Post

You can vibecode a website in an afternoon now. Lovable, Bolt, v0, Cursor: prompt in, live site out. The prompt never asks one question though: is this legal in the EU? What AI-built sites tend to get wrong 🧵

25/10/26, 2:31 pm0 reposts1 like

Steven | TrustYourWebsite

@trustyourwebsite.com

The models learned from a web built on US defaults. So generated sites often ship Google Analytics in the head, fonts from a third-party CDN and a cookie banner that is pure decoration. It looks fine. It breaks the rules on the first page load.

Steven | TrustYourWebsite

@trustyourwebsite.com

Banners first. Since April 2025 the Dutch privacy regulator (AP) has warned 200+ sites. Three in four fixed it. The rest now face investigation or fines. Their test: do trackers stop after you click Reject? autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies/tracking-cookies

Steven | TrustYourWebsite

@trustyourwebsite.com

Consent has to be an active choice. The CJEU settled in Planet49 (C-673/17) that pre-ticked boxes don't count. A banner with only an "OK" button, while scripts already fired on load, is exactly the pattern regulators flag.

Steven | TrustYourWebsite

@trustyourwebsite.com

Accessibility: since 28 June 2025 the European Accessibility Act covers B2C webshops and online services. Generated UIs love light grey text, unlabelled icon buttons and placeholder-only form fields. Micro-enterprises are exempt, but check the thresholds. eur-lex.europa.eu/eli/dir/2019/882/oj