Vibe-Coded Websites Are Susceptible to Litigation. Is Your Site at Risk?

Which Tracking Tools Do Vibe-Coded Websites Include?

AI coding assistants, and the starter templates they often build on, tend to reproduce the most common patterns found in existing websites. For a new website, these patterns may include analytics scripts, hosted fonts, and error monitoring tools. In some cases, they also include session replay tools that record how visitors move through each page. Each of these is a third-party tool that sends visitor data to a company other than the website operator.

Each type of tool sends different visitor data:

Based on how these categories of tools commonly behave, as of October 2026.

These tools are common, and many websites run them. However, on a vibe-coded website, they are often added without much thought or scrutiny. As a result, the website may not have a privacy notice that describes these tools or a consent banner in place to control when they are used.

Hosted fonts are a useful example of how minor these sorts of tools can appear. In 2022, a Munich court ordered a website operator to pay a visitor 100 euros in damages because the website loaded Google Fonts from Google's servers, which sent the visitor's IP address to Google without consent. While the amount was small, the claim was based on a font rather than an advertising or analytics tool. Many businesses, including mature ones, would not think to review a font for privacy risk.

Why Do Wiretapping Laws Reach Small Websites?

With a couple of exceptions, state privacy laws apply only to businesses above certain size thresholds. In California, the main thresholds are annual revenue above an inflation-adjusted $25 million or personal information from 100,000 or more consumers. New websites rarely meet either threshold, so these laws may not apply to them at first.

In contrast, wiretapping laws such as CIPA have no thresholds, and Section 637.2 sets statutory damages at $5,000 per violation. Wiretapping claims tend to allege that session replay and analytics tools let third parties intercept visitors' activity without consent. Recent complaints against small online stores allege that session replay tools were used with no consent banner in place. Vibe-coded websites are often launched with the same tools and without a way to collect consent.

Consent is one of the main defenses to these claims. In Javier v. Assurance IQ, the Ninth Circuit held that consent has to be obtained before the recording begins. Websites without a consent banner cannot show that their visitors consented.

California's SB 690, signed on September 30, 2026, allows only the Attorney General to bring CIPA's pen register claims over website tracking, starting January 1, 2027. However, it does not affect Section 631, which is the wiretapping provision that session replay and search bar claims rely on.

Who Is Liable for AI-Generated Tracking Code?

The businesses that operate websites are liable for the tracking, regardless of how the code was written. The terms of service for AI coding assistants generally make users responsible for the code the assistants produce. Starter templates and hosting platforms tend to have similar terms. Demand letters and complaints name the business that operates the website, and the use of an AI assistant is unlikely to serve as a defense to these claims.

AI assistants can also generate privacy notices, which creates a separate risk. These notices tend to be generic and often lack context about what the websites collect. Plaintiffs tend to quote them in demand letters and complaints.

A notice that does not disclose the tracking weakens any argument that visitors consented to it. The risk is greater when a notice states that the website does not track visitors or share their data, while its analytics or session replay tools indicate otherwise. That type of statement can support a separate claim that visitors were misled.

What Does This Mean for Vibe-Coded Websites?

I recommend that businesses start by learning which third-party tools their websites load. A complete inventory is ideal, but a review of the tools the AI assistant added is a reasonable first step, including any analytics associated with the hosting platform. Tools that the business does not need should be removed. Session replay tools deserve particular attention, because they appear regularly in wiretapping complaints.

Any remaining tools should be placed under the control of a consent banner. Website owners also need to decide whether the banner uses an opt-in or opt-out model. This is a risk decision, and it should not be left to a default setting without careful thought.

It may be tempting to build the consent banner with the same AI assistant. However, consent technology has many requirements that are easy to miss. For example, a banner has to block underlying tracking scripts and not only the cookies, honor opt-out signals such as the Global Privacy Control, pass each choice to platform tools such as Google Consent Mode, and avoid dark patterns. A self-built banner that misses these requirements may increase risk rather than reduce it.

For this reason, a dedicated consent management platform is a better choice than a self-built banner. My recommendation is Captain Compliance, the platform I help build.

Additionally, privacy notices should be written to describe the tools the websites use. These steps need to be revisited as the websites change, because AI assistants can add new tools whenever the code is updated.