Vibe Coding and GDPR: Why Your AI-Built Site May Be Breaking the Law

AI coding agents like Claude Code and Codex ship working sites fast, but they quietly introduce GDPR violations you never asked for: cookies set before consent, personal data kept forever, no way for users to delete it. Here is why it happens across every coding agent, what it can cost you, and the free Claude Code skill that scans your project for GDPR issues and fixes them.

June 28, 2026

You describe an app to a coding agent, it writes the code, you deploy, and a few hours later you have a real product online. That is the promise of vibe coding, and most of the time it delivers. The site loads, the signup works, the dashboard looks clean. Everything you can see is fine.

The problem is everything you cannot see. While it was wiring up your features, the agent also made dozens of small decisions about cookies, tracking, data storage, and user rights. Nobody asked it to think about the law, so it did not. By the time you ship, your shiny new site may already be sitting on a pile of GDPR violations, and you have no idea they are there.

This is not a Claude problem or a Codex problem. It is a structural property of how AI coding agents work, and it applies to every one of them. Let us walk through exactly what goes wrong, what it can cost you, and the free Claude Code skill that finds and fixes these issues before a regulator does.

What an AI coding agent quietly gets wrong

A coding agent optimizes for one thing: making the feature work. Ask it for analytics and it drops in a tracking script. Ask it for a contact form and it stores every submission in a table. Ask it for a login and it keeps user records indefinitely. Each choice is reasonable in isolation. Together, they form a textbook list of the violations regulators sanction most often.

Here is what slips through on a typical vibe-coded site:

Cookies and trackers fire before consent. Analytics, embedded maps, fonts, social pixels, and session tools load the moment the page opens. Under GDPR and the ePrivacy rules, non-essential cookies need prior, freely given consent. A site that drops them on first paint is already non-compliant, and a cookie banner that only appears after the tracker has fired does not fix it.
Personal data is kept forever. The agent creates a users table, a submissions table, a logs table, and never adds a retention policy. GDPR requires that you keep personal data only as long as you actually need it. "Forever, just in case" is exactly the storage-limitation breach the law was written to stop.
There is no way to delete your data. Users have a right to erasure, the so-called right to be forgotten. Almost no vibe-coded app ships with a delete-my-account flow or a documented process to honor an erasure request. The data goes in and there is no door marked exit.
No access or portability path. People can ask for a copy of everything you hold on them. If your only answer is a manual database query you have never tested, you are not meeting the access and portability obligations.
Third-party data leaves the EU silently. That analytics script or hosted font you added in two seconds may ship IP addresses and identifiers to servers outside the EU with no legal transfer mechanism in place.
No record of what you collect. GDPR expects you to know and document your processing activities. An app whose data flows live only in the agent's forgotten chat history has no register at all.

None of this shows up in a demo. The app works perfectly. The legal layer is simply missing, and it stays missing until someone complains or a regulator comes knocking.

The agent fills the left column flawlessly. The right column is the part nobody asked it to build, so it stays empty.

Why every coding agent does this, not just Claude

It is tempting to blame one tool, but the cause runs deeper. Coding agents learn from public code, and most public code was never written with GDPR in mind. When a model has seen ten thousand examples of "add Google Analytics" that drop the script straight into the <head>, that is the pattern it reproduces. The training data encodes the bad habit, so the output inherits it.

There is hard data on the broader version of this problem. Veracode's 2025 GenAI Code Security Report tested output from more than 100 large language models across dozens of coding tasks and found that 45% of AI-generated code introduced a security vulnerability. The same study found AI-written code carried 2.74 times more vulnerabilities than human-written code, and, tellingly, that newer and larger models did not do better. This is structural, not a bug that the next release patches away.

Privacy compliance is the same shape of problem as security. Both are invisible requirements that the "make it work" objective walks straight past. So whether you drive Claude Code or Codex, Antigravity CLI, Cursor, or any other agent, you are exposed to the same blind spot. The tool changes, the gap does not.

What a GDPR violation can actually cost

This is where it stops being abstract. GDPR fines are capped at the higher of 20 million euros or 4% of worldwide annual turnover, and regulators have started using the upper end of that range.

In 2025 alone, France's data protection authority, the CNIL, handed down 486 million euros in fines, nearly ten times its 2024 total. Two decisions on a single day in September drove most of it: 325 million euros against Google for cookie and advertising-transparency failures, and 150 million euros against Shein for trackers dropped without consent. The exact categories of mistake an AI agent ships by default are the same categories drawing nine-figure penalties.

It is easy to read those numbers and assume regulators only chase giants. They do not. The CNIL runs a simplified procedure aimed squarely at small, factual cases: a non-compliant cookie banner, an ignored access request, a weak password policy. Those are bread-and-butter findings for a small business, and they are exactly what a vibe-coded site gets wrong. The size of your company changes the size of the fine, not whether you can be fined.

The headline fines hit large companies, but the violations behind them, cookies without consent and missing transparency, are the same ones a coding agent ships on a small site by default.

