How to add a cookie banner to a Base44 app

To add a cookie banner to a Base44 app, paste the consent script into the app's index.html from the Code tab, at the top of <head>, so it runs before any analytics or advertising tag. Base44 generates working web applications from plain-language prompts, but its own documentation is explicit that Base44 does not add a consent banner to your app. If your finished app collects analytics, records sessions, embeds third-party scripts or serves visitors in the EU, the banner has to load before non-essential cookies fire.

This guide covers what Base44 actually deploys, which cookies and storage items you are likely to find, Base44's own GDPR position, and the practical steps for adding a banner to a vibe-coded application.

What Base44 builds and why it affects cookie consent

Base44 is an AI app builder acquired by Wix in June 2025, reportedly for about USD 80 million up front plus earn-out payments. The platform turns natural-language prompts into full-stack React applications with built-in databases, authentication, file storage and hosting, which puts it in the same conversation as Bolt.new, Lovable and v0 by Vercel.

The output is not a static brochure site. Base44 apps include backend infrastructure, user accounts and integrations with services like Google Workspace, Slack and email providers. As of October 2026, Base44 also switches on its own app analytics for every app by default and offers session recordings on the Builder plan and above. Anything that stores or reads data on the visitor's device falls under Article 5(3) of the ePrivacy Directive, regardless of whether a human wrote the code or an AI did.

Cookies and storage a typical Base44 app uses

The exact footprint depends on what your app does, but most Base44 deployments include some combination of the following:

Base44's security overview says it keeps authentication tokens in the browser's localStorage and that HttpOnly cookie storage is not available. Sign-in storage is usually treated as strictly necessary under Article 5(3) because it is required for the service the user explicitly requested.

Session recordings are a different matter. Base44's own help page warns that recording sessions may require visitor consent in regions such as the EU, the UK and California, and that getting it is your job. Analytics cookies, marketing pixels and third-party embeds need prior consent in the EU, the UK and most jurisdictions following an opt-in model. Mapping each item to one of the standard cookie categories is the first step before any banner can do its job.

Where the consent script goes in Base44

A standard cookie banner is added by placing one script tag in the <head> of every page, before any tracking scripts run. This is the recommended pattern for React applications and the one used by every major consent management platform.

Base44 used to manage the head section internally, with no built-in way to place a script before anything else fired. That changed: Base44's SEO documentation now says you can edit the generated index.html in the Code tab and add <script> tags that must appear in the HTML source. Editing code needs a paid plan: on the Free plan you can view the code but not change it. Three working options exist.

Option 1: Paste the tag into index.html

Open your app's dashboard, go to the Code tab and open index.html. Paste the embed code from your Kukie.io dashboard as the first child of <head>, above any analytics or advertising tag, then publish:

<script src="https://cdn.kukie.io/s/YOUR_SITE_KEY/c.js" async></script>

Replace YOUR_SITE_KEY with the site key shown in your dashboard. Because the tag is in the HTML source, it starts loading before React mounts, which is the most reliable position for blocking other scripts.

Option 2: Inject it from Layout.js using useEffect

Every Base44 app has a top-level Layout.js component that wraps every page. If you prefer to keep index.html untouched, you can append the script tag to document.head from inside a useEffect hook, which runs on the client after React mounts. Prompt the AI builder to add a loader at the top of Layout.js:

useEffect(() => {
  const s = document.createElement('script');
  s.src = 'https://cdn.kukie.io/s/YOUR_SITE_KEY/c.js';
  s.async = true;
  document.head.appendChild(s);
}, []);

This works for client-side consent collection. The timing caveat: anything that runs before React mounts runs before the banner loads. If you add Google Analytics or Meta Pixel directly in a component, switch to a consent-aware loader instead of a hard-coded script tag.

Option 3: Export the code and host it yourself

On the Builder plan and above, Base44 lets you export the generated project as a ZIP or connect it to GitHub. The exported frontend is a standard React project. Once you host it on Vercel, Netlify or your own infrastructure, adding a banner is identical to any other React build: the same tag goes at the top of <head> in index.html, and auto-blocking is switched on in the Kukie.io dashboard. Note that the Base44 backend stays on Base44 servers behind the SDK, so this option moves hosting but not full data control.

Base44's own GDPR position

When your app collects personal data from EU visitors, you decide why and how, so you are the controller and Base44 hosts and processes that data for you. Three points from Base44's privacy and security documentation matter for your own records:

• All Base44 servers are in the United States, and every workspace stores its data there by default.

