Smell #15: Ethical Blindspot

Symptoms

• Your AI-generated tracking code collects Personally Identifiable Information (PII) without user consent (GDPR violation).
• Your UI components lack aria- labels or keyboard navigation support (Accessibility violation).
• Your search algorithm accidentally mirrors biases found in the AI's training data.
• You merged a "License-Free" utility that actually copied code from a GPL-licensed project.

Example: The Silent Data Leak

Prompt: "Add analytics to track user search behavior." AI Output:

function trackSearch(query) {
  analytics.send({
    userId: currentUser.id,
    email: currentUser.email, // PII LEAK: AI added this for "better tracking"
    query: query,
    timestamp: Date.now()
  });
}

The Result: You are now storing user emails in a third-party analytics dashboard without explicit consent. A major privacy violation merged in 5 seconds of vibe coding.

Debt Impact

This smell leads to Legal and Social Bankruptcy:

| Debt Category | Impact | |---------------|--------| | ⚖️ IP | Legal liability, GDPR fines, and potential lawsuits. | | 🔐 SEC | Privacy breaches and data exposure. | | 👥 TEAM | Loss of trust from users and damage to the team's professional reputation. |

How to Fix

1. Compliance Audit: Scan your AI-generated modules for PII handling and accessibility gaps.
2. Privacy by Design: Refactor modules to use "Anonymized IDs" instead of raw user data.
3. Inclusion Audit: Test your UI with a screen reader to catch accessibility blindspots.

How to Prevent

• Ethical Constraints: Include "Must be GDPR compliant" or "Must follow WCAG 2.1" in your standard instructions.
• Privacy Reviews: Treat every AI-generated data-handling module as a high-risk security component.
• Standardized Consent: Use a shared utility for tracking that handles consent automatically.

Related Smells

• Smell #4: Over-Delegation — Giving AI autonomy over sensitive data.
• Smell #10: Missing Self-Review — Not reading the code means not seeing the ethical breach.

Book Reference

• Chapter 6: Tool Calling & MCP — privacy risks of giving agents tool access.
• Chapter 11: Can You Patent This? — the legal and regulatory framework.
• Chapter 18: The Manifesto — "Responsibility Remains Yours."