Quick Answer: A Vietnam website compliance audit checks your site against Vietnamese laws such as Personal Data Protection Law 91/2025 and E-Commerce Law 122/2025. The open-source vn-law-check toolkit lets an AI coding agent like Claude Code or Cursor scan your code or URL and rank issues as red, yellow, green, or not applicable. It's a preliminary check, not legal advice.
Your launch checklist probably covers performance, SEO, and payments. Does it cover the cookie banner that loads your Meta Pixel before anyone clicks "accept"? A Vietnam website compliance audit used to mean a lawyer's invoice and a week of waiting. Now a coding agent can run a first pass inside the editor where you already work. The catch is that the first pass only helps if you know what it's looking for.
What the audit actually looks for
Most founders assume compliance means the privacy policy page. In practice, the bigger failures are behavioral. A form collects a phone number with no stated purpose. A script sends data to an analytics vendor on page load. A chatbot stores conversations with no retention rule.
The vn-law-check toolkit starts with a triage step. It classifies your site first, then applies only the checklists that matter. A static blog that collects nothing gets a one-line note. A shop with login, a cart, tracking, and an AI chatbot gets a full report. That split is the right design. Running a payment-gateway checklist against a brochure site just creates noise.
The scanner looks for signals such as:
- forms that collect email, phone number, or full name
- Google Analytics, Meta Pixel, TikTok Pixel, and ads SDKs
- login, cart, checkout, and booking flows
- AI chatbots or AI tools running on the frontend
- cookie banners, privacy policies, and consent flows
Here's the limit you need to plan around. scan.sh reads local source files when you point it at a folder. When you give it a URL, fetch-site.sh downloads public pages of that site, capped at 15 pages and 20 JavaScript files at once. A URL scan sees what the browser receives, not what your backend does with the data. Treat it as a view from the outside.
The "continued use equals consent" trap
Here's where most guides go wrong: they treat a consent banner as a checkbox problem. The toolkit's sample report shows a sharper failure. A privacy page says, "By continuing to use the website, you're deemed to have agreed…"
The report flags it as 🔴 and cites Article 9, clause 4, point d of Law 91/2025. Under that provision, silence or non-response is not treated as consent. The cause and effect is simple. When a visitor scrolls past your banner and keeps browsing, your site records "consent" that the law doesn't recognize. Every later data transfer then rests on a shaky basis.
The fix is equally simple. Delete the sentence and ask for explicit consent at the point of collection, next to the form field or the tracker. Vague blanket language in a policy page doesn't satisfy that requirement.
How to read the severity levels
Every finding gets one of four labels. Use them to set your sprint order, not to decide what's legal.
| Level | Meaning | What to do |
|---|---|---|
| 🔴 Fix now | Likely violation or a missing mandatory element | Fix before launch and confirm with a lawyer |
| 🟡 Improve | Compliant in part, or weak wording | Schedule within the next release |
| 🟢 Pass | The checked item is present and matches the checklist | No action needed beyond a spot check |
| ⚪ Not applicable | The site doesn't trigger this rule | Skip it |
The honest caveat is in the repo itself. The maintainer says the checklists are a preliminary review, not a guarantee of full legal compliance. Some items are marked "CHƯA XÁC MINH" (not yet verified against the full legal text). The author estimates dozens of such items remain, mostly around specialized transactions and data collection. That's a useful signal. A green result on an unverified item means "the tool couldn't confirm it," not "the law is satisfied."
Setting it up in five steps
Install depends on your tool. Here's the order that works:
- In Claude Code, run
/plugin marketplace add mhfed/vn-law-check, then/plugin install vn-law-check. These run inside Claude Code, not in a terminal. - For Cursor, Windsurf, Copilot, Cline, or Codex, run the install script from your project folder with
curl -fsSL https://raw.githubusercontent.com/mhfed/vn-law-check/main/install.sh | bash. - Check what the script changed. It copies checklists into
.vn-law-check/and doesn't overwrite your existing files. If you already haveAGENTS.mdorCLAUDE.md, it only appends a short usage note. - Start a session and ask the agent: "audit pháp lý website này theo luật Việt Nam." You can also paste a URL instead of a repo.
- Read the report, then ask the agent to fix the 🔴 items one at a time.
Why one at a time? Batch fixes are hard to review. A change to a consent flow touches the form, the banner, and the policy text together. Reviewing them in separate commits makes it obvious which change fixed which finding.
Common follow-up questions
Teams usually ask three things next. Does the tool work without source code? Yes, through the URL path, though it sees less. Can it write the privacy policy? The repo's workflow drafts one from your code: what data you collect, which vendors receive it (Google Analytics, Firebase, OpenAI, and so on), and where consent forms belong. The draft is only as accurate as the code it reads. If your backend sends data to a service the frontend never mentions, the draft will miss it.
The third question is about trust. The project's change history is worth reading. An early error put the small-business exemption in Article 38 of the relevant law, not Article 39. The maintainers list corrections publicly, so anyone who copied an older checklist can see what changed. That transparency is a better sign than a flawless record would be.
Where the tool stops and a lawyer starts
This is the part to take seriously. The scanner can flag a missing consent step. It can't tell you whether your retention period is defensible for your business, or whether a cross-border transfer meets the decree's conditions. Those judgment calls need a human who reads the full text.
A reasonable split: use the agent to find the gaps quickly and cheaply, then send the 🔴 items and anything marked unverified to counsel. You'll arrive at that meeting with a concrete list, and the lawyer spends time on the hard questions instead of the obvious ones.
Before you ship, do one thing by hand. Open your site in a private browser window, reject every optional cookie, and watch the network tab. If a tracker still fires, the report was right to be worried.
Frequently Asked Questions
what is a vietnam website compliance audit?
A Vietnam website compliance audit is a structured review of your site or app against Vietnamese laws on personal data, e-commerce, advertising, and AI. It checks forms, trackers, consent flows, policies, and terms. Results are ranked by urgency. A preliminary audit identifies gaps; it doesn't certify legal compliance.
how do I run a website legal audit with Claude Code or Cursor?
Install the vn-law-check toolkit in your project, then ask the agent to audit the site under Vietnamese law. You can also give it a public URL. The agent classifies the site, applies relevant checklists, and returns a report with red, yellow, green, and not-applicable labels. Fix the red items first.
is continuing to browse a website valid consent under Vietnamese law?
No. Under Article 9, clause 4, point d of Law 91/2025, silence or non-response is not treated as consent. Replace "by continuing to use this site" wording with an explicit opt-in at the point where you collect data, such as a checkbox beside a form field.
can an AI compliance audit replace a Vietnamese lawyer?
No. An AI-driven audit finds likely gaps quickly, but it can't confirm full legal compliance or assess your specific business risk. Send red items and any unverified findings to a qualified lawyer before launch.
Run the audit on your site this week, then fix the first red item and note what changed in your consent flow. Share the report with whoever owns your privacy policy, and pass this to a teammate wrestling with a tracker they can't explain. Start with vn-law-check on GitHub, and remember that a Vietnam website compliance audit is the first step, not the last.