RatingLock

1. One-liner

Catches the feature that silently flips your app to 13+ before Apple’s questionnaire does it for you.

2. Trend signal — why now?

Three things landed inside twelve months and they compound.

Apple made the age-rating questionnaire mandatory and then widened it. On July 9, 2026, Apple added social-media questions to the App Store Connect age rating questionnaire. From September 2026, answers are required with every new app or update submission — including apps submitted for notarization for alternative distribution. The trigger definition is deliberately broad: “the ability to redistribute, amplify, or interact with user-generated content through a social feed or similar discovery method.” Trip it and you’re locked to a minimum 13+ rating, you get a “Social Media” content descriptor on your product page, and you land in the Social Media Time Allowance bucket in iOS 27 — where parents cap an entire category, not your app specifically.

That definition sweeps in apps nobody thinks of as social: fitness apps with leaderboards, education tools with class discussion threads, productivity apps with document comments, recipe and travel apps with public reviews, games with guild chat.

The state laws turned rating accuracy into legal exposure. Texas’s App Store Accountability Act took effect January 1, 2026; the Fifth Circuit stayed the injunction and in July 2026 the Supreme Court allowed Texas to enforce. Utah (May 6, 2027), Louisiana (July 1, 2027), and Alabama (January 1, 2027) follow. Developers — not just app stores — must assign ratings by statutory age bands (<13, 13–15, 16–17, 18+) and consume age-category signals from the store. Texas penalties run to $10,000 per violation.

Apple ships enforcement teeth. Apple has said it will reject or remove apps with misleading or inaccurately reported age ratings, and that deliberate misrepresentation can result in account termination. Apple’s own transparency reporting shows 1,931,400 of 7,771,599 submissions rejected. Meanwhile Apple’s June 2026 guidelines added stricter rules targeting low-quality and inactive apps.

And developers are visibly lost. From Apple’s own developer forums on the rating deadline:

“What is not clear is what actually happens after that date.”

“Many of us are in the middle of development and may not be ready to submit a new build before the deadline.”

“the email gives the impression, that you could update the age ratings for existing Apps. But this is not possible. You can do this only for new builds.”

“I can’t save my answers to the age questions unless my app ‘is in an editable state’… It’s not if you don’t have a build uploaded for a version you created in AppStoreConnect.”

“why? help us pls. apple is really silent on this one.”

“Given the many times this question is raised on the forum and how much it worries developers, it would be great to have a comprehensive answer from Apple.”

That last one is the whole business in one sentence. Apple is silent, the deadline is real, and the penalty for guessing wrong is your release.

Provenance:
  - Signal 1 (Demand): Apple developer forum thread — developers repeatedly asking what happens at the rating deadline, unable to save answers, no Apple response — https://developer.apple.com/forums/thread/810473 — 2026-07
  - Signal 2 (Feasibility/Platform): Apple adds social media questions to App Store Connect age rating questionnaire; mandatory from Sept 2026; broad UGC trigger definition; min 13+ lock — https://9to5mac.com/2026/07/09/apple-adds-social-media-questions-to-app-store-connect-age-rating-questionnaire/ — 2026-07-09
  - Signal 3 (Economic/Regulatory): SCOTUS allows Texas App Store Accountability Act enforcement; Utah/Louisiana/Alabama follow 2027; developer-side rating duties; $10K/violation — https://www.scotusblog.com/2026/07/supreme-court-allows-texas-to-enforce-law-requiring-age-verification-and-parental-consent-on-app/ — 2026-07
  - Signal 4 (Feasibility): Google Play/IARC requires re-answering the content-rating questionnaire whenever features change; EEA/AU/BR/SG/UK minor-blocking from March 2026 — https://support.google.com/googleplay/android-developer/answer/9859655 — 2026
  Category: Platform shift

3. The opportunity

The gap is between “what your app actually does” and “what your questionnaire says it does” — and nobody is watching that gap.

