10 ways to get your vibecoded app sued or taken down

Everything below has a real case behind it. Most of these companies weren't hacked and didn't do anything a normal founder would call shady. They shipped fast and skipped a step nobody sees on screen.

Copy this whole page into Claude and use the prompt at the bottom. It'll walk your codebase and tell you which of the ten you're currently failing.

1. No privacy policy at all

California has required a posted privacy policy since 2004 for any site or app collecting personal information from someone in the state. You're out of compliance before your first user signs up. "I'll add it later" is the same sentence as "I'll add auth later," and you'd never say that one out loud.

Fix: write one that describes what your app actually does. Don't generate a generic one and forget it.

2. Your privacy policy doesn't say you collect user data

Regulators don't read your code. They read your policy, then check whether the code agrees with it. Every FTC privacy case of the last three years turns on that gap. Collecting emails is fine. Collecting emails while your policy stays quiet about it is the violation.

Fix: open your database. Every table with a person in it needs a sentence in the policy.

3. Your privacy policy doesn't say you use AI

If your app sends user input to OpenAI or Anthropic or anyone else, a third party is now processing your users' data. They typed something into your box and it left your building. That has to be disclosed, and if the input is sensitive it has to be disclosed loudly.

Fix: name the model provider, say what gets sent, say whether it's used for training.

4. Your privacy policy doesn't name the third parties you send data to

BetterHelp told people their mental health intake answers were private and then fed them to Facebook and Criteo for ad targeting. The FTC took $7.8 million and a twenty year consent order. GoodRx did the same thing with prescription data and paid $1.5 million.

Nobody broke into either company. Somebody pasted a tracking pixel onto a page and shipped it.

Fix: open your network tab, watch what leaves, list every domain, then check that list against your policy. That means analytics, error tracking, ad pixels, email tools, and payment processors, all of it.

5. Uploads you promised to delete are still sitting in storage

Tea was a dating safety app for women. Upload a selfie and a photo ID so we can confirm you're a woman, and we delete them after verification. The policy said so in writing.

They kept them. When someone found the storage bucket in July 2025, 13,000 selfies and government IDs were still in there, some from users who had signed up two years earlier.

The strongest claim in the class action is the promise they broke, not the leak.

Fix: if your policy says you delete something, write the job that deletes it. Then check that it ran.

6. Your storage bucket is set to public

Same app, same week. Somebody on 4chan noticed the Firebase bucket had no authentication on it and pulled 72,000 images. Three days later a researcher pulled 1.1 million private messages out of a second database, conversations about abortions and cheating partners and where people were meeting up.

Tea had hit number one on the US App Store days before. Class actions landed inside a week. Under California law a breach is worth $100 to $750 per person with no requirement to prove anyone was harmed. Run that against 72,000 people.

Every part of the app worked. The one setting that failed never appeared on a screen, so nobody looked at it.

Fix: default deny on every bucket and every table. Then log out and try to hit your own URLs from a private window.

7. Testimonials from people who don't exist

The FTC's rule on consumer reviews took effect in October 2024 and it names AI generated reviews specifically. It covers reviews from people who never existed, reviews from people who never used the product, bought followers, and bought view counts.

The ceiling is $53,088 per violation, and each fake review counts on its own. Twenty testimonials on a landing page is a theoretical million dollars.

Reviews from you, your cofounder, or your employees are a different case. Those are legal when you disclose the connection and a violation when you don't, which is the version everybody actually ships. The same rule bans burying negative reviews, so filtering one-stars out of your testimonial widget while claiming it shows real feedback is its own line item.

Fix: every testimonial needs a real person attached to a real account. If it's someone on your team, label it. "From our team" costs you nothing.

8. Cancelling takes more clicks than signing up

Founders heard that the FTC's click-to-cancel rule got struck down in July 2025 and read it as permission. The rule died. The statute underneath it did not, and every big case ran on the statute anyway.

Shutterstock paid $35 million in May 2026 because you couldn't finish an early cancellation online and had to reach a human by phone or chat. Chegg paid $7.5 million for a multi-step flow. Vonage paid $100 million for routing people to retention agents who dropped the call.

Fix: count the taps. Signup and cancellation get the same number.

9. Your free trial auto charges with no reminder

Agreeing to your terms is not the same as agreeing to a recurring charge. The law wants a separate, affirmative yes to the money part, disclosed before you take the card, in language a tired person understands at 11pm.

State auto-renewal laws add a reminder requirement on top, and California's is the strict one. New York City's own rule kicks in October 2026.

Fix: show the price, the cadence, the renewal date, and the cancel path on the same screen as the card field. Email before you charge.

10. Your chatbot has no self-harm response

If your bot holds a conversation across sessions and behaves like a companion, New York and California already regulate you. New York's law took effect November 2025, California's in January 2026.

You have to tell users it isn't human. You need a protocol that keeps it from producing self-harm content and routes people to crisis services when they disclose. Minors get break reminders and a content block.

The part that should scare a solo dev: California's version lets any injured user sue directly for the greater of actual damages or $1,000 per violation, plus their attorney's fees. No regulator has to notice you first. One user with a lawyer is the whole enforcement mechanism.

These laws exist because teenagers died. That's why they're built so one person can bring them.

Fix: disclosure on the first message, crisis routing on keyword match, and an age gate before anything else.

Paste this into Claude

I'm going to give you a compliance checklist and access to my codebase. Go through all ten items one at a time.

For each one, tell me: pass, fail, or can't tell from the code. If it's a fail, show me the specific file and line, then give me the change. If you can't tell, tell me exactly what to look at.

Then rank the failures by how likely each one is to actually hurt me, and give me the fix order. Don't write me a summary. Write me the diffs.

Start with number 6, since that one is silent and the rest of them aren't.

[paste the ten items here]

If you don't have your code in front of Claude, paste your live privacy policy and your terms instead, tell it what your app actually does, and ask which of the ten your documents fail to cover. That catches items one through four and seven on its own.

The order to fix them in

Six first. An open bucket is the only one on this list that gets worse every hour and gives you no warning.

Then five, because a broken deletion promise turns a leak into a lawsuit.

Then two through four, since your privacy policy is the document everyone reads when they decide whether to come after you.

Everything else is a weekend.