The Dark Side of Vibe Coding: What Is Actually Illegal

Mandatory House Rules (Please Read Before RSVPing)

Order Food & Drinks: If we are hosted at a café or restaurant venue, every attendee must order a meal to support the host venue.
Zero Solicitation: This is an analytical, educational workshop for builders, founders, and researchers—no cold pitching or client hunting.
Strict Ban on Scams: Any promotion of deceptive AI arbitrage, crypto pump-and-dumps, or dark-pattern scraping tools results in immediate removal.

Event Overview & Legal Rationale AI coding agents (like Google Antigravity, Cursor, Lovable, and Claude Code) let a single founder spin up a full-stack SaaS, scraper, or landing page in an afternoon. But "vibe coding" without understanding software, privacy, and consumer law is turning indie hackers into accidental defendants.
When you tell an AI agent to "build me a high-converting landing page," "scrape my competitor's users," or "clone that SaaS," the LLM does not check statutory compliance. It optimizes for completion—often generating synthetic fraud, hardcoded security leaks, and unauthorized access scripts. In the eyes of regulators in the US, EU, Australia, Japan, Singapore, and here in Thailand, "the AI wrote it" is never a legal defense. You are strictly liable for every line of code and every claim you deploy to a public server.
This interactive session breaks down the exact legal red lines of vibe coding—grounded in Computer Crime statutes, Anti-Hacking laws, Data Privacy frameworks, and Consumer Protection acts—and gives you a clean, practical blueprint for vibe coding 100% legally.
Part 1: The 5 Illegal Traps in Vibe Coding (Real-World Examples & Statutes Broken)

Trap 1: Vibe-Coded Fake Social Proof (Consumer Fraud & Anti-Deception Laws)
The Example: Prompting an AI builder to create a SaaS landing page and leaving in the AI-generated "Trusted by 10,000+ users" badge, fake company logos, AI-generated customer avatars, and fabricated 5-star testimonials.
The Laws Broken: US FTC Act (16 C.F.R. Part 465) ($53,088 fine per violation), EU Omnibus Directive (2019/2161) (up to 4% of global turnover), Australian Consumer Law (ACL § 18 & § 29) (where testimonials are legally presumed fake until you prove otherwise in court), Japan’s AUPMR ("Stema" Stealth Marketing Ban), Singapore’s CPFTA & Penal Code § 424A, and Thailand’s Computer Crime Act (CCA) Section 14(1) (importing false or forged data into a computer system likely to defraud the public—punishable by up to 5 years imprisonment and a 100,000 THB fine).
Trap 2: Vibe-Coded Scrapers & Lead Hunters (Anti-Hacking & Computer Crime Laws)
The Example: Telling an agentic coder to write a Playwright/Puppeteer script that rotates proxies, bypasses Cloudflare/CAPTCHAs, logs into a competitor's platform, or scrapes private user directories and Google Maps data to build a B2B lead list.
The Laws Broken: US Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030) (unauthorized access bypassing technical barriers), Thailand Computer Crime Act Sections 5, 7, and 8 (unauthorized access to computer systems/data or intercepting data in transit—carrying 2 to 5 years imprisonment), and Singapore Computer Misuse Act (CMA).
Trap 3: Invisible Data Harvesting & Exposed Databases (Anti-Privacy & Data Protection Laws)
The Example: Deploying a vibe-coded app that collects user emails, behavioral analytics, or uploaded files without consent banners, encryption, or Row-Level Security (RLS) in Supabase/Firebase—leaving customer data exposed to the public internet or feeding private user data directly into third-party LLM APIs without a Data Processing Agreement.
The Laws Broken: Thailand’s Personal Data Protection Act (PDPA B.E. 2562) (administrative fines up to 5 million THB plus criminal liability for unlawful disclosure), EU GDPR (Articles 5, 6, 25 & 32 — "Privacy by Design"), and US FTC data-security enforcement (which prosecutes sloppy, unencrypted database configurations as an unfair trade practice).
Trap 4: UI/Product Cloning & Unlicensed Training Loops (IP, Copyright & API Contract Law)
The Example: Feeding a competitor’s proprietary frontend, documentation, or paid course directly into an agent to spin up a 1:1 commercial clone, or running automated scripts to harvest outputs from Gemini 4 Argon to fine-tune a competing model.
The Laws Broken: US Digital Millennium Copyright Act (DMCA § 1201), Lanham Act Trade Dress Infringement, Google APIs Terms of Service (prohibition on model distillation and reverse engineering), and Open-Source License Violations (GPL/AGPL) when vibe-coded apps copy copyleft repositories into closed-source commercial products without attribution.
Trap 5: Vibe-Coded Dark Patterns & Fake Urgency (E-Commerce & Unfair Practice Laws)
The Example: Prompting an AI to add a fake countdown timer that resets on refresh, a fake pop-up saying "Someone in Bangkok just bought this 2 minutes ago," or a subscription flow that is 1-click to join but impossible to cancel.
The Laws Broken: FTC "Click-to-Cancel" & Dark Patterns Rules, EU Digital Services Act (DSA Article 25), and Thailand’s Consumer Protection Act & Direct Sales and Direct Marketing Act.