Today the questionnaire is a human filling a form from memory, once, at submission time. Meanwhile the app changes every two weeks. A product manager ships a “reactions on shared lists” feature in sprint 14. Nobody tells the person who answers the questionnaire. Six months later a reviewer notices, and now you’re arguing with App Review about whether you misrepresented your rating — with account termination language in the policy and a Texas AG statute in the background.

The incumbents don’t cover this. Age-verification vendors (iDenfy, Sumsub, ID.me) verify users — a completely different problem from classifying your app. ASO tools (AppFollow, and the $0–149/mo app-monitoring tier) watch rankings, reviews, and keywords, not compliance surface. Enterprise GRC (Vanta, Drata at $10–15K/yr; OneTrust modules from ~$1,000/mo) does SOC 2 and privacy scanning — priced and shaped for a compliance department, not a 4-person app studio, and none of them model the IARC/Apple questionnaire.

The wedge: treat the age-rating questionnaire as a build artifact, not a form. Diff the app’s actual capability surface against the last submitted answers, every release, and shout before the build ships — not after review rejects it.

This is a 10× UX play, not a 10× cost play. The incumbent is a text field in App Store Connect and a person’s memory.

4. Target market

• Primary customer: Head of Mobile / lead iOS engineer / solo founder at app studios publishing 1–20 apps, 2–40 employees, $200K–$10M revenue. Sweet spot: apps with incidental UGC — fitness, education, productivity, hobby/community, mid-size games. Global, but the buyer concentration is US, EU, and India dev shops publishing to US stores.
• Why they buy: In their words, from Apple’s forums — “why? help us pls. apple is really silent on this one.” They are not worried about a fine; they are worried about a blocked release. A rejected submission costs days, and rejection timelines run 24–72 hours for simple fixes but 7–14 days for content and permissions flags. For a studio shipping biweekly with a marketing beat attached, a 10-day content-flag rejection is the expensive event.
• Rough TAM reasoning: ~1.05M app publishers have published on the App Store; ~2.2–2.4M live apps. The addressable slice is publishers who ship regularly and have any UGC surface — realistically low-hundreds-of-thousands, but I only need a few thousand. At 700 customers × $150/mo that’s $1.26M ARR. That works.
• Why now for them: September 2026 makes the questionnaire blocking on every submission. Before September this was optional paperwork. After September it is on the critical path of every release, forever.

5. Product sketch (MVP)

• Capability scan — point it at your repo and your live build; it inventories the features that map to questionnaire triggers: UGC feeds, comments, follows, leaderboards, DMs, chat, external links, purchases, ad SDKs, location sharing.
• Answer draft — generates a proposed set of answers to both Apple’s questionnaire and Google Play’s IARC questionnaire, each answer annotated with the specific evidence (which screen, which SDK, which endpoint) that justifies it.
• Rating forecast — before you submit, shows the resulting rating per store and per region (ClassInd, PEGI, USK, GRAC, ACB), and flags the ones that differ from your current live rating.
• Release diff / drift alert — on every PR or every build, compares the current capability surface against your last submitted answers and posts “this release adds a public activity feed → this will flip you to 13+ and add the Social Media descriptor.”
• 13+ blast radius report — plain-English estimate of what tripping the social flag costs you: Time Allowance category, search-surface filtering for age-filtered devices, screenshot/metadata review needed for EU/Korea/SEA.
• Under-13 gating advisor — the exemption path: if social features are disabled for under-13 users, you’re excluded from the Social Media Time Allowance for that band. The tool tells you exactly which surfaces to gate to qualify.
• Evidence file — a timestamped, exportable record of what you declared, when, and why, mapped to the Texas/Utah/Louisiana/Alabama statutory age bands. This is what you hand a regulator or an App Review appeal.
• Store-policy changelog — monitored feed of Apple/Google rating-policy changes with “does this affect your apps: yes/no” per app.

6. AI angle — what’s load-bearing

Load-bearing in two places, and the product genuinely does not exist without either.

