AI website builders can put a site online in minutes from a single prompt. Whether they provide consent tools depends on the kind of builder. Hosted builders such as Wix, Squarespace and Framer include a basic cookie banner you can switch on. Code-generating builders such as Lovable and Bolt ship none, and Hostinger Horizons only adds one if you ask for it. In every case the site owner still has to check that analytics and marketing scripts wait for the visitor's choice.
That gap between a visible banner and scripts that actually wait is where the legal risk sits.
Why an AI-built site still needs a consent layer
AI builders are designed to ship websites quickly. Consent is not a generation target. When the builder wires up a contact form or a chat widget, it usually loads supporting third-party scripts at the same time. Those scripts set cookies. Under Article 5(3) of the ePrivacy Directive, any cookie that is not strictly necessary needs prior consent from the visitor before it can be stored.
Some AI builders ship with a banner toggle. Others include nothing. A banner generated from a prompt is often a single accept button with no reject option, no category breakdown and no script-blocking logic behind it. Dark patterns like asymmetric design and pre-ticked boxes are exactly what the French CNIL fined heavily through 2025.
The site owner is the data controller
Under Article 4 of the GDPR, the data controller is the person or company that decides why and how personal data is processed. When someone launches a site built with an AI tool and adds Google Analytics 4, a Meta Pixel, or Microsoft Clarity, those decisions belong to the site owner. The platform that hosts the site is, at most, a processor.
Liability does not transfer. A founder in Texas who uses Durable AI to launch a site visited by users in Berlin still falls under Article 3 of the GDPR, which sets territorial scope based on where visitors are, not where the business is registered. UK GDPR mirrors this for British visitors, and CCPA rules apply to qualifying businesses with California users.
What AI builders generate, and what they miss
The consent output of an AI builder typically covers the visible surface and almost nothing behind it. A prompt like "add a GDPR cookie banner" returns a banner element. The scripts that should be paused behind that banner keep firing.
| What AI builders usually do | What they usually do not do |
|---|---|
| Insert a static cookie banner element | Block scripts before user consent |
| Auto-enable Google Analytics or Clarity | Implement Google Consent Mode v2 signals |
| Generate a generic privacy policy template | Maintain a cookie inventory tied to actual cookies on the site |
| Show one accept button | Provide an equal-prominence reject button |
| Store a single consent flag | Log a consent record with timestamp and choice for audit |
| Treat all cookies as one category | Separate analytics, marketing, and functional categories |
How the major AI builders compare
The picture varies by platform. Some have first-party features that get part of the way. Most still leave the site owner responsible for the heavy lifting.
Wix exposes a Privacy and Cookies panel that adds a basic banner and lets visitors set preferences. How far it reaches depends on how a tracker was added: check that scripts from apps and embedded widgets actually wait for the banner. A dedicated consent solution for Wix is usually required for sites running paid ads or analytics.
Squarespace ships a cookie banner that offers Decline all and Manage cookies alongside Accept, and its Google Analytics integration supports Consent Mode when the banner is on. Scripts you add yourself through code injection are a separate question, so sites built with Squarespace that run several third-party tools often add an external CMP.
Framer offers a built-in cookie banner component tied to Google Tag Manager and Google Consent Mode, which covers Google services but not the embeds and scripts you add yourself, as the guide to Framer cookie consent explains. Webflow and Lovable lean on user-added embeds, and their AI features focus on design and content generation, not script governance, so consent there is the site owner's job from day one.
Hostinger Horizons can scaffold a banner through a chat prompt and supports script wrapping for some integrations, but the resulting consent record is minimal and is not designed to stand up to a DPA audit. Tools like Bolt and Cursor generate code that compiles. Whether that code respects consent before triggering tracking depends entirely on the prompt and the developer's privacy literacy.
What the latest enforcement shows
The CNIL had a busy year. On 1 September 2025, the regulator imposed €325 million on Google for displaying ads in Gmail without prior consent and using asymmetric Accept versus Reject interfaces during account creation, and €150 million on SHEIN's Irish entity INFINITE STYLES SERVICES CO. LIMITED for setting advertising cookies on shein.com before any user choice. On 20 November 2025, the publisher of vanityfair.fr was fined €750,000 for placing consent-required cookies as soon as a visitor arrived on the site. On 30 December 2025, a €3.5 million fine landed on a French retailer, mainly for sending loyalty-programme data to a social network for advertising, with eleven cookies set before any choice among the breaches.
The CNIL sanctioned 21 separate entities in 2025 for tracker violations through its restricted committee and simplified sanction procedure. The pattern is consistent: scripts firing too early, refusal options buried or missing, and information that fails the informed test under Article 7 of the GDPR.
