Vibe-coded an app? The legal implications for you

If AI wrote the code, who is legally responsible?

You are. Data protection law asks who decides why and how personal data is used. That person or company is the ‘controller’, the party that carries the main legal duties. If you launched the app and decide what it collects, you are the controller, whether you wrote one line of code or none.

The AI tool and your hosting provider are usually ‘processors’: services that handle data on your instructions. Processors have duties too, but they do not take yours away. Their terms almost always say that you are responsible for what you build and deploy.

Consumer law works the same way. If you sell to the public, you are the ‘trader’. You are responsible for what your app promises, what it charges and how it treats people, not the model that produced the checkout page.

Do I need a privacy policy for my app?

Almost certainly. If your app has a sign-up form, it collects personal data, meaning any information about an identifiable person. An email address is enough. The GDPR in the EU and UK, India’s DPDP Act, Brazil’s LGPD, many US state laws and both app stores expect a clear privacy notice.

The notice must describe what your app really does. AI builders often add analytics, error tracking or login providers without you noticing. List every third-party service before you write the notice.

Cookies and trackers need separate care. In the EU, non-essential cookies and similar trackers need consent before they load. The UK relaxed this slightly from 5 February 2026 under the Data (Use and Access) Act 2025, allowing some first-party analytics without consent if users get a clear explanation and an easy opt-out. Advertising pixels still need consent in both places.

Is a vibe-coded app secure enough?

The law does not demand perfect security, only security appropriate to the risk. The GDPR calls these ‘appropriate technical and organisational measures’, and most privacy laws use similar wording. A regulator will ask whether you took reasonable steps, not whether a human typed the code.

AI tools write working code quickly. They do not always write safe code. The most common problems in vibe-coded apps are databases left open to anyone, secret keys placed in code that runs in the browser, missing checks on who can see which records, and test data copied into the live app.

None of this needs a security degree to fix. Ask your AI tool to run its security scan, then ask it specifically to explain who can read and write each table. Log out, open your app in a private window and try to see another user’s data. If you can, so can anyone.

• Keep secret keys, such as a Stripe secret key or a database service key, on the server only.
• Turn on row-level security, the database rule that limits each user to their own rows, for every table.
• Rotate any key that has ever appeared in a public repository, a screenshot or a shared project.
• Keep backups, and separate your test database from your live one.

What happens if my app leaks user data?

A ‘personal data breach’ is any security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without permission. An open database that a stranger could read can count, even if you are not sure anyone looked.

Many countries require you to report breaches to a regulator, and sometimes to the affected people, within fixed deadlines. The clock often starts when you become aware of the breach, not when you finish investigating. Write down now who you would call and what you would check first.

If you have users in several countries, the shortest clock that applies sets your timetable.

Who owns code written by AI, and can it contain someone else’s?

In the US, copyright protects human authorship only. The US Copyright Office said in January 2025 that prompts alone generally do not make you the author of what an AI produces, although human selection, arrangement and editing can be protected. Courts have refused registration for works made autonomously by AI. The UK, EU, India and others take their own positions, but all put weight on human creativity.

For most founders this matters less than it sounds, because the value sits in the brand, users and data. But investors and buyers may ask how the code was made, and your own edits and design choices help.

The bigger risk is open-source licences. AI tools add libraries to your project, and may occasionally reproduce code from public repositories. Most open-source licences, such as MIT, only require you to keep a copyright notice. ‘Copyleft’ licences such as the GPL can require you to share your own source code if you distribute the software, and the AGPL can apply even to software offered over a network.

Finally, read the AI tool’s own terms. Lovable, OpenAI and other major providers state that, as between you and them, you own the output. They cannot give you rights they do not have, and indemnities against third-party claims, where offered, are usually limited to paid business or enterprise plans.

• Run a free licence scanner over your dependencies before launch.
• Replace any copyleft component you do not intend to comply with.
• Keep your prompts, edits and design notes as a record of human contribution.

Charging users: subscriptions, renewals and refunds

Taking payments brings in consumer law, which protects people buying for personal use. Payment processors such as Stripe handle card data, but not your duties to explain prices, renewals and cancellation fairly.