One: mapping code and UI to regulatory concepts. “Does this app let users redistribute, amplify, or interact with user-generated content through a social feed or similar discovery method?” is not a grep. It’s a judgment call about what a CommentThread component attached to a public list actually constitutes. An LLM reading the codebase, the screen graph, and the SDK manifest and reasoning about whether that trips Apple’s definition is the core of the product. Deterministic rules catch the obvious cases and miss exactly the incidental-UGC cases that are the whole market.

Two: keeping up with prose that changes. Apple’s and Google’s policy language shifts constantly and is written in ambiguous English. Re-deriving the trigger rules from updated policy text — and re-evaluating every customer’s app against the new reading — is continuous interpretation work. That’s model work, not a rules table someone maintains by hand.

Remove the AI and you have a checklist someone ignores. Which is what they have now.

7. Localization angle (if any)

N/A as a primary wedge — this is a global play. The compliance surface is Apple’s and Google’s, which are the same everywhere.

But regional divergence is a feature, not a localization strategy: the same app carries different ratings under ClassInd (Brazil), PEGI (EU/Israel), USK (Germany), GRAC (Korea), ACB (Australia). Brazil and Singapore began blocking mature content for minors in March 2026; Apple now blocks 18+ downloads in Brazil, Australia, and Singapore without age assurance. Multi-region rating forecasting is a differentiator against any competitor who builds US-only. Pricing stays USD — this buyer already pays in USD for Apple’s $99/yr developer account and their CI.

8. Business model — path to $1M–$5M ARR

• Pricing: $99/mo for up to 3 apps (indie/solo), $299/mo up to 10 apps + CI integration (studio), $899/mo unlimited apps + multi-region forecasting + evidence export + policy-change monitoring (agency/publisher). Annual discount 2 months.
• ACV: ~$2,100 blended.
• Rough math to $1M ARR: 480 customers at blended $175/mo. Realistic mix: 250 indie × $99, 180 studio × $299, 50 agency × $899 = $1.29M ARR.
• Rough math to $5M ARR: ~2,300 customers at the same mix, or hold customer count near 1,200 and move upmarket — add per-seat review workflow and become the mobile-release compliance system of record for publishers running 50+ apps. Agencies and white-label app shops (who publish hundreds of near-identical apps and get hit hardest by a per-app questionnaire) are the natural high-ACV segment.
• Expansion path: apps published → regions monitored → adjacent release-gates. The natural sequels are privacy nutrition labels / Data Safety (same shape: a form that drifts from reality), COPPA data-handling checks against the April 22, 2026 amended rule, and DSA/EU minor-protection declarations. Every one is the same engine pointed at a different questionnaire.

9. Go-to-market wedge — first 100 customers

• Free “Will September flip your rating?” scanner, aimed at the deadline. Public tool: paste an App Store URL, get a report on whether your app likely trips the social-media flag and what your rating becomes. No signup for the result; signup to monitor it. This is a dated, urgent, self-qualifying hook — and it expires as a hook in September, which is exactly why it converts now.
• Answer the questions Apple won’t. The developer forum thread has people begging for clarity and getting silence. Write the definitive public guide to the September change — the trigger definition, the under-13 exemption mechanics, the per-region rating table — and answer in the threads where people are asking. Same for r/iOSProgramming, r/androiddev, and the Xojo/Unity/Flutter/React Native community forums where this keeps surfacing. Content is the channel here because the search intent is spiking against an empty SERP.
• Scrape the affected list and go direct. App-store data is queryable. Pull apps that (a) rank in Health/Fitness, Education, Productivity, or Lifestyle, (b) currently hold a 4+ or 9+ rating, and (c) mention feeds, comments, community, leaderboards, or sharing in their description or screenshots. That’s a list of apps facing an unplanned rating downgrade. Send each a one-page report of their app’s specific exposure. Personalized, factual, alarming, and true — expect 3–5% reply on a few thousand.
• Mobile CI/CD and release-tooling partnerships. Fastlane plugin, Bitrise/Codemagic step, GitHub Action. The product’s home is the release pipeline, so ship where releases already run. Marketplace listings are free distribution to exactly the right buyer.
• App agencies and white-label publishers as a channel. A shop publishing 200 client apps has 200 questionnaires and 200 liabilities. One agency deal delivers dozens of app-slots and the highest ACV in the book. There are hundreds of these shops and they’re easy to find.

10. Build complexity — justification

Medium. Off-the-shelf: LLM APIs for the code-and-policy reasoning, standard web stack, GitHub/GitLab webhooks, App Store Connect and Google Play Developer APIs for reading current metadata. The custom work is the capability-extraction pass — statically inventorying UGC/social surfaces across Swift, Kotlin, React Native, and Flutter codebases with enough precision that the answers are defensible — plus the per-region rating model (Apple global rating + ClassInd/PEGI/USK/GRAC/ACB). Call it 10–14 weeks to a credible v1 for two people, with the free public scanner shippable in 3 weeks as the lead magnet.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Helps developers comply; reads public policy and the customer’s own code with permission. Not legal advice — positioned as engineering tooling.
Ethical — no harm / dark patterns	✅	Improves the accuracy of child-safety classifications. The under-13 gating advisor helps developers actually protect minors, not evade rules. Must refuse to help disguise genuine social features.
Market exists (evidence above)	✅	Mandatory Sept 2026 questionnaire, enforceable state statutes, 1M+ publishers, documented developer confusion on Apple’s own forums.
1–5 person team can build this	✅	Two people, 10–14 weeks.
Launchable with <$50K / ₹40L	✅	Inference, hosting, a scraper. Well under $20K to first revenue.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	15/20	Blocked releases and rating downgrades are real and expensive, and September makes it every-release. But it’s a periodic sting, not daily bleeding — most teams feel it at submission time, not continuously. Held under 17 honestly.
Demand evidence	15	12/15	Strong: mandatory deadline, enforceable statutes, verbatim developer confusion on Apple’s forums, 1M+ publishers. Docked because I found no one currently paying for this specific thing — the willingness-to-pay is inferred from adjacent spend, not observed.
Build feasibility	15	11/15	Standard stack, but multi-framework static capability extraction is genuinely fiddly and precision matters — a false negative is the customer’s blocked release. 10–14 weeks, not 4.
Distribution clarity	15	12/15	Named lists, scrapeable targets, a dated free-tool hook, CI marketplaces, forum threads with live demand. Docked because the deadline hook expires in September and the post-September motion is less proven.
Revenue mechanics	15	11/15	$99–$899 sits comfortably inside dev-tool budgets and well under GRC pricing. 480 customers to $1M is achievable. Risk: indie tier may churn once they’ve answered the questionnaire once — the drift-monitoring value has to actually land.
Time to first revenue	10	8/10	Free scanner in ~3 weeks, paid tier ~10–14 weeks, urgency peaks in August. Revenue inside 8 weeks of launch is realistic.
Defensibility	10	5/10	Honestly weak at month 3 — this is copyable. Month 12 is better: accumulated per-app answer history, the evidence trail customers won’t want to re-create elsewhere, CI integration lock-in, and a policy-interpretation corpus that compounds. Execution-and-head-start moat, not a real one.
Total	100	74/100

13. Qualitative modifiers

Founder-fit tags

technical-heavy · content-heavy

Needs someone who can reason about mobile codebases across frameworks, and someone who will write the authoritative public explainer that Apple isn’t writing. Notably it does not need domain expertise you can’t acquire — the policy is public text, which is exactly why a small team can move first.