• On the Business and Enterprise plans, you can choose EU or UK data residency for apps you create after changing the setting. Base44 notes that requests may still be processed in another region before the data is saved.

• Base44's security overview says a Data Processing Agreement is available on request, alongside SOC 2 Type II and ISO 27001 certification.

Name Base44, and Wix as its parent company where relevant, in your privacy policy, and ask for the DPA before you launch to EU users. A US data location also means your privacy policy needs to describe the international transfer.

Regulations that apply to Base44 apps

If your app reaches users in the European Economic Area, the UK, Switzerland or Brazil, prior consent for non-essential cookies is a hard requirement. The relevant rules:

• The GDPR governs how personal data flowing through cookies is processed once collected.

• The ePrivacy Directive (Article 5(3)) is the source of the consent requirement itself, and the GDPR's Article 7 defines what valid consent looks like.

• National regulators including the CNIL in France, the ICO in the UK and the Garante in Italy enforce both at national level.

• The LGPD in Brazil and POPIA in South Africa apply similar consent and transparency rules to cookie use.

United States state laws follow a different model. Under the CCPA and the laws that followed it (CPRA, Virginia, Colorado, Connecticut and others), the approach is opt-out rather than opt-in, with specific rules around "Do Not Sell or Share My Personal Information" links.

Recent CNIL enforcement you should know about

The French data protection authority continues to issue the largest cookie fines in Europe. On 1 September 2025 (announced two days later), the CNIL fined Google 325 million euros and SHEIN 150 million euros under Article 82 of the French Data Protection Act, which implements Article 5(3) of the ePrivacy Directive. On 20 November 2025, the same regulator fined Condé Nast 750,000 euros over the vanityfair.fr website, after finding that new cookies were placed and existing ones continued to be read even after users clicked "Refuse all". Across 2025 as a whole, the CNIL's 2025 review counts 83 sanctions totalling about 486.8 million euros, 21 of them against organisations over trackers.

The pattern across these decisions is consistent. Regulators look at what cookies actually fire before consent, whether reject is as straightforward as accept, and whether the banner respects the user's choice afterwards. A Base44 app shipped without a banner, or one that loads tracking before the banner appears, falls into exactly the territory these decisions target. For French-facing apps in particular, the CNIL cookie guidelines are the practical reference point.

Step by step: adding Kukie.io to a Base44 app

1. Create a free Kukie.io account and add your Base44 app's domain.

2. Run a cookie scan against the deployed app. The scanner detects first-party and third-party cookies set during a normal session, including those from any integrations the AI builder wired in for you.

3. Categorise the detected cookies in the dashboard. Session and auth cookies belong in Necessary. Tools like Google Analytics 4 belong in Analytics. Anything used for advertising lands in Marketing. Preference and live-chat cookies fall under Functional.

4. Copy the embed code from the Kukie.io dashboard.

5. In Base44, open index.html in the Code tab and paste the tag at the top of <head>, or prompt the AI to add the useEffect loader to Layout.js.

6. Enable auto-blocking and Google Consent Mode v2 in the Kukie.io dashboard. Auto-blocking holds analytics and marketing scripts until consent is granted, which is what Article 5(3) requires of them.

7. Verify the banner loads on the live URL, that Reject all is one click and equally prominent as Accept all, and that no analytics cookies fire before consent is captured.

Before you turn on Base44's session recordings, decide whether you will ask for consent first. Base44 cannot hold recordings back behind your banner for you, so if you cannot gate them, leave them off for EU visitors.

What to get right before going live

A working banner is necessary but not sufficient. Three additional items still need attention:

• A cookie policy page listing every cookie, its purpose, duration and provider. Kukie.io generates this from the latest scan results.

• A privacy policy that names Base44 and Wix (as parent company) as relevant processors where applicable, and describes the US data location.

• A way to withdraw consent at any time. Kukie.io adds a small "Cookie settings" button to the app that reopens the preferences from any page.

Base44 cookie questions, answered

Put a consent banner in front of your Base44 app

If you have built an app with Base44 and serve EU visitors, a consent banner is not optional. Kukie.io scans the deployed app, lists every cookie it sets and holds analytics and marketing scripts until visitors choose. The Free plan covers up to 5 websites.

Start free