Britain has moved in the same direction. Since 5 February 2026, the Data (Use and Access) Act 2025 lets the ICO fine PECR breaches up to £17.5 million or 4% of global turnover, according to the ICO's commencement statement. The ICO reviewed the top 1,000 UK websites from January 2025 and reported in December 2025 that 979 of them were compliant, after 17 preliminary enforcement notices.
Where the EU AI Act adds another layer
The EU AI Act does not regulate cookies. Its general-purpose AI rules have applied since 2 August 2025 and most of the rest since 2 August 2026, while the Digital Omnibus on AI moved the stand-alone high-risk obligations to 2 December 2027. Ad optimisation and personalisation tools are rarely classed as high-risk under the Act, but when cookie-collected data feeds a system that profiles users or makes automated decisions, the GDPR's rules on profiling and consent still apply.
The interplay is governed by Article 22 of the GDPR on automated decision-making, the ePrivacy rules on tracker storage, and the transparency requirements in the AI Act. The GDPR and the AI Act work in parallel, not in place of each other. Penalties under the AI Act reach €35 million or 7% of global turnover for prohibited practices.
If an AI-built site reuses cookie-based behavioural data to train, fine-tune or validate an AI model, the original analytics consent does not cover that new purpose. You need a new legal basis, usually fresh, specific consent.
Five steps to a consent layer on an AI-built site
The practical fix is to treat the AI builder output as the front-end and bolt a real consent system on top. Five steps cover most cases.
First, scan the live site. A free cookie scanner walks every public page and lists every cookie, pixel, and tracker the AI builder pulled in, including the ones hidden inside embedded widgets and ad codes.
Second, categorise the findings. Necessary cookies stay on by default. Everything else (analytics, marketing, personalisation) needs prior, explicit consent. Knowing where each cookie comes from is the prerequisite for an accurate inventory.
Third, replace the AI-generated banner with a consent management platform (CMP) that blocks scripts until consent is granted, logs every choice, and respects withdrawal. Equal-prominence accept and reject buttons on the first layer are now table stakes after the SHEIN and Conde Nast decisions.
Fourth, wire up Google Consent Mode v2 if Google Ads or GA4 are present. The signals tell Google whether to fire tags fully, in a privacy-preserving way, or not at all.
Fifth, set the banner to respect geographic rules. EU and UK visitors require opt-in. California users get a Do Not Sell or Share choice, and Brazil generally expects consent under the LGPD. One configuration cannot fit every jurisdiction.
AI website builders and consent: quick answers
Is the cookie banner that my AI builder generates good enough for GDPR?
Rarely. A static banner with one button does not meet the GDPR or ePrivacy Directive standard for consent. Valid consent must be informed, granular, and freely given, and scripts must be blocked until the visitor opts in.
If I use Hostinger Horizons or 10Web, is the platform responsible for consent?
The platform is a processor at most. The site owner is the data controller and carries the regulatory liability under Article 4 of the GDPR. Reading the platform's data processing agreement clarifies the split.
Do US-based AI-built sites need a cookie banner?
If the site is visited by EU, UK, or Brazilian users, yes. Article 3 of the GDPR applies based on visitor location. California visitors also trigger CCPA notice requirements, including a Do Not Sell or Share opt-out for qualifying businesses.
What happens if I let analytics fire before consent on an AI-built site?
It is the most common cookie breach in recent CNIL decisions. The vanityfair.fr publisher was fined €750,000 for it in November 2025, and SHEIN €150 million in September 2025. A cookie scan will reveal whether scripts are firing before consent.
Does the EU AI Act apply to small AI-built sites?
The Act applies based on what the AI system does, not the size of the business deploying it. For a typical AI-built site, the Act's main touchpoint is transparency under Article 50, which has applied since 2 August 2026, such as making clear when visitors are talking to an AI chatbot. The cookie rules still come from the ePrivacy Directive and the GDPR.
Can I just ask my AI builder to write a privacy policy?
The generated text is a starting point. It needs to match the actual data flows on the live site, list real third parties by name, and be reviewed against the privacy regime that applies to the audience.
Check what your AI-built site loads before visitors arrive
An AI builder gets the site to launch. A consent management platform holds the trackers back until visitors choose. Kukie.io scans every page, classifies the cookies and trackers picked up along the way, blocks non-essential scripts before consent, and logs each choice for audit. It works alongside Wix, Squarespace, Webflow, Framer, WordPress, and code-generated sites from Lovable, Bolt, or Cursor.
