E-commerce-specific PDPA (個資法) compliance — member consent at signup, cookie consent, order / payment data retention, DSAR (data subject access request) handling, and cross-border data transfer for TW merchants.
SkillScore96Maintained
Automatic
◆Legal & Contracts pack
Last verified 8/28/2026
What it changes
Passed 22 of 23 test cases with the skill, and 21 of 23 without it.
Without skill91%
With skill96%
Checks it passed that the model alone missed
Requires blocking non-essential tracking scripts until user consent is given.
1 fixed21 passed either way1 still failing0 broke
Pass-rate lift
+4 pp
Tokens
+22%
Agent turns
0%
Response time
+10%
Model gemini-3.6-flashMeasured 8/28/2026v122 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
A test case the skill fixed. Same model, same prompt, with and without the skill.
Prompt
A Taiwanese online shop embeds Facebook Pixel, Google Tag Manager, and TikTok Pixel across its store. During checkout, these scripts extract customer phone numbers and email addresses directly from form fields. What technical controls must be implemented to prevent unauthorized PII exposure to third-party scripts?
What was checked, without and with the skill
Checked
Without skill
With skill
Requires hashing sensitive personal identifiers prior to third-party script transmission.
Passed
Passed
Requires blocking non-essential tracking scripts until user consent is given.
Missed
Passed
case-08 · gemini-3.6-flash · 8/28/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md47 linessingle file
E-Commerce PDPA Compliance
STATUS: SKELETON — body pending.
When to use this skill
Designing member signup consent for a TW store
Building cookie-consent banner for TW traffic
Responding to DSAR (resident data subject access request)
Designing data-retention policy for order / payment data
Cross-border transfer (TW → AWS US / GCP APAC)
Do NOT use when
Generic PDPA / GDPR concepts → law-gdpr-pdpa
Marketing consent for LINE OA → tw-ecom-operations-line-oa
Core concepts
TODO: 個資法 §5 specific-purpose principle, 第八條 告知義務, 蒐集 vs 處理 vs 利用 split.
Decision tree
TODO: data flow → consent form design.
Implementation guidance
TODO: consent form template, DSAR SOP, retention schedule, cross-border transfer assessment.