Legal risks of vibe coding: which US, EU and Ecuador laws apply to your AI-built app

A post making the rounds on social media warns that "with 0 sales you can already owe $100,000" because of legal gaps in an AI-built app, and offers a six-point prompt for Claude to fix them. The underlying point is sound: Claude, Cursor or Lovable will build a sign-up flow, a newsletter or a subscription plan in an afternoon, but they won't tell you which laws you just triggered.

The viral prompt, though, mixes obligations that apply to you with ones that don't, and ignores Ecuador and most of Latin America. This guide covers the law behind each point, who it really applies to, what it can cost and what it looks like for a blog, an app with accounts, a SaaS or a store. At the end there is an improved prompt. In part two we run the audit on this very blog, with before and after screenshots.

This is not legal advice. It is a technical guide to spot risks and know what to ask a lawyer. If your app already charges money or handles sensitive data, talk to one.

The key idea: fines are counted per unit

The post gets the most important part right. Many of these laws don't fine you on revenue but per violation: every child signed up, every visitor recorded, every email sent. With modest traffic the numbers add up fast.

The $53,088 figure is the FTC's per-violation maximum in 16 CFR 1.98, adjusted for inflation every year.

Point by point: what the viral prompt says and the law behind it

1. Age verification (COPPA)

The law: the Children's Online Privacy Protection Act protects children under 13. The FTC amended the rule in 2025 (effective 23 June 2025; compliance mandatory since 22 April 2026) and widened what counts as personal information: biometrics, phone numbers, voice recordings and government identifiers.

Who it applies to: services directed to children, and general-audience services with actual knowledge that they have users under 13. A B2B tool for accountants does not need an age gate to comply with COPPA. A homework app, a game or a platform with avatars and chat does.

What to do:

• If your audience may include children, ask for date of birth neutrally (without hinting "you must be 13") and, if the user is under 13, block sign-up or obtain verifiable parental consent.
• Don't collect more than you need: no microphone, profile photo or location "just in case".
• In Ecuador, the LOPDP (Art. 21) lets teenagers from age 15 consent to processing of their data; below that, their legal guardian does. If your app targets schools there, that is your threshold, not 13.

2. Google Fonts and the GDPR

The case: the Munich Regional Court I (judgment of 20 January 2022, 3 O 17493/20) ordered a website to pay €100 to a visitor because it loaded Google Fonts from Google's servers: the browser sent the visitor's IP to Google without consent, and the court found no legitimate interest because fonts can be self-hosted. A wave of mass claims for €100-170 followed, which another Munich court (30 March 2023, 4 O 13063/22) found abusive. The technical lesson still stands.

Who it applies to: the GDPR reaches you outside the EU if you offer your service to people in the EU or monitor their behaviour (Art. 3(2)).

What to do: don't load third-party resources you don't need. In Next.js, next/font/google downloads the fonts at build time and serves them from your own domain, so it already complies. The problem is a <link href="https://fonts.googleapis.com/..."> pasted into the <head>, which is exactly what AI tools tend to generate. The same reasoning applies to icons, scripts and embedded videos.

Quick check:

curl -s https://your-domain.com/ | grep -c "fonts.googleapis.com\|fonts.gstatic.com"

If it returns 0, you are not loading Google Fonts from Google. The real case runs this same test on this blog.

3. Session replay and chats (CIPA)

The law: the California Invasion of Privacy Act penalises intercepting a communication without the consent of all parties. Plaintiffs apply it to tools that record what you do on a website (session replay such as Hotjar, Microsoft Clarity or FullStory), to support chats and to some pixels. Thousands of suits have been filed since 2022, mostly in California, with $5,000 statutory damages per violation. Courts don't always side with plaintiffs, but defending costs money.

Who it applies to: any website with visitors in California that records sessions or passes chat content to a third party.

What to do:

• Don't install session replay if you won't look at it.
• If you need it, turn it on only after consent, never on page load, and mask every form field (most tools support this with a setting or a data-* attribute).
• A banner shown while the script is already recording does not count: the script must wait for "Accept".