Key assumptions to validate (3–5)

1. Assumption: Developers will pay for questionnaire accuracy rather than just guessing and dealing with rejection if it happens. How to test: Ship the free scanner, then gate the “monitor this app every release” feature behind a $99 checkout. Measure scan→paid conversion. Target: >4%.
2. Assumption: Enough apps are unknowingly exposed for the scrape-and-alert motion to work. How to test: Sample 500 apps in Health/Fitness, Education, and Productivity currently rated 4+/9+; manually assess how many have UGC surfaces that would trip the social flag. Target: >20% exposed.
3. Assumption: Capability extraction can hit precision high enough to be trusted. How to test: Run it against 30 open-source mobile apps with known feature sets; hand-score false positives and false negatives. Target: <5% false-negative rate on social surfaces — false negatives are the dangerous direction.
4. Assumption: The value survives September — that drift monitoring is a recurring need, not a one-time form-filling. How to test: Interview 20 studios about release cadence and how often features change what the questionnaire answer should be. Target: >50% report a feature change in the last 6 months that would have altered an answer.

Risk flags

1. Platform dependency (severe): Apple could ship this themselves. A “we detected social features in your build” warning in App Store Connect or Xcode would gut the core product overnight — and it’s an obvious thing for them to build. Mitigation is to be broader than Apple would ever be: multi-store, multi-region, evidence trail, state-statute mapping. Apple will never build the Texas AG evidence file.
2. Market timing (compresses): The September deadline is the demand peak. Miss it and the urgency narrative gets much harder, even though the underlying need persists. This idea has a launch window measured in weeks, not quarters.
3. Regulatory churn: The state ASAAs are under active First Amendment litigation. Texas is enforceable now via the Fifth Circuit stay and the Supreme Court’s July 2026 order, but courts could still narrow these laws. The Apple/Google platform requirements are the durable half of the thesis; the statutes are the accelerant. Don’t build the company on the statutes alone.
4. Liability positioning: If the tool says “you’re fine” and App Review disagrees, the customer blames you. Must ship as engineering tooling with evidence, explicitly not as legal advice, and surface confidence levels rather than false certainty.
5. Churn in the indie tier: A solo dev with one app may pay once, answer the questionnaire, and cancel. The $99 tier may be a lead-gen product rather than a real revenue line; the business likely lives in the studio and agency tiers.

14. Structured verdict

Score:                  74/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Technical founder who has shipped mobile apps and been rejected by App Review,
                        paired with someone who writes well in public
Time to revenue:        8 weeks (free scanner at 3 weeks, paid tier at 10-14)
Capital to launch:      $15-20K / ₹13-17L
Top 3 assumptions to validate first:
  1. Scan-to-paid conversion >4% — gate release monitoring behind checkout on the free scanner
  2. >20% of sampled 4+/9+ apps in Health/Education/Productivity have flag-tripping UGC surfaces
  3. <5% false-negative rate on social-surface detection across 30 open-source mobile apps
Kill criteria:
  - Abandon if Apple ships native pre-submission rating-drift warnings in App Store Connect or Xcode
  - Abandon if scan-to-paid conversion stays under 2% across 1,000+ free scans
  - Abandon if false-negative rate can't get below 10% — an unreliable tool here is worse than no tool
  - Abandon if <10% of 40 studio interviews report a rating-relevant feature change in the last 6 months

15. Next step — 1-week validation sprint

• Day 1–2: Build the crude scanner — App Store URL in, screenshots + description + public metadata through a model, out comes “likely trips the social flag: yes/no, here’s why.” No repo access, no login. Ship it on a one-page site.
• Day 3: Run it across 500 apps rated 4+/9+ in Health & Fitness, Education, and Productivity. Hand-verify a 50-app sample to measure how wrong the model is. This produces both the exposure number and the accuracy number.
• Day 4: Email 150 of the exposed apps’ developers their own one-page exposure report. Post the definitive September explainer to r/iOSProgramming and the Apple developer forum thread where people are asking with no answer.
• Day 5: Count. Go/no-go on falsifiable thresholds:
  • Go if ≥20% of sampled apps are genuinely exposed, AND ≥8% of the 150 emails reply, AND ≥3 replies say some version of “how much and when can I have it.”
  • No-go if exposure is under 10% (market too thin), or replies are under 3% (the alarm doesn’t land), or the manual check shows the model is wrong more than a third of the time on the direction that matters.

The measurable outcome is a reply-with-buying-intent count, not a vibe. Three people asking the price in week one is the bar.