The short answer
Privacy, cookie, consumer, AI-transparency and accessibility laws apply to an app from its first real user, however it was built. AI builders write working code, not compliant code. SafeLaunch reads the live site or repository, tests it in a real browser and checks it against 138 laws in 54 markets, citing the law and the exact fix for every finding.
Key takeaways
- The law applies to what your product does, not to how long it took to build. A weekend app collecting emails is processing personal data on day one.
- AI builders reliably add analytics, sign-up forms, payments and AI features. Each one pulls in specific legal duties that the builder does not flag.
- The most common launch gaps are trackers loading before consent, a missing or generic privacy notice, unprotected database tables, missing AI disclosures and inaccessible forms.
- SafeLaunch checks a link, repository, .zip or app package against 138 laws in 54 markets, with a free scan in about a minute.
- A report is evidence-backed guidance, not legal advice or a certificate of compliance.
On this page
- 1. What is vibe coding, and why does it change compliance?
- 2. Which laws apply to an app built in a weekend?
- 3. The six compliance gaps AI builders leave behind most often
- 4. How does SafeLaunch check a vibe-coded app?
- 5. A pre-launch legal checklist for vibe coders
- 6. What SafeLaunch is, and what it isn't
- 7. How to check your app today
01
What is vibe coding, and why does it change compliance?
Vibe coding is building software by describing what you want to an AI builder (Lovable, Bolt, v0, Replit) or an AI coding agent (Cursor, Claude Code, Windsurf) and letting it write most of the code. A founder with no engineering team can go from idea to a live product with sign-up, payments and an AI feature in a weekend.
That speed removes the step where legal questions used to come up. In a traditional build, a product manager, an engineer and sometimes a lawyer would ask what data a form collects, which vendors receive it and what the cookie banner does. In a vibe-coded build, those decisions are made by the model in seconds, often silently, and the founder sees only the finished screen.
02
Which laws apply to an app built in a weekend?
Most privacy and consumer laws apply based on who your users are and what you do with their data, not on company size or launch date. Some laws have thresholds (several US state privacy laws, for example), but the EU and UK GDPR, cookie rules and accessibility duties have no minimum revenue. An app that is open to visitors in Europe and collects an email address is in scope.
| What the app does | Laws that commonly apply | What they require |
|---|---|---|
| Collects emails or accounts | GDPR, UK GDPR, CCPA/CPRA, India DPDP Act, Brazil LGPD | A lawful basis, a clear privacy notice, access and deletion rights, security |
| Runs Google Analytics, Meta Pixel or Hotjar | ePrivacy Directive Art. 5(3), UK PECR, GDPR | Prior consent for non-essential cookies and trackers, a real Reject option |
| Has a chatbot or AI-generated content | EU AI Act Art. 50, GDPR Art. 22, FTC Act §5 | Tell people they are talking to AI; no misleading AI claims |
| Sells a subscription | FTC Act §5 and ROSCA, EU Consumer Rights Directive, Australian Consumer Law | Clear pricing and renewal terms, easy cancellation, withdrawal rights |
| Sends marketing email | CAN-SPAM, CASL, UK PECR, Australia Spam Act | Consent where required, sender identity, a working unsubscribe |
| Has forms and buttons | ADA Title III, European Accessibility Act, WCAG 2.2 AA | Labelled fields, keyboard access, visible focus, sufficient contrast |
SafeLaunch keeps this mapping in a versioned rulebook of 138 laws and standards across 54 markets, from GDPR and the CCPA to India's DPDP Rules 2025, the EU AI Act and WCAG 2.2. See the full coverage map.
03
The six compliance gaps AI builders leave behind most often
These are patterns, not a criticism of any builder. They come from the way generated code is assembled: popular libraries, default configurations and copy that reads well but promises things the code doesn't do.
- 01
Trackers that load before anyone agrees
An analytics or ad script is pasted into the page head and fires on first load. A cookie banner may appear, but the tracking has already happened, and clicking Reject often changes nothing.
- 02
A privacy notice that describes someone else's product
A generated or template notice lists vendors you don't use and leaves out the ones you do (your email provider, your AI model API, your payment processor). Regulators treat a notice that contradicts actual practice as a transparency failure.
- 03
Database tables anyone can read
Backend-as-a-service databases are only as private as their access rules. A table created without row-level rules, or with a public read rule left from testing, can expose every user's records to anyone with the public key that ships in the browser.
- 04
Secrets in the client bundle
API keys for AI models, payment providers or email services end up in front-end code, where any visitor can copy them.
- 05
AI features with no disclosure
A support chatbot answers as if it were a person, or AI-generated images and text are presented without a label. The EU AI Act's transparency duties under Article 50 apply from 2 August 2026.