In the US, the FTC’s 2024 ‘click-to-cancel’ rule was vacated by the Eighth Circuit in July 2025, before most of it took effect. The FTC restarted the process with an advance notice of proposed rulemaking in March 2026, but there is no new rule yet. The federal Restore Online Shoppers’ Confidence Act still requires clear disclosure and consent for online subscriptions, and state laws, including California’s automatic renewal law, require clear terms and an easy online way to cancel.

In the EU, consumers usually have 14 days to withdraw from an online contract. For digital services, they can be asked to agree that the service starts at once, and then pay for what they used if they cancel. From 19 June 2026, EU rules also require a clear online ‘withdrawal function’ for contracts made online. The UK has its own cancellation rules and new subscription rules under the Digital Markets, Competition and Consumers Act 2024, expected to start in 2027.

Putting AI inside your app: chatbots and AI APIs

Many vibe-coded apps call an AI model themselves, for a chatbot, a summary or a generated image. That means your users’ data travels to OpenAI, Anthropic, Google or another provider. In privacy terms, the provider is your processor, and you need a data processing agreement (DPA), a contract setting out how they handle the data. Most providers include one in their business terms.

Check the data settings too. OpenAI says API data is not used for training by default and abuse-monitoring logs are kept for up to 30 days. OpenAI and Anthropic both offer zero data retention to approved customers. Mention these providers in your privacy notice. Apple’s App Review Guidelines now specifically require apps to disclose sharing personal data with third-party AI and get explicit permission first.

If you offer the app in the EU, Article 50 of the EU AI Act has applied since 2 August 2026. People must be told when they are talking to an AI system, unless that is obvious. If your app publishes AI-generated images or video that look real, labelling rules can apply too. Fines can reach €15 million or 3% of worldwide turnover, with lower caps for small companies.

App stores, accessibility and children

Apple and Google enforce their own privacy rules before your app goes live. Both require a privacy policy link and a summary of data practices: Apple’s ‘privacy nutrition labels’ and Google Play’s ‘Data safety’ section. If users can create an account, both require a way to delete it, and Google also requires a web link for deletion requests. Incorrect labels can lead to rejection or removal.

Accessibility is now a legal topic, not just good design. The European Accessibility Act has applied since 28 June 2025 to certain consumer services, including e-commerce, banking and e-books. Micro-enterprises providing services, those with fewer than 10 staff and turnover or balance sheet of €2 million or less, are exempt. In the US, many lawsuits are brought under the Americans with Disabilities Act over inaccessible websites and apps.

Children need the most care. In the US, COPPA applies to services aimed at under-13s or that know they collect children’s data, and amended COPPA rules have required compliance since 22 April 2026. The EU sets the age for consent to online services between 13 and 16 depending on the country, the UK has its Children’s Code, and India’s DPDP Rules will require verifiable parental consent for under-18s from May 2027. If children might use your app, decide how you will check age before launch.

What is happening in the market right now?

Vibe coding went from a phrase to a market in about a year. Andrej Karpathy coined the term in February 2025, and Collins Dictionary named it its Word of the Year 2025. Tools such as Lovable, Bolt, Replit, Cursor and v0 now let non-developers ship products that handle real customer data.

Security researchers have followed. In 2025, a researcher reported that a sample of apps from Lovable’s public showcase had databases readable without logging in, because access rules were missing or weak. It was logged as CVE-2025-48757; Lovable disputed the rating, saying each customer is responsible for securing its own app. In April 2026, Lovable acknowledged a separate flaw that let users view source code and chat history of public projects between February and April 2026, and said private projects were not affected.

Other incidents show the same pattern. In July 2025, the SaaStr founder reported that Replit’s AI agent deleted a live database during a test project, and Replit added safeguards in response. The same month, the Tea dating app reported that about 72,000 images were exposed from a misconfigured legacy storage bucket. Tea has not said the app was vibe-coded, but the mistake is one AI builders can easily repeat.

Regulators are not targeting vibe coding as such. They apply existing privacy, security and consumer rules to whoever runs the app, while breach deadlines shorten and EU AI Act transparency duties go live. The speed of building has changed; the duties have not.