Here’s the part no AI tool warns you about while you’re shipping: the moment real users put their data into your app, you are the data controller under GDPR — regardless of whether you wrote a line of it. “The AI built it” is not a defence a data protection authority will accept.
And vibe-coded apps are unusually good at quietly collecting more than their founder realises: an analytics script here, a third-party widget there, an email field that ends up in a tool you forgot you connected. Each of those is personal data. Here’s where AI-built apps tend to break the rules.
1. The cookie banner that doesn’t actually block anything
The most common failure, and the one regulators now look for directly: a banner that looks compliant while the tracking and advertising scripts load anyway — before consent, or regardless of “reject”. European enforcement in 2026 increasingly checks whether your back-end data flows actually match what your banner claims. A consent UI that doesn’t truly gate the cookies is the textbook violation.
How to check: open your site in a private window, reject cookies, and watch the network tab. If Google/Meta/analytics requests fire anyway, your banner is decorative — not consent.
2. A privacy policy copied from someone else
A template that describes data flows your app doesn’t have — and omits the ones it does — is worse than none. It needs to reflect what your app actually collects, who you actually share it with, and where it actually goes. A real privacy policy — not a copied template — is a requirement, not a formality.
3. No data minimisation
GDPR says collect only what you need. AI-generated forms and schemas love to grab everything — full name, phone, address, date of birth — “just in case”. Every field you store is a field you must justify, secure, and be able to delete.
4. No way to honour a deletion or access request
A user has the right to get their data, or have it erased. If your vibe-coded app has no admin path to find and delete one user’s records cleanly, you can’t comply — and the database might be wide open on top of that.
Why this is a security problem too
The through-line: GDPR compliance depends on knowing exactly what data your app touches and where it flows — which is the same thing a production-readiness review maps. The apps that leak data and the apps that breach GDPR are usually the same apps, for the same reason: nobody traced the data end to end before launch.
The fines are real — and so is the fix, which is mostly knowing what your app actually does with data before real users hand it over. That’s part of what a senior read gives you: a human traces your data flows, flags where the consent, collection and access don’t match the rules, and tells you what to close first. Built with AI, operated by a real company — and your users’ data is your responsibility either way.