- 06
Forms a keyboard can't complete
Placeholder text used instead of labels, custom dropdowns that trap focus and low-contrast buttons. These fail WCAG 2.2 AA, the benchmark for the European Accessibility Act and most ADA website claims.
04
How does SafeLaunch check a vibe-coded app?
SafeLaunch was built for the way people ship now. You give it what you have: a live link, a GitHub repository, a project .zip exported from your builder, or an iOS or Android app package. It looks at the product first and answers what it can see itself, then asks only the questions a scan can't settle, in plain English.
- 01
Read the product
Legal pages first, then sign-up, contact and checkout pages. Every form field is traced to what it collects. In code, it looks for exposed secrets, database access rules, AI calls and third-party services. Secrets are redacted before anything is stored, and source code isn't kept after the scan.
- 02
Visit it in a real browser
For websites, a real browser records which cookies are set and which requests leave the page before any choice, after Reject and after Accept, then tests the page against WCAG 2.2 AA. See why the real-browser test matters.
- 03
Map the facts that decide which laws apply
Vendors, data collected, where the business appears to be based, and what the product offers: subscriptions, AI features, user posts, age-restricted content.
- 04
Run the rulebook, market by market
Fixed checks run first so the same version always gets the same core result. Then every requirement of the 138 laws in your chosen markets is tested, with size thresholds applied and the reason recorded.
- 05
Expert AI analysis with a second opinion
On paid audits, a frontier model works through requirements fixed checks can't settle. Every finding must quote the text or code it relies on, and a model from a different AI lab reviews each one and can reject it.
- 06
A cited report with the fix
A score per market, every finding cited to the article or section, and the exact change. Launch Fix adds code changes and copy-paste prompts for your builder. See how findings become prompts.
138
laws and standards
54
markets
~1 min
free scan
7
AI builders with tailored prompts
05
A pre-launch legal checklist for vibe coders
Whether or not you use SafeLaunch, work through this list before you share the link publicly. Each item maps to a check in the SafeLaunch rulebook.
- 1List every third-party service your app sends data to: analytics, ads, email, payments, auth, AI model APIs, error tracking, chat widgets.
- 2Make the privacy notice match that list. Name the data you collect, why, who receives it, how long you keep it and how people can exercise their rights.
- 3Block non-essential trackers until consent for visitors in the EU, UK and other opt-in markets, and make Reject as easy as Accept.
- 4Check every database table's access rules. A signed-in user should only read their own rows; anonymous visitors should read nothing private.
- 5Move secret keys server-side. Only publishable keys belong in front-end code.
- 6Label AI. Say when users are talking to a chatbot, and mark AI-generated media where the law requires it.
- 7Publish clear terms and refund rules if you charge, including renewal and cancellation for subscriptions.
- 8Add an unsubscribe link and sender details to every marketing email.
- 9Tab through your sign-up and checkout with the keyboard only. Every field needs a visible label.
- 10Record what you checked and when. If a regulator, app store or investor asks, a dated record of the version you launched is far more useful than memory.
06
What SafeLaunch is, and what it isn't
What SafeLaunch does
- Reads your live site, code or app package and records the evidence
- Cites the law and article behind every finding, per market
- Writes the fix: code changes, builder prompts and draft policies
- Signs a version-locked record of the exact commit or upload checked
What it doesn't do
- Give legal advice or act as your lawyer
- Certify that a product is compliant
- See behind log-ins, submit forms or run payments on a URL scan
- Verify contracts, staff processes or how vendors are configured
For decisions with real legal risk, such as health data, children's services, regulated professions or a regulator's letter, use the report as the starting brief for a qualified lawyer. An optional expert review adds a privacy professional's written memo on any paid report.
07
How to check your app today
Sign in with Google or email and paste your link. The free scan takes about a minute and shows what your product does, which legal pages exist, red/amber/green by area of law, the most serious problems and what already passes. Every account gets three free scans a month, no card needed. When you're ready to fix, Launch Report ($49) lists every finding in every market and Launch Fix ($149) adds the code and prompts. See pricing and a full sample report.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
FAQ
Frequently asked questions.
Sources and further reading
- GDPR Article 3: territorial scope
- GDPR Article 83: administrative fines
- ePrivacy Directive 2002/58/EC, Article 5(3)
- EU AI Act, Regulation (EU) 2024/1689 (Article 50)
- FTC: privacy and security guidance for businesses
- W3C: Web Content Accessibility Guidelines 2.2
This article is general information, not legal advice. SafeLaunch is automated software, not a law firm; a report records what was checked on one version and is not a certificate of compliance. Read the disclaimer.
From the founder
SafeLaunch is built by Raghav R Handa, a lawyer-turned-builder in New Delhi. He writes about this topic in plain English:
See what SafeLaunch finds on your product.
Paste a link and get your score, the most serious problems and what already passes, in about a minute.
Keep reading