The short answer
A Claude Code app has the same legal duties as any other app: a privacy notice that matches what it collects, consent before non-essential tracking in markets that require it, secure data with access rules, an AI disclosure if it has a chatbot, and accessible forms. SafeLaunch checks a Claude Code app against 138 laws in 54 markets and writes the fixes as prompts for Claude Code.
Key takeaways
- Claude Code is Anthropic's agentic coding tool that works in your terminal and repository. The law applies to what your app does, not to the tool that built it.
- The usual gaps: trackers before consent, a privacy notice that doesn't name your real vendors, open database tables, secret keys in the browser, missing AI disclosures and unlabelled form fields.
- Tell Claude Code the rules once, in CLAUDE.md in the repository root (Claude Code reads it at the start of every session), to prevent most of these gaps.
- SafeLaunch recognises Claude Code projects from a CLAUDE.md file in the repository, and writes every fix as a prompt for Claude Code.
- Start with a free scan: your score, the most serious problems and what already passes, in about a minute.
On this page
01
What does a Claude Code app collect, and which laws apply?
Claude Code is Anthropic's agentic coding tool that works in your terminal and repository. Projects typically use whatever your repository uses; it reads and edits files, runs commands and follows the project instructions in CLAUDE.md. Whatever the stack, the features people ask for most each pull in specific legal duties:
| Feature you asked for | Laws that commonly apply | What they require |
|---|---|---|
| Sign-up, waitlist or contact form | GDPR, UK GDPR, CCPA/CPRA, India DPDP Act, Brazil LGPD | A notice at collection, a lawful basis, access and deletion rights, security |
| Analytics, ad pixels or session replay | ePrivacy Directive Art. 5(3), UK PECR, CCPA | Consent before non-essential tracking in the EU and UK; an opt-out of sharing in California |
| Chatbot or AI-generated content | EU AI Act Art. 50, California BOT Act, Korea AI Basic Act | Tell people they are talking to AI; label AI-generated content where required |
| Payments or subscriptions | FTC Act §5 and ROSCA, EU Consumer Rights Directive, PCI DSS | Clear price and renewal terms, easy cancellation, no card data on your own pages |
| Marketing email | CAN-SPAM, CASL, UK PECR | Consent where required, sender details, a working unsubscribe |
| Any page with forms or buttons | ADA Title III, European Accessibility Act, WCAG 2.2 AA | Labelled fields, keyboard access, visible focus, sufficient contrast |
02
The most common compliance gaps in Claude Code apps
- 01
Fixes that never get verified
An agent can apply ten fixes in a few minutes. The risk is believing they work. Ask for one commit per fix and for the project's tests after each, then re-check with SafeLaunch: the re-check matches findings by rule and shows which are no longer detected.
- 02
Trackers that load before consent
An analytics or ad tag added to the page head fires on first load. A banner may appear, but the tracking has already happened, and Reject often changes nothing. A SafeLaunch paid audit tests this in a real browser: before a choice, after Reject and after Accept. The free scan flags trackers it can see in the page source.
- 03
A privacy notice that describes a different product
Generated notices list generic vendors and miss the ones you use: your database host, email provider, payment processor and AI model API. The notice must match what the app does.
- 04
An AI feature with no disclosure
A support bot that answers like a person, or AI images without a label. The EU AI Act's Article 50 has required chatbot disclosure since 2 August 2026.
- 05
Forms a keyboard or screen reader can't complete
Placeholder text instead of labels, custom selects that trap focus, low-contrast buttons. These fail WCAG 2.2 AA, the benchmark for the European Accessibility Act and most ADA website claims.
03
How do I make Claude Code follow compliance rules automatically?
Add the rules below to CLAUDE.md, or to AGENTS.md if your team shares instructions across tools. These rules won't make an app compliant on their own, but they stop the most common gaps from being created in the first place.
# Compliance rules for this project (privacy, cookies, AI, accessibility, security)
- Never load analytics, advertising, session-replay or chat scripts before the
visitor accepts the matching cookie category. Reject must keep them off.
Put "Reject all" next to "Accept all" with equal prominence.
- Every form field must have a stated purpose. Don't add fields the feature
doesn't need. Every field needs a visible <label>.
- When adding a service that receives user data (email, payments, analytics,
AI model API, error tracking), list it so the privacy notice can be updated.
- Secret keys never go in front-end code or the repository. Only publishable
keys may reach the browser. Use server functions or environment variables.
- Every database table with user data has row-level access rules: users read
and write only their own rows; anonymous users read nothing private.
- Any chatbot or AI assistant says it is an AI in its header and first message.
- Marketing email needs recorded consent where required, sender details and a
working unsubscribe link.
- Subscriptions show price, renewal and cancellation terms before payment, and
cancelling is as easy as signing up.
- Keep interactive elements keyboard-accessible with visible focus, and text
contrast at least 4.5:1.04
What does a SafeLaunch fix prompt for Claude Code look like?
Every finding in a Launch Fix report comes with a prompt shaped for Claude Code. How to use it: Run claude in the project folder and paste. Each prompt ends with "Done when" checks so you know the fix worked.
Make this change. Read the relevant files first, keep the diff minimal, and run the project's checks afterwards.
Load Google Analytics only after the visitor accepts the "analytics" cookie
category. Set Google Consent Mode defaults to "denied" before any Google tag,
remove the tag that loads unconditionally, and initialise analytics from the
consent banner's accept callback. Add a "Reject all" button next to
"Accept all" with equal prominence, and remember the choice.
Done when:
- With no choice made, no analytics request is sent and no tracking cookie is set.
- After clicking Reject, no analytics or advertising tracker loads.
- A SafeLaunch scan of the next version no longer reports "Trackers load before consent".Launch Fix also writes a master prompt that works through every finding in order of severity, a patch file and draft policies. See how findings become prompts.
05
How do I check my Claude Code app with SafeLaunch?
- 01
Paste the live link, connect GitHub or upload a .zip
A live link gets the page checks, and on paid audits the real-browser cookie and accessibility test. A repository or .zip gets the code checks: exposed secrets, database rules, forms and AI calls. Both together see the most.
- 02
Answer only what the scan can't see
SafeLaunch pre-fills what it detects, such as sign-in, payments, AI features and where you're based, and asks the rest in plain English.
- 03
Read your score per market
80 or above is Low risk, 55 to 79 Needs work, below 55 High risk. Read what the score means.
- 04
Paste the fixes into Claude Code and re-check
Resolved findings show as "no longer detected". Launch Fix includes one free re-check within 30 days.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- Claude Code documentation: memory and CLAUDE.md
- GDPR (EUR-Lex)
- EU AI Act, Regulation (EU) 2024/1689
- W3C: WCAG 2.2
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading