AI Builders / Vibe Coding
9 min read
What GDPR asks of you when you publish a ChatGPT Site
Under the ChatGPT Sites Terms, the owner of a published Site is the data controller and OpenAI only...
Read moreAdd consent in one line.
Apps built with Lovable, Bolt, v0 and Replit often load analytics before anyone agrees. Add one line of embed code to index.html and your app asks first.
The Free plan covers up to 5 sites and needs no credit card.
Why it matters
A banner that appears is not the same as a consent system. Generated apps often wire in tracking by default and leave the consent part to you.
Google Analytics and ad pixels can run on the first page view, before anyone has agreed. In the EU and the UK, cookies that are not strictly necessary need prior consent.
Generating the app with AI does not change who operates it. Privacy law looks to whoever runs the site, not to the tool that wrote the code.
In the EU and the UK, cookies that are not strictly necessary need prior consent, and California gives visitors a right to opt out. A generated app usually has neither a banner nor an opt-out.
Builders
The embed code is one line of HTML, so it works in any app that serves a web page. These are the builders people ask about most.
Lovable
React apps from a prompt
Bolt.new
Full-stack apps in the browser
v0
Interfaces from Vercel
Replit
Apps built by an agent
Cursor
An AI code editor
Windsurf
An agentic code editor
Base44
No-code AI apps
Firebase Studio
Google's AI workspace
Anything
Formerly Create.xyz
Databutton
AI data apps
Softgen
Web apps from a chat
Tempo
React apps, built visually
Claude Code
An agentic coding tool
GitHub Copilot
An AI pair programmer
Devin
An autonomous AI engineer
Trickle
An AI website builder
The same line works with any other builder, or with code you wrote yourself: it goes in the head of your page.
How it works
Your generated app needs one line. The rest happens in your Kukie.io dashboard.
Know what you shipped
The exact output changes with every builder release, but generated apps keep shipping the same kinds of third-party services, and most of them matter for consent.
| Category | Typical services in generated apps | What it means for consent |
|---|---|---|
| Platform analytics | Vercel Analytics, Netlify Analytics, Cloudflare Web Analytics | Varies: cookieless modes exist, but the added script still needs a review |
| Product analytics | Google Analytics 4, PostHog, Plausible, added when you ask for analytics | GA4 and PostHog set identifiers, which need consent in the EU and the UK |
| Error monitoring | Sentry and similar tools, added when you ask for monitoring | Collects session data: list it, and hold back the parts that are not essential |
| Back end and sign-in | Firebase and Supabase, with sign-in tokens and optional analytics | Sign-in cookies are strictly necessary. The bundled analytics are not |
| Fonts and embeds | Google Fonts, YouTube embeds, map widgets | Requests to third parties that pass on the visitor's IP address. A German court (LG München I, 20 January 2022, 3 O 17493/20) awarded damages over Google Fonts loaded from Google's servers |
We check what each builder generates and keep the results current in the 2026 AI builder cookie audit and the comparison of consent banners across builders.
Step-by-step guides for the most popular AI app builders.
AI Builders / Vibe Coding
9 min read
Under the ChatGPT Sites Terms, the owner of a published Site is the data controller and OpenAI only...
Read more
AI Builders / Vibe Coding
12 min read
OpenAI removed canvas from ChatGPT's models on 28 May 2026, so an app you built in it now sits on a...
Read more
AI Builders / Vibe Coding
9 min read
FlutterFlow web apps render compiled Dart onto a canvas, so the cookie banner has to live in the HTM...
Read more
AI Builders / Vibe Coding
8 min read
A Claude artifact hosted on claude.ai cannot set cookies, so no banner of yours is needed there. Emb...
Read more
AI Builders / Vibe Coding
9 min read
Bubble apps set authentication cookies on every visitor and load analytics, chat, and pixel scripts...
Read more
AI Builders / Vibe Coding
10 min read
Vercel, Netlify and Cloudflare Pages each add their own cookies and analytics to an AI-built app, in...
Read more
AI Builders / Vibe Coding
8 min read
AI builders ship a working frontend and a hosted database, but they do not generate consent, a priva...
Read more
AI Builders / Vibe Coding
10 min read
Apps from Lovable, Bolt, v0, Replit, Base44 and Firebase Studio set cookies and write to local stora...
Read more
AI Builders / Vibe Coding
9 min read
AI app builders rarely generate cookie consent, and the trackers they leave behind come from differe...
Read more
AI Builders / Vibe Coding
10 min read
None of the major AI app builders generates a GDPR cookie banner on its own. By default, Lovable, Bo...
Read more
GDPR
7 min read
Bolt.new generates a React and Vite app in minutes but ships no consent layer, so analytics and pixe...
Read more
AI Builders / Vibe Coding
8 min read
Putting a cookie banner on a Lovable app takes about a minute: one consent script in index.html, loa...
Read more
Compliance
9 min read
Lovable, Bolt, v0, and Replit all generate working apps fast, but none ships a cookie consent banner...
Read more
AI Builders / Vibe Coding
8 min read
AI app builders can ship a working product from a single prompt, but none generate a GDPR-compliant...
Read more
GDPR
9 min read
AI code generators like Cursor, Bolt, and Lovable produce working applications with trackers already...
Read more
GDPR
8 min read
AI app builders return working products: authentication, a database, payments, a deployed URL. What...
Read more
GDPR
8 min read
An AI app builder hands you working code, not a consent layer, yet the fonts, analytics, and embeds...
Read more
Analytics
7 min read
A 0% consent rate in some regions appears in Google Tag Manager when your container sends denied adv...
Read more
GDPR
7 min read
AI coding tools produce apps that run, not apps that comply. Vibe-coded apps routinely ship with tra...
Read more
GDPR
8 min read
Vibe coding ships real, deployable apps that set cookies and write to storage, often before anyone c...
Read more
GDPR
7 min read
Cloudflare VibeSDK deploys a full AI app builder into your own Cloudflare account, which shifts cook...
Read more
GDPR
9 min read
An app generated by a0.dev is a real React Native build that ships to the App Store, Google Play, an...
Read more
Cookies
7 min read
Firebase Studio generates full-stack apps but no cookie banner, consent log, or privacy policy. This...
Read more
Guides
7 min read
Windsurf scaffolds full-stack apps from a prompt and deploys to Netlify or Vercel with one click. Th...
Read more
Cookies
9 min read
Cursor writes the React, Next.js or SvelteKit boilerplate in minutes, but it almost never wires up c...
Read more
Cookies
8 min read
Base44 turns plain-language prompts into full-stack React apps, but the apps it ships still need a c...
Read more
Guides
8 min read
Replit Agent generates full apps from a single prompt, but cookie consent is never part of the outpu...
Read more
Cookies
8 min read
v0 by Vercel generates React and Next.js apps from natural-language prompts, but the output never in...
Read more
Compliance
7 min read
AI website builders generate layouts, copy, and themes in minutes. They do not deliver working cooki...
Read more
GDPR
7 min read
Bolt.new generates production-ready web apps in minutes, but cookie consent is not part of the defau...
Read moreThe Free plan covers up to 5 sites and needs no credit card. Add the line, scan your app and publish your banner.
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.