Utah Made the Follower Graph Portable. The Business Is Hiding in the ZIP File.

Utah Made the Follower Graph Portable. The Business Is Hiding in the ZIP File.

For a decade, creators have been told to own their audience. Start a newsletter. Build a community. Get people onto an email list. Stop renting attention from an algorithm.

Good advice, and it quietly concedes the loss. Creators have already spent years building the thing that actually determines their income: a relationship network living inside Instagram, TikTok, YouTube, and X. Who follows them. Who engages. Which accounts show up in more than one place. How the whole thing shifts month over month.

Platforms let you download your posts, your photos, your account history. Data portability, as the industry practices it, stops at content. The social graph, the map of connections around you, stayed inside the building. Google Takeout and Meta's transfer tools have existed for years, and neither one hands you your graph.

On July 1, 2026, Utah made that refusal illegal.

The Utah Digital Choice Act now requires a covered social media service to give an eligible Utah consumer a portable copy of their personal data on request, and it names the social graph explicitly: connections with other users, content the person created, responses to and from other accounts, and the metadata around all of it. The output has to be portable and readily usable, in a form the consumer can transmit elsewhere without impediment.

A law that forces a file to exist creates a business for whoever can read the file. Here's the opportunity:

This isn't a migration app or a link-in-bio page, and it doesn't promise to turn followers into an email list. It starts as a secure backup and normalization service. It ingests whatever the platforms return, translates incompatible formats into one schema, finds the overlap across accounts, and produces an audience record the creator or their manager can actually use.

The market is geographically boxed in and the work is operationally filthy, which is why it's worth entering now.

The 650,000 followers that don't exist

A creator with 400,000 Instagram followers, 180,000 TikTok followers, and 70,000 YouTube subscribers tells a sponsor they reach 650,000 people.

They don't. Some followers are on all three. Some are inactive, some are bots, some are the same person twice, and plenty haven't seen a post in months. The sum is arithmetic dressed as reach, and everyone in the transaction knows it.

That fiction is getting expensive. U.S. creator ad spend hit a projected $37 billion in 2025, up 26% year over year and growing roughly four times faster than the media industry overall, with $44 billion projected for 2026. Nearly half of creator ad buyers now call creators a must-buy channel, ranking them just behind paid search and social. The money showed up faster than the measurement.

The money is also stacking at the top. CreatorIQ found the top 10% of creators took 62% of all creator payments in 2025, and the top 1% took 21%. Median compensation per campaign was $3,000 against an average of $11,400. Total dollars paid to creators rose 59% that year, while the number of creators getting paid rose 183%. More people, splitting a smaller slice each.

So the middle tier of the creator economy runs real businesses on borrowed evidence. Revenue depends on distribution they can't inspect, sponsor decks quote platform-generated summaries, and the whole audience can vanish behind a suspension, a takeover, a policy change, or a slow bleed in reach that nobody announces. The pitch is simple: your followers live on rented land, but the record of your audience doesn't have to.

Be honest about the limit. A social graph export isn't an email list, and holding a record of someone doesn't give you permission to contact them. Audience ownership, in this version, means continuity, evidence, and intelligence. That's enough to charge for.

What Utah actually changed

Most portability rights are theater. The platform hands over a 4GB ZIP of JSON, CSV, HTML, media, undocumented identifiers, and duplicate records. Compliance achieved. The user is no better off.

Utah's version has teeth in one specific place: it names the social graph, and it demands a portable, readily usable format. Existing export tools fail exactly that clause. Instagram already buries follower data under `connections/followers_and_following`, splitting large accounts across `followers_1.json`, `followers_2.json`, and onward in a nested `string_list_data` structure. X ships followers as JSON inside a ZIP. Those files were built to satisfy a download button.

The scope is narrower than the biggest version of this idea. The right belongs to a Utah consumer, which the underlying Utah Consumer Privacy Act defines as a resident acting in a personal or household capacity, not a commercial one. There's no revenue floor or user-count threshold on covered services, which is a real quirk worth noting. The right attaches to the person, and that's a design constraint more than a ceiling. An agency can't invoke it on behalf of twenty clients. Each creator makes the request as an eligible individual, then authorizes the manager or the software to process what comes back. Build the workflow to preserve that authorization trail, and treat the law as a right you help people exercise.

Know what's carved out, too. The law doesn't reach inferences, analyses, derived data the company generated about you, or proprietary ranking systems. You get the relationships. You don't get the algorithm's opinion of them.

Enforcement runs through Utah's Division of Consumer Protection, at up to $2,500 per violation and $5,000 for violating an order. That won't terrify Meta, but it makes compliance cheaper than a fight, which is all a first mover needs.

The 2026 amendments tighten the screws further, effective July 1, 2027: a five-business-day clock on portability responses, explicit protocol disclosure, continuous sharing mechanics, and consent rules for data involving other users. The interoperability framework leans on open protocols without naming one. ActivityPub, DSNP, and AT Protocol are all in the conversation, and none has been anointed. Waiting for the spec is the wrong move. Start collecting real exports now, learn how each platform interprets the requirement, build adapters while the volume is small, and arrive in July 2027 with working ingestion instead of a deck.

The second state already passed

The obvious objection is that Utah is 3.5 million people and this dies there.

South Dakota disagrees. Governor Larry Rhoden signed SB 111 on March 10, 2026, after it cleared the Senate 34-0 and the House 62-3. It requires social media companies to hand over collected personal data on request and to maintain transparent interoperability interfaces. Two states now have portability law on the books.

New York is the one that matters. On June 4, 2026, the State Senate passed its own Digital Choice Act, S8850A, by a vote of 60 to 0. It requires a user's social graph within five business days, mandates an open-protocol interoperability interface with synchronous sharing, and gives secondary users an opt-out before their public data moves. It sits in the Assembly Consumer Affairs and Protection Committee. If it clears, it takes effect July 1, 2027, the same day Utah's amendments land.

The wave is uneven, though, and you should price that in. Virginia's SB 85 passed its Senate 40-0 and then died on the table in a House committee on March 9, 2026. New Hampshire's HB 1589 drew an "inexpedient to legislate" recommendation 16-0 in February 2026. California's AB 2169 and South Carolina's companion bills are still sitting in committee. The federal ACCESS Act, which tried this years ago, remains stalled, which is exactly why the states are moving at all.

None of it is revenue. A Senate vote isn't a statute, and the tech industry has already sued Utah over other social media laws and won injunctions. Treat the expansion as an option you hold, not a market you have. Still, the dominoes are pointed somewhere useful. Utah has creators. New York has the agencies, the brands, and the talent managers who buy software.

The competition is aimed the other way

Audience overlap isn't a novel feature. The influencer marketing platforms already sell it. Modash runs overlap analysis across a shortlist of creators and sells normalized data through an API. HypeAuditor does competