Ask Lovable, Bolt, v0, Cursor or any other AI tool for a landing page and you get something that looks finished within minutes. Clean layout, decent copy, a contact form that works. It is genuinely impressive.
What you do not get is the work nobody sees. The AI builds what you asked for, and nobody asks for a cookie declaration. These are the seven gaps that show up again and again on AI-built sites, and how to close each one before you launch.
1. Analytics and ad pixels that load before consent
This is the big one. You ask the AI to "add Google Analytics" or "add the Meta Pixel", and it does exactly that: it pastes the tag into the <head> of your page. The tag now runs for every visitor the moment the page loads, before anyone has been asked anything.
In the EU, the UK and Norway that is the wrong order. Analytics and advertising cookies need consent first, and a cookie banner does not help if the tag above it has already fired. We have written up the details for the Meta Pixel and for Google Analytics.
The fix: take the tag out of your code and let a consent tool load it after the visitor agrees. With Consentify you remove the snippet, paste your measurement ID into the dashboard instead, and the tag is only injected once the visitor has accepted that category. The AI cannot get the order wrong, because the tag is no longer in your code at all.
2. No privacy policy or cookie declaration
AI tools will happily put a "Privacy Policy" link in the footer. Check what is actually behind it. Often it is a generic template written for a different kind of business, or a page that was never filled in.
A cookie declaration has a specific job: it lists the cookies your site really sets, who sets them, what they are for and how long they last. A template copied from somewhere else does not know any of that.
The fix: generate the declaration from what the site actually loads. Our free cookie policy generator scans the page and writes the table for you. Then read through the privacy policy yourself: who you are, what the contact form collects and where it goes. That part is about your business, and no tool knows it for you.
3. YouTube videos and maps that set cookies
An embedded YouTube video or Google Map looks harmless. It is really a third-party page inside yours, and it starts setting its own cookies as soon as it loads, before the visitor presses play. YouTube's privacy-enhanced mode (youtube-nocookie.com) reduces this, but it does not make the embed consent-free. More on that in our post on YouTube embeds.
The fix: show a placeholder until the visitor agrees, then load the embed. Consentify does this automatically for YouTube, Vimeo, Calendly, Google Maps and other common embeds, without you changing the embed code.
4. Google Fonts loaded from Google's servers
Many templates and AI-generated pages load their fonts with a link to fonts.googleapis.com. That sets no cookies, so it is not a consent problem. But every page view sends the visitor's IP address to Google, and in 2022 a court in Munich ruled that this was a GDPR breach when the site could just as well have hosted the fonts itself.
The fix: download the font files and serve them from your own domain. In Next.js, next/font does this for you at build time. A cookie banner is not the fix here, self-hosting is. Our Google Fonts page in the tracker database explains what to look for.
5. Missing titles, descriptions and share images
AI-built pages often ship with the same title on every page, no meta description and no Open Graph image. Share a link on LinkedIn or Slack and it shows up as a bare URL. Search engines see the same thin page.
The fix: give every page its own title (under about 60 characters) and description (around 150 to 160), and add og:title, og:description and og:image. Ask the AI to do it page by page, then paste one link into a chat to check the preview before you launch.
6. No 404 page and links that go nowhere
Placeholder links (href="#"), buttons with no target and the framework's default 404 page are common in generated code. The AI wired up the pages you described and nothing else.
The fix: click through every link in the navigation and the footer, add a 404 page that sends people somewhere useful, and set up redirects if the new site replaces an old one, so the old URLs keep working.
7. Accessibility: alt text, contrast and labels
Images without alt text, light grey text on white and form fields without labels are the usual misses. That matters for real visitors using screen readers or zoom, and since June 2025 the European Accessibility Act has made it a legal requirement for many online services, including most online shops.
The fix: ask the AI to add descriptive alt text and proper form labels, check your colours with a contrast checker, and run the Lighthouse accessibility audit in Chrome DevTools before launch.
A prompt you can paste before launch
AI tools are good at fixing all of this once you ask. Paste something like this into your builder:
Before we launch, go through the whole site and: remove all analytics and advertising code from the HTML, because I will load it through a consent tool. Make sure there is a privacy policy page and a cookie policy page, linked from the footer. Replace embedded YouTube videos and maps with a click-to-load placeholder. Self-host all fonts instead of loading them from Google. Give every page a unique title, meta description and Open Graph image. Add a useful 404 page and remove every placeholder link. Add alt text to every image and a label to every form field.
Then check the result. Do not take the AI's word for it, it will tell you everything is done.
Check it in ten seconds
The first four points are things you cannot see by looking at the page. Run the free GDPR scan on your site. It loads the page as a new visitor who has not clicked anything and lists every tracker, cookie and third-party request that starts anyway, Google Fonts included. No account needed.