Post

You can vibecode a website in an afternoon now. Lovable, Bolt, v0, Cursor: prompt in, live site out. The prompt never asks one question though: is this legal in the EU? What AI-built sites tend to get wrong 🧵

The models learned from a web built on US defaults. So generated sites often ship Google Analytics in the head, fonts from a third-party CDN and a cookie banner that is pure decoration. It looks fine. It breaks the rules on the first page load.

Banners first. Since April 2025 the Dutch privacy regulator (AP) has warned 200+ sites. Three in four fixed it. The rest now face investigation or fines. Their test: do trackers stop after you click Reject? autoriteitpersoonsgegevens.nl/themas/internet-slimme-apparaten/cookies/tracking-cookies

Consent has to be an active choice. The CJEU settled in Planet49 (C-673/17) that pre-ticked boxes don't count. A banner with only an "OK" button, while scripts already fired on load, is exactly the pattern regulators flag.

Accessibility: since 28 June 2025 the European Accessibility Act covers B2C webshops and online services. Generated UIs love light grey text, unlabelled icon buttons and placeholder-only form fields. Micro-enterprises are exempt, but check the thresholds. eur-lex.europa.eu/eli/dir/2019/882/oj

Images: "add a hero photo" can pull in pictures nobody licensed. Rights holders send invoices of several hundred to a few thousand euros per image, and "the AI picked it" is not a defence.

Legal pages: the e-Commerce Directive (art. 5) requires your name, geographic address, email, trade register number and VAT number to be easy to find. A generated footer with a logo and a Calendly link doesn't cover that.

That's why I built TrustYourWebsite. Paste a URL and get 220+ checks on cookies, privacy, accessibility, security and image rights in about 2 minutes, with evidence. 9 in 10 sites scanned so far had high-risk issues. Free scan: trustyourwebsite.com