台灣個資法 PIPA 2026 修法：電商同意書範本更新與違規罰則逐條解析

1{
2  "consentForm": {
3    "version": "2.0.0",
4    "effectiveDate": "2026-07-01",
5    "locale": "zh-TW",
6    "collector": {
7      "name": "○○股份有限公司",
8      "registrationNumber": "統一編號：00000000",
9      "contactEmail": "[email protected]",
10      "dpo": "個資保護聯絡人：王小明"
11    },
12    "purposes": [
13      {
14        "id": "purpose_001",
15        "code": "040",
16        "label": "行銷業務",
17        "description": "用於寄送商品推薦、促銷活動通知及個人化廣告",
18        "required": false,
19        "dataCategories": ["C001", "C003", "C011"],
20        "retentionPeriod": "會員關係存續期間及終止後6個月",
21        "crossBorderTransfer": {
22          "enabled": true,
23          "countries": ["HK", "SG", "JP"],
24          "legalBasis": "當事人書面同意"
25        }
26      },
27      {
28        "id": "purpose_002",
29        "code": "148",
30        "label": "網路購物及其他電子商務服務",
31        "description": "用於處理訂單、出貨、退換貨及客戶服務",
32        "required": true,
33        "dataCategories": ["C001", "C002", "C003"],
34        "retentionPeriod": "交易完成後依商事法規保留5年",
35        "crossBorderTransfer": {
36          "enabled": false
37        }
38      }
39    ],
40    "rights": {
41      "access": true,
42      "correction": true,
43      "deletion": true,
44      "cessation": true,
45      "portability": false
46    }
47  }
48}

1import React, { useState } from 'react';
2
3interface ConsentPurpose {
4  id: string;
5  label: string;
6  description: string;
7  required: boolean;
8}
9
10interface ConsentRecord {
11  purposeId: string;
12  granted: boolean;
13  timestamp: string;
14  formVersion: string;
15}
16
17const PIPAConsentForm: React.FC<{ purposes: ConsentPurpose[] }> = ({ purposes }) => {
18  const [consents, setConsents] = useState<Record<string, boolean>>(
19    Object.fromEntries(purposes.map(p => [p.id, p.required]))
20  );
21
22  const handleSubmit = async () => {
23    const records: ConsentRecord[] = Object.entries(consents).map(
24      ([purposeId, granted]) => ({
25        purposeId,
26        granted,
27        timestamp: new Date().toISOString(),
28        formVersion: '2.0.0',
29      })
30    );
31
32    await fetch('/api/consent', {
33      method: 'POST',
34      headers: { 'Content-Type': 'application/json' },
35      body: JSON.stringify({
36        records,
37        userAgent: navigator.userAgent,
38        // 注意：IP 由後端記錄，不從前端傳送
39      }),
40    });
41  };
42
43  return (
44    <div className="pipa-consent-form">
45      <h2>個人資料蒐集同意書</h2>
46      <p>依據《個人資料保護法》第 7、8 條規定，請您詳閱以下各項目的說明後，分別勾選是否同意。</p>
47      {purposes.map((purpose) => (
48        <div key={purpose.id} className="consent-item">
49          <label>
50            <input
51              type="checkbox"
52              checked={consents[purpose.id]}
53              disabled={purpose.required}
54              onChange={(e) =>
55                setConsents((prev) => ({
56                  ...prev,
57                  [purpose.id]: e.target.checked,
58                }))
59              }
60            />
61            <strong>{purpose.label}</strong>
62            {purpose.required && <span className="required-badge">（履約必要）</span>}
63          </label>
64          <p className="purpose-description">{purpose.description}</p>
65        </div>
66      ))}
67      <button onClick={handleSubmit}>確認送出</button>
68    </div>
69  );
70};
71
72export default PIPAConsentForm;

1{
2  "status": "success",
3  "consentId": "cst_20260701_abc123",
4  "recordedAt": "2026-07-01T08:30:00.000Z",
5  "version": "2.0.0"
6}

1CREATE TABLE consent_audit_log (
2  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
3  user_id VARCHAR(255) NOT NULL,
4  purpose_id VARCHAR(50) NOT NULL,
5  purpose_code VARCHAR(10) NOT NULL,
6  granted BOOLEAN NOT NULL,
7  form_version VARCHAR(20) NOT NULL,
8  ip_address INET NOT NULL,
9  user_agent TEXT,
10  consent_text_hash VARCHAR(64) NOT NULL, -- SHA-256 of the consent text shown
11  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
12  revoked_at TIMESTAMPTZ,
13  revocation_reason TEXT
14);
15
16CREATE INDEX idx_consent_user ON consent_audit_log(user_id);
17CREATE INDEX idx_consent_purpose ON consent_audit_log(purpose_id);
18CREATE INDEX idx_consent_created ON consent_audit_log(created_at);

1// 在 GTM Custom HTML tag 中設定，於頁面載入時執行
2window.dataLayer = window.dataLayer || [];
3function gtag() { dataLayer.push(arguments); }
4
5// 預設全部拒絕，等待使用者互動
6gtag('consent', 'default', {
7  'ad_storage': 'denied',
8  'ad_user_data': 'denied',
9  'ad_personalization': 'denied',
10  'analytics_storage': 'denied',
11  'functionality_storage': 'granted', // 履約必要
12  'security_storage': 'granted',       // 安全必要
13  'region': ['TW']  // 僅對台灣用戶套用
14});
15
16// 使用者提交同意書後，根據各 purpose 的 granted 狀態更新
17function updateConsentFromPIPA(consentRecords) {
18  const marketingConsent = consentRecords.find(
19    r => r.purposeId === 'purpose_001'
20  );
21  
22  gtag('consent', 'update', {
23    'ad_storage': marketingConsent?.granted ? 'granted' : 'denied',
24    'ad_user_data': marketingConsent?.granted ? 'granted' : 'denied',
25    'ad_personalization': marketingConsent?.granted ? 'granted' : 'denied',
26    'analytics_storage': marketingConsent?.granted ? 'granted' : 'denied',
27  });
28}

1// ❌ 錯誤
2body: new FormData(formElement)
3
4// ✅ 正確
5body: JSON.stringify({ records, userAgent: navigator.userAgent })