Part 2: How to Vibe Code 100% Legally (The Compliant Builder’s Blueprint)

1. Enforce a "Zero-Fabrication" System Prompt: Hardcode a rule in your `.cursorrules` or `ANTIGRAVITY.md` file: "Never generate placeholder testimonials, fake metrics, fictional user quotes, or unverified trust badges. Use live product demos or architectural specs instead."
2. Build "Privacy-by-Design" Before Writing UI: Never connect a live user form before enabling Row-Level Security (RLS), shifting all API keys to server-side environment variables, using Enterprise/Paid API tiers (which guarantee zero training on client data), and adding a real PDPA/GDPR consent flow.
3. Use Authorized APIs & First-Party Data Only: Replace rogue scraping scripts with official public APIs, user-uploaded files, or authorized Gemini Deep Research grounded search workflows that respect `robots.txt` and platform terms.
4. Maintain "Human-in-the-Loop" Authorship for Copyright Protection: Under US Copyright Office and EU law, purely AI-generated code cannot be copyrighted. Document your human architectural architecture, custom business logic, and manual code reviews so your company actually owns the intellectual property of its codebase.
5. Run a Pre-Flight Security & Legal Audit: Before pushing any vibe-coded repo to production, use an autonomous auditing pass in Google Antigravity / Gemini 4 Argon specifically prompted to hunt for exposed secrets, missing RLS policies, copyleft license conflicts, and deceptive UI copy.

2-Hour Interactive Workshop Agenda

0:00 – 0:20 | Welcome\, Food Order & Builder Check-In: Grab your meal, introduce what you are building, and drop your biggest vibe-coding question on the board.
0:20 – 0:55 | The Legal Anatomy of Vibe Coding (Dr. Stefan Ručman): A grounded walkthrough of how Computer Crime Acts, PDPA/GDPR, and FTC/EU consumer laws apply to AI-generated apps.
0:55 – 1:30 | Live Lab: "Spot the Lawsuit" & The Compliant Refactor: We will inspect a typical vibe-coded SaaS landing page and backend live on the big screen, identify the 6 hidden legal violations in the code, and use Gemini 4 Argon to refactor it into a secure, legally compliant architecture in real time.
1:30 – 2:00 | Socratic Q&A & Open Founder Discussion: Discussing real edge cases from Chiang Mai founders, agencies, and indie developers.

Disclaimer: Chiang Mai Professionals, Expats, and Digital Nomads is an independent community group facilitated by Dr. Stefan Ručman; this workshop provides educational analysis of technology regulation and does not constitute formal legal representation.