AgeTrail

Idea

Compliance middleware and audit-trail software that helps small and mid-size app publishers meet the new wave of state App Store Accountability Acts (ASAAs). AgeTrail reads Apple's Declared Age Range API and Google's Play Age Signals API, applies a maintained per-state rule engine (Texas, Utah, Louisiana today, more as they pass), and generates the timestamped consent and age-signal audit log a small publisher needs to defend itself if a state AG or a private plaintiff comes calling. It is built for the 2 to 50 person studio that cannot afford an enterprise identity-verification contract or a compliance lawyer on retainer.

Market gap

Texas's ASAA took effect January 1, 2026, and after the Fifth Circuit stayed a preliminary injunction on May 28, 2026, it is now actively enforceable, private right of action included. Utah's developer and provider obligations landed May 6, 2026, and even though its Attorney General enforcement authority was later stripped by amendment, the law's private right of action against developers remains live. Louisiana's version arrives July 1, 2026, and California has enacted its own take. Apple and Google responded by shipping the Declared Age Range API and the Play Age Signals API respectively, so developers no longer need to build age verification themselves, they just need to read the signal and act on it correctly per state.

That "act on it correctly per state" step is the gap. Every state law sets its own age thresholds, consent-capture and revocation rules, and recordkeeping expectations. The enterprise identity vendors (Yoti, Persona, k-ID's Kids Web Services) sell verification infrastructure to platforms with trust and safety teams. A four-person studio shipping a chat feature into a game has no in-house counsel to translate a comparison chart of four state statutes into a compliance checklist, and no way to prove months later what age signal it had on file for a given user when a lawsuit lands. Timing: this obligation is not hypothetical anymore. It is live law with real litigation exposure, today, for anyone shipping social, chat, dating-adjacent, or marketplace features to US app store users.

Total Addressable Market (TAM)

Bottom-up, US-only, mobile-first:

• Apple App Store had roughly 1,060,820 active publishers worldwide as of July 2026 (termsandconditionstemplate.com, citing Apple platform data). Assuming the US holds about 20 percent of active publisher accounts (a standard rough share used across app-market reporting given US app store revenue concentration), that is about 212,000 US-based publisher accounts. Google Play shows about 185,950 US-developed apps as a supporting data point for the size of the US publisher base.
• Assumption: about 8 percent of active US publishers ship apps in the categories ASAAs target directly (social, chat/messaging features, games with in-app chat or UGC, dating-adjacent, marketplace) ≈ 17,000 organizations. This is a reasoned estimate based on App Store category mix reporting (social, games, and lifestyle categories with UGC/chat commonly account for a meaningful single-digit-to-low-double-digit share of active listings); flagged here as an assumption, not a cited figure.
• Assumption: about 40 percent of those are run by a paid team of 2 to 50 people with real revenue, rather than a solo hobbyist with no budget for compliance tooling ≈ 6,800 organizations. This is the SAM.
• SOM: capturing 3 percent of SAM within 3 years ≈ 200 paying organizations.
• Pricing: blended average contract value across Starter/Growth tiers ≈ $3,000/year.
• SAM in ARR terms: 6,800 x $3,000 ≈ $20.4M.
• SOM in ARR terms (Year 2 to 3 target): 200 x $3,000 ≈ $600K ARR.

This is a mobile-only, US-only, three-state floor. It grows every time a new state passes its own ASAA (the Future of Privacy Forum is already tracking bills beyond the four enacted states), and expands further if web/desktop app coverage is added later.

Monetization strategy

Subscription SaaS billed monthly or annually. The app publisher pays, per organization, scaled by number of apps and states covered. They keep paying because the obligation is continuous, not one-time: every live app needs an ongoing, defensible audit trail for as long as it is in market, and the rule engine has to be updated every time a new state passes its own version of the law. Cancelling the subscription means losing the ability to prove compliance retroactively, which is the whole point of the product.

Pricing strategy

• Starter: $99/month. 1 app, the 3 currently enacted states (TX, UT, LA), basic audit log export (PDF/CSV).
• Growth (anchor): $349/month. Up to 5 apps, all enacted states with auto-updates as new states pass, parental consent revocation workflows, priority email alerts on new state law changes.
• Scale: $899/month. Up to 20 apps, API access for CI/CD integration, dedicated onboarding, expedited audit-package generation for an active AG inquiry or lawsuit.

Growth is the anchor because it is the first tier that actually keeps pace with the legal landscape (auto-updates); Starter is the low-friction entry point for a single-app studio testing whether they are even in scope.

Lead magnet

A free "App Store Accountability Act State-by-State Compliance Checklist." The publisher answers a 5-question intake (which states drive your downloads, does your app have chat/UGC/messaging, do you sell anything to users, do you already read Apple/Google's age-signal APIs, do you have a parental consent flow today) and gets a PDF showing exactly which enacted laws apply to them, what the deadline and penalty exposure looks like, and what a compliant consent flow needs to capture. This qualifies the visitor by making them do the work of realizing they are exposed, then hands them the checklist AgeTrail's dashboard automates.

Competitors

• Yoti: age estimation and digital identity verification technology, sold to large platforms (used by Instagram, PlayStation, and others) as raw verification infrastructure.
• Persona: general-purpose identity verification and KYC platform that can be configured for age checks, but built as horizontal identity infrastructure, not a state-law rule engine.
• k-ID (Kids Web Services): age verification and parental consent infrastructure aimed at games and platforms, sold through enterprise partnership deals rather than as self-serve SaaS for small studios.
• VerifyMy: age assurance API provider, largely UK/EU-focused, oriented at adult content and age-restricted site operators.

What competitors offer now

All four are verification infrastructure vendors: they estimate or confirm a user's age and, in some cases, capture parental consent. None of them ship a maintained, state-by-state legal rule engine that maps a specific app's features (chat, UGC, purchases, messaging) to what each enacted ASAA actually requires, and none productize the audit trail a small publisher needs to hand a court or an AG's office as a defense package. They are also priced and sold for platforms with dedicated trust and safety or legal teams to configure them, not for a 4-person studio that just wants to know if it is exposed and what to do about it this week.

What can be done differently to attract customers

Do not compete on verification technology at all. Apple and Google already solved that with the Declared Age Range API and Play Age Signals API, both free to any developer. Compete on being the compliance layer that sits on top of those free signals: a rule engine that turns "my app has an in-app chat feature and gets downloads from Texas and Utah" into a plain-language checklist, a consent-capture flow, and an exportable, immutable audit log timestamped to survive a private-right-of-action lawsuit years after the fact. Distribution follows the free compliance checklist lead magnet, seeded into indie developer communities (itch.io, r/gamedev, r/indiedev, ACT's small developer members) that are already anxious about this exact law and currently have nowhere affordable to go.