4. Marketing emails (CAN-SPAM and Ecuador)

US law: the CAN-SPAM Act does not require prior permission, but every commercial email must include the sender's valid postal address and a working unsubscribe link, honoured within 10 business days. The fine is per email.

In Ecuador: Article 50 of the Electronic Commerce, Electronic Signatures and Data Messages Act requires anyone sending periodic messages to provide "expedited means" to unsubscribe, and the request is binding from the moment it is received. On top of that, building a list with personal data requires a legal basis under the LOPDP (usually consent) and telling people what you use it for.

What to do: in Resend, Brevo, Mailchimp or similar, set a footer with the address and unsubscribe link on every marketing template and check unsubscribes apply automatically. Transactional emails (password reset, invoices) don't need an unsubscribe link, but don't slip promotions into them.

5. Subscriptions: renewal and cancellation

US law: the FTC's federal "click-to-cancel" rule was vacated by the Eighth Circuit on 8 July 2025 on procedural grounds. The FTC restarted rulemaking in March 2026, but the rule is not in force. What does apply is ROSCA, a federal statute that requires disclosing all material terms before charging, getting express informed consent and offering simple cancellation. In California, the amended automatic renewal law (AB 2863, in force since 1 July 2025) requires online cancellation if the customer signed up online, an annual reminder and keeping proof of consent.

In Ecuador: the Consumer Protection Act requires clear and complete price and terms, and Article 50 of the Electronic Commerce Act adds that sellers must disclose "all requirements, conditions and restrictions" of services sold online.

What to do, next to the subscribe button:

• Price and frequency ("$19 a month, renews automatically") and when the next charge happens.
• How to cancel, with a link that works from the user's account in two clicks, no calls or forms.
• An explicit checkbox or action to accept, and keep a record of it.

6. DMCA agent

The law: the DMCA protects services that host user-uploaded content (comments, files, profiles): if someone uploads infringing material and you remove it on notice, you are not liable. To get that protection you must register a designated agent with the US Copyright Office ($6 per designation, renewed every 3 years) and publish its details on your site.

Who it applies to: only if your users can publish content. A blog without comments or a tool that doesn't host third-party files doesn't need it.

What the viral prompt leaves out

• Chatbot disclosure (EU AI Act). Since 2 August 2026, if your app has a chatbot that talks to people in the EU, it must be clear they are dealing with an AI (Art. 50). If you add an assistant via the Claude or OpenAI API, a visible "You're chatting with an AI assistant" covers the basics.
• Affiliate links (FTC). If you earn a commission, say so next to the link, not only on a separate page. The FTC states that "affiliate link" on its own is not an adequate disclosure.

• A privacy policy that tells the truth. AI-generated templates often describe analytics, ads or banners your site doesn't have, or leave gaps like "[N] days". A policy that doesn't match what you do is a problem in itself.
• Controller details (Ecuador). The LOPDP (Art. 12) requires disclosing the identity and contact details of the data controller, including address, phone and email.

Ecuador: the laws that apply even with no US users

The regulator is the Superintendencia de Protección de Datos Personales (SPDP), and it is already issuing fines: in 2025 it adopted its fine calculation methodology (Resolution SPDP-SPD-2025-0022-R) and sanctioned LigaPro and the Ecuadorian Football Federation for a combined $454,500.17. For individuals and small companies, the percentages apply to the previous year's business volume.

What applies to you? Checklist by project type

Blog or content site (like this one):

• Fonts, scripts and images: served from your domain or from third parties? Disclose it in the privacy policy.
• Analytics or ads? If there are none, the policy must not say there are. If there are, get consent before loading them.
• Affiliate links: visible notice at the top and next to each link.
• Real contact details and controller information so people can exercise their rights.

App with user accounts: all of the above, plus minimum age (13 in the US, 15 in Ecuador to consent without parents), data minimisation, account deletion and data export.

SaaS with subscriptions: all of the above, plus renewal terms next to the button, simple online cancellation, reminders and a record of consent.

Online store: terms, final prices including taxes, return rights (15 days in Ecuador) and invoicing.

App with a chatbot or generative AI: an AI disclosure, no personal data sent to the AI provider without telling users, and a check on where the provider processes data (another international transfer).

