Taiwan in the Privacy Map

Taiwan is a large, mobile-first market with strong demand for games and utility apps, so many publishers monetize traffic from it. Its main privacy law is the Personal Data Protection Act (PDPA), in force in its current form since 2012. Unlike the GDPR, it has no rule written specifically for cookies, so publishers apply its general principles to cookies and ad identifiers that count as personal data.

Core Principles

The PDPA rests on a few ideas you will recognize from other regimes:

• Specific purpose. Personal data may be collected and used only for a specified, legitimate purpose and within the scope necessary for it.
• Notice. When collecting personal data, you generally must tell people who you are, the purpose, the categories of data, how long and where it is used, and what rights they have.
• Consent or another lawful ground. For non-government organizations, collection and use need a lawful ground. Consent is one, and using data beyond the original purpose typically requires a new ground or consent.
• Individual rights. People can ask to inspect, correct, stop the use of, or delete their data.

What This Means for Cookies and Ad IDs

Whether a given cookie or device identifier is personal data depends on whether it can identify a person, alone or combined with other data. Behavioral advertising profiles tied to persistent identifiers will usually be treated that way in practice. A cautious approach is to treat advertising and cross-site tracking identifiers as needing prior notice and a clear opt-in, while strictly necessary cookies need only be disclosed.

Cross-Border Transfers

The PDPA lets authorities restrict international transfers in specific situations, for example where a recipient country lacks adequate protection or where the transfer is used to evade the law. If your ad vendors process Taiwanese users' data outside Taiwan, list them in your privacy notice and confirm what your contracts require.

Enforcement and a Changing Landscape

Enforcement has historically been shared among sector regulators and local governments, and amendments in recent years have aimed at creating a dedicated data protection authority. Because the institutional details have been shifting, check the current position with local counsel rather than assuming any one agency handles every case.

A Practical Setup

1. Show the banner in Traditional Chinese for Taiwanese visitors, with the purposes explained in plain language.
2. Keep non-essential tags blocked until the user opts in.
3. Name your vendors in the notice, including ad networks and measurement tools.
4. Offer a way to withdraw consent that is as easy as giving it.
5. Keep a record of what each visitor saw and chose.
6. Avoid collecting children's data for advertising; if your audience includes minors, apply stricter defaults.

Ad Revenue Considerations

Taiwan does not run a TCF-style regime, so most demand from global ad networks relies on their own policies. Many Google ad products still expect clean consent signals for traffic they treat as regulated, so a banner that records choices and passes them to your ad stack helps you keep monetizing while respecting user choice.

How FlexyConsent Helps

FlexyConsent's banner is available in 58 languages and works with Google Consent Mode v2, so you can show a localized banner and pass the consent state to Google tags. Confirm the banner setup that fits this market with your legal adviser.

Key Takeaways

• Taiwan's PDPA has no cookie-specific rule; its general notice, purpose and consent principles apply.
• Treat advertising and cross-site identifiers as needing notice and a clear opt-in.
• Cross-border processing by vendors should be disclosed and contractually covered.
• The enforcement structure has been evolving, so verify the current position locally.
• A localized banner that blocks tags until choice is a sound baseline.