Digital ID adoption — it owns the growth targets, the conference, the 1,000-e-service goal for 2027 — and the agency licensing and supervising the operators that run it. There is no separate Digital ID privacy regulator sitting outside ETDA's chain of incentives.
Steelmanning the Caution
The strongest case for slowing down isn't hypothetical. Thailand has a documented history of biometric overreach: post-2014, security forces conducted dragnet DNA collection in the Malay Muslim-majority Deep South with minimal consent safeguards, and a 2019 SIM registration mandate tied phone service to facial recognition enrollment (Global Voices Advox). Civil society groups have reasonably asked what happens when a national identity layer this size — now explicitly reaching toward "vulnerable groups" who have the least practical ability to opt out or contest misuse — sits under an agency whose core mandate is expansion, not restraint. That is a fair question, not a strawman.
Why the Expansion Case Still Holds
But the counterfactual for excluded populations isn't "no data collection" — it's continued reliance on paper processes, in-person biometric checks at immigration and welfare counters, and informal verification with far less transparency or audit trail than a licensed digital credential leaves behind. Phase 1 (2022–2024) already demonstrated the inclusion case: digital ID users jumped from under 20 million to over 40 million once the October 2024 stimulus handout ran through the Pao Tang app, because a working digital identity was the fastest way to get cash to people who needed it (Biometric Update). Phase 2 targets 1,000 e-government services by 2027, up from roughly 400 — a scaling curve that only makes sense if adoption keeps compounding, which it will not do under a heavier, slower-to-license regulatory model.
The Fix Is Governance, Not a Pause
The proportionate response isn't to slow Digital ID 2.0's rollout to foreigners and vulnerable groups — it's to separate ETDA's promotional mandate from its supervisory one before the system gets larger still. A structurally independent audit function for Digital ID specifically — distinct from ETDA's growth KPIs, with public reporting on licensee compliance and breach incidents — would cost little relative to the 7.96 billion baht (~$237 million) already committed to the 2025 framework buildout, and it would answer the Deep South-era concern directly rather than deferring it. Thailand has built genuinely useful public infrastructure at a scale few countries can match. The risk isn't that Digital ID 2.0 exists; it's that the government that benefits most from its growth is also the one checking its own homework.