What GDPR actually asks for (in plain terms)

You do not need to become a lawyer to close most of the gap. The bulk of everyday compliance comes down to a handful of concrete behaviors your code either has or does not:

Consent before non-essential cookies. Nothing that tracks, profiles, or measures should run until the user has actively agreed. Strictly necessary cookies are the only exception.
A lawful basis for every bit of data you collect. Consent, contract, or legitimate interest, decided before you store anything, not after.
Data minimization. Collect only what the feature genuinely needs. The agent's instinct to log everything is the opposite of this.
Retention limits. Every category of personal data needs a defined lifespan and a way to delete it when that time is up.
The data subject rights. Access, rectification, erasure, and portability all need a real, working path, not a promise in a privacy policy.
A clear privacy notice and a record of processing. People should be able to see what you collect and why, and you should be able to prove it.

Read that list back against the section on what agents get wrong and the overlap is almost perfect. The good news is that because these are concrete, code-level behaviors, a tool can scan for them.

The fix: a free Claude Code skill that scans and repairs

Here is the part the manual checklist cannot give you: an automated pass over your actual codebase. A developer named Jeremy Longshore published a free, open-source Claude Code skill called scanning-for-gdpr-compliance (listed in some marketplaces as the GDPR Compliance Scanner) that does exactly this. It lives in the claude-code-plugins-plus repository and runs entirely inside Claude Code, so there is no separate service to sign up for.

The skill reads your project the way a privacy auditor would. It inspects data flows, storage locations, processing activities, consent mechanisms, retention policies, access controls, and how you handle data subject rights. Then it does three things that matter:

It detects. Rule-based checks flag the patterns above: trackers firing before consent, personal data with no retention limit, missing erasure paths, undocumented processing.
It classifies by severity. Findings come back scored and prioritized, so a tracker leaking identifiers outranks a missing line in your privacy notice. You fix the dangerous things first instead of drowning in a flat list.
It remediates in your code. Because it runs inside the agent, it does not just produce a report you have to act on later. It can implement the recommended changes directly, turning "you have a problem here" into an actual edit on the same pass.

Installing it is a one-liner. With the plugin marketplace you add the source and install the skill:

/plugin marketplace add jeremylongshore/claude-code-plugins-plus

Then trigger a scan in plain language. The skill responds to phrases like:

scan GDPR compliance
check data privacy
validate GDPR

You can also install it by dropping the skill folder into your project's .claude/skills/ directory, the standard way Claude Code discovers skills. Either way, the scan runs against your real repository, not a checklist in the abstract.

Codebase in, prioritized findings in the middle, real code edits out. The same loop you already use for features, pointed at compliance.

A fair word of caution, because honesty is part of trust here: a scan is not a legal sign-off. The skill catches the mechanical, code-level violations that make up most of the everyday risk, the cookies, the retention, the missing erasure flow, and it gets you dramatically closer to compliant in minutes. It does not replace a data protection lawyer for anything sensitive, a Data Protection Impact Assessment, or processing health data. Treat it as the technical first pass that removes the obvious breaches, then bring in human review for the edge cases.

Why this gets harder when you run a fleet of agents

One developer with one agent has one codebase to keep honest. The moment you run several agents in parallel, each shipping features into the same product, the surface area for quiet violations multiplies. One agent adds an analytics script, another spins up a logging table, a third wires in a third-party widget, and no single human ever reviewed the privacy implications of the whole.

This is the same reason context and consistency are hard at scale, a theme we keep coming back to whether the topic is running coding agents in parallel or vibe coding without drowning. The fix is the same in shape: make the standard part of the shared setup rather than something you remember to check at the end.

In AgentsRoom, the multi-agent cockpit, the skills and rules you configure once apply to every agent in the room, across Claude Code, Codex, and the other providers you drive from one place. Wire a compliance pass into your workflow once and every agent inherits it, instead of hoping each one independently remembers a rule nobody trained it on. The discipline that keeps a single session clean is what keeps a whole fleet out of regulatory trouble.

A practical compliance checklist for AI-built sites

Before you call any AI-built site done, run it against this list. Most of it the scanner will catch, but knowing what you are looking for makes the report readable:

No non-essential cookie or tracker fires before the user consents.
Every personal-data store has a defined retention period and a deletion mechanism.
Users can request and receive a copy of their data.
Users can delete their account and have their data erased.
A privacy notice explains what you collect, why, and on what legal basis.
Third-party scripts and data transfers outside the EU have a lawful mechanism.
You can produce a record of your processing activities if asked.

If you cannot tick every box, your AI-built site is carrying GDPR risk, and a single complaint is enough to surface it.

The takeaway

Vibe coding is genuinely fast, and that speed is the trap. The agent fills in everything you can see and skips everything you cannot, which is exactly where GDPR lives. Cookies before consent, data kept forever, no way to delete it: these are not exotic edge cases, they are the default output of every coding agent, and they are the same failures regulators fined to the tune of hundreds of millions of euros in 2025.

The fix is not to stop using agents. It is to add the missing pass. Run the free scanning-for-gdpr-compliance skill over your project, let it classify and repair the obvious breaches, then have a human review what is left. A few minutes of scanning is a lot cheaper than discovering the gap from a regulator's letter.

Building with more than one agent? Download AgentsRoom to run Claude Code, Codex, and more from a single cockpit, see what each one supports in the provider compatibility matrix, and read how to keep moving fast in vibe coding without drowning.