Any project with marketing emails: postal address, unsubscribe link and immediate opt-out.

The improved prompt for Claude Code

The original prompt's problem is that it fixes all six things without asking whether they apply. You can end up with a pointless age gate on a B2B tool or a DMCA page on a site with no user content. This prompt takes inventory first, fixes only what applies and leaves you the items that need a human decision:

Act as a technical legal-compliance auditor for this project. This is not legal advice: your job is to spot risks and fix what is technical.

1. Inventory (change nothing yet):
   - What personal data is collected (forms, sign-up, payments, logs) and where it is stored.
   - Cookies, localStorage and third-party scripts or resources loaded (fonts, analytics, session replay, chat, pixels, videos, image CDNs).
   - Emails sent (transactional and marketing) and through which provider.
   - Subscriptions or recurring payments, and how they are cancelled.
   - Whether users can publish content.
   - Whether any AI feature talks to users or generates content.
   - Audience and countries: ask me if you can't infer it (US, EU, Ecuador or others).

2. From that inventory, state which laws apply and why: COPPA, GDPR, CIPA, CAN-SPAM, ROSCA and California's automatic renewal law, DMCA, AI Act Art. 50, FTC affiliate guidance, and in Ecuador the LOPDP, Art. 50 of the Electronic Commerce Act and the Consumer Protection Act. Mark anything irrelevant as "does not apply".

3. Fix only what applies and is technical, for example:
   - Self-host fonts and resources on my domain (in Next.js, next/font).
   - Load analytics and session replay only after consent, with every field masked.
   - Footer with postal address and unsubscribe link on every marketing template, with immediate opt-out.
   - Price, renewal frequency and a cancel link next to the subscribe button; two-click online cancellation.
   - Affiliate notice at the top of the content and next to each paid link.
   - A visible notice that the user is talking to an AI.
   - Minimum age at sign-up if the audience may include minors.

4. Review the privacy policy, cookie policy and terms: they must describe what the app does TODAY. Remove mentions of tools that don't exist and gaps like [N] or [PENDING].

5. Don't invent legal details (address, phone, tax ID, company name): leave them as pending and ask me.

Finish with a table: risk, law, applies yes/no, change made, file touched, and what is left to decide with a lawyer.

Common mistakes

• Pasting a generic privacy policy. If it says you use Google Analytics and you don't, or the other way round, you are giving people false information. Generate it from the inventory, not from a template.
• A banner that blocks nothing. The analytics script starts before the click. Check DevTools → Network: no third-party requests should go out until the visitor accepts.
• Half-done self-hosting. You migrate the main font, but an icon component or a CSS @import still calls Google. Search the whole project for googleapis.
• An unsubscribe link that requires logging in. CAN-SPAM and Ecuadorian law require an expedited method: one click, no password.
• Fixing what doesn't apply. An age gate or DMCA agent you don't need adds friction and data you then have to protect.

FAQ

My app is Ecuadorian with no US users. Does COPPA apply?

No. COPPA covers services directed to children in the US or with actual knowledge of US users under 13. You are covered by the LOPDP, which sets 15 as the age at which a teenager can consent on their own.

Do I need a cookie banner?

Only if you use non-essential cookies or similar technologies (analytics, ads, session replay). If your site uses none, you don't need one; say so in your cookie policy.

Does a personal blog in Ecuador need a privacy policy?

The LOPDP excludes journalistic and editorial content, but not technical data, the emails you receive, or any forms or newsletters you add. If you process readers' data, explain how.

How much does a DMCA agent registration cost?

$6 per designation with the US Copyright Office, renewed every three years. It only makes sense if you host user content.

Can I ask Claude to write my privacy policy?

Yes, as a draft, as long as it starts from your app's real inventory. Check it doesn't invent providers or data, and have a lawyer review the final version if you handle sensitive data or take payments.

Conclusion

The viral post is right that per-unit fines can sink a project with no sales, but not every point applies to every project, and in Ecuador the main rules are the LOPDP and the Electronic Commerce Act. Take inventory first, fix what applies and write down what doesn't. In part two we run this same review on codigoagente: what was fine, what we fixed and what is still pending.