AI App Builder Cookie Consent in 2026: Who Gives You a Banner and Who Leaves It to You

Quick answer

If your app has users in the EU or the UK, somebody has to show them a cookie banner and honour the answer. In October 2026, only three of the eight builders we track help with that, and they help in three completely different ways.

Bubble gives you the deepest first-party controls: an app setting plus two workflow actions, so you build the banner and Bubble gives you the switches behind it. Webflow gives you a three-call JavaScript consent API, but only on sites that have Analyze or Optimize. Softr gives you a dedicated settings slot for a bought third-party banner. The other five give you nothing at all for end-user consent, which is defensible for the code-export tools and much less defensible for the hosted ones.

The trap is that searching their documentation for "cookie" or "consent" ranks them almost exactly backwards.

Why a word search gets this wrong

We counted how often each builder's own documentation index mentions cookies, consent, GDPR and related terms. The result is close to an inversion of what the products actually do.

The highest raw score belongs to v0, with seven mentions of cookies and eight of GDPR. Read in context, all seven cookie mentions are about iframe and preview-proxy origin scoping, in sentences such as the one noting that generated previews running on a proxy origin "will need an alternative authentication flow" because upstream Set-Cookie headers are stripped. That is a sandboxing concern, not a consent feature. The eight GDPR mentions are compliance attestations describing Vercel, Bolt and Base44 as companies, alongside SOC 2 and ISO 27001. None of it is a control you can ship to a visitor.

Bubble, which ships by far the most, scores two and two.

The same trap catches three more builders. Lovable's documentation index contains the word "banner", and it refers to an announcement banner you post to your own workspace, plus the in-project warning banner that appears before an abandoned project is deleted. Replit's two "banner" hits are social-media cover images from its asset-generation use cases. Base44's and Lovable's "opt-out" hits are both about excluding your data from AI model training, which is a real and separate thing we have covered elsewhere.

In other words, "consent" in this category usually means consent to something other than cookies: an OAuth consent screen, an AI training opt-out, an agent asking permission before running a tool. Four different senses, none of them the banner.

What each builder actually ships

Bubble is the only one that documents its own cookies and then hands you the switches. By default it sets three cookies on every visitor, logged in or not: a session ID, a session signature and a user identifier. A general setting named Do not set cookies on new visitors by default turns that off, and it is off by default and must be enabled per app. Two workflow actions, Opt-in to cookies and Opt-out from cookies, flip it per visitor. Bubble's own summary is exact: "Together, the setting and the two actions let you build your own cookie consent flow."

Two limits are stated just as plainly. First, "these actions only cover Bubble's own cookies, not cookies set by plugins or other services", and separately that "Bubble can't give you control over cookies that a plugin or another service sets." Second, turning the default cookies off has a product cost: no temporary users for new visitors, and no transfer of pre-signup data such as a shopping cart into the account at signup. Bubble also sets its cookies regardless of the setting the moment someone signs up or logs in, because it cannot keep a session without them.

Webflow is the only one with a programmatic consent API. Three calls on the wf global: getUserTrackingChoice() returns allow, deny, or none; allowUserTracking() turns tracking on, with optional activate and reload flags; denyUserTracking() turns it off, with an optional reload. The three-state read matters more than it looks, because "has not decided yet" and "has declined" need different handling and most home-grown implementations collapse them.

The boundary is availability and scope. Webflow's own index describes the browser API as being "Available on sites with Webflow Analyze or Optimize", and each method is documented as governing tracking "for Webflow Analyze and Optimize" specifically. It is a consent state machine for Webflow's own analytics products. Any third-party script you add is still yours to gate.

Softr takes the third route: buy the banner. It documents a first-class integration slot at Settings, then Integrations, then Iubenda Cookie Solution, which "allows to add a customizable cookie consent banner on your site". The page notes "You will need an Iubenda subscription for this integration", while also saying the cookie solution itself does not require a paid licence, so read that as needing an account rather than a paid plan. The part that matters technically is prior blocking: "By default, Iubenda will block the most common scripts on your site until the user hits Accept", with a Prior blocking and asynchronous re-activation toggle on the embed. Prior blocking is the thing that makes a banner meaningful rather than decorative, and it is the thing a hand-rolled banner most often omits.

Lovable has a page titled "Privacy and security settings" and it is the cleanest illustration of the gap. Across 34,661 characters and thirty-seven headings covering workspace access, publishing, MCP connectors and data protection, the word "cookie" appears zero times, "consent" zero times, and "tracking" zero times. There is a genuine privacy feature in there, Block publishing with PII, which refuses a publish when personal data is detected. It is just not a consent control.

Bolt.new is the most minimal of the eight. Its entire support documentation index, roughly 16KB, contains zero occurrences of privacy, legal, trust or compliance.

Replit has a page called "Privacy and deployment settings", which is about who can see a deployment, not about what the deployment stores on a visitor's device. No consent surface.

Base44 publishes a "Privacy and security" page that covers encryption, ownership and the platform's own GDPR posture, pointing at its Terms of Service and DPA for the detail. Its only opt-out is the Enterprise AI-training exclusion, and the page is candid that "There is no opt-out setting to find or switch on" because that exclusion is automatic. Nothing for end-user cookies.

v0 ships no consent feature, as covered above.

The comparison

How to read the five blanks

A blank is not automatically a failure, and the distinction is about who owns the output.

Lovable, Bolt.new, Replit and v0 all hand you real code you can host yourself. On a Next.js or React project you add whatever consent management platform you like and wire it to your own analytics, exactly as you would on any hand-written app. The builder neither helps nor hinders, and "no first-party consent feature" is a fair description rather than a criticism. The thing to be clear-eyed about is that nobody is going to tell you which cookies the platform's own runtime sets on your visitors. Bubble documents its three by name; the export tools do not publish an equivalent list, so if you need one for your privacy policy you will be reading the shipped code or your own browser's storage panel.

Base44 is the one where the blank bites hardest, because it is hosted and the app runs on infrastructure you do not control.

If you are choosing partly on where data physically sits, that is a separate axis and we have measured it in where AI app builders actually store your data. If your question is which cookies get set in the first place, most of them are session cookies, and the mechanics differ by builder in how AI app builders handle built-in auth.

Verdict, October 2026

For an EU-facing app where consent handling matters and you do not want to own the whole problem, Softr is the shortest path in 2026, because prior script blocking comes with the integration rather than being something you remember to implement. Bubble is the best option if you want to control the banner yourself and you are willing to build it, and it is the only builder that tells you what its own cookies are. Webflow is strong if you are already paying for Analyze or Optimize and your tracking is mostly Webflow's own; outside that, the API governs less than it looks.

For the four code-export tools, treat consent as part of your application work rather than a feature you are shopping for, and budget an afternoon for a consent management platform plus the script gating. For Base44, ask before you commit.

One caveat that applies to all eight, and Bubble says it best about itself: using a compliant platform "does not mean however that your app built on Bubble is automatically compliant". You are the data controller. The builder is a processor. None of this is legal advice, and the vendor pages below say the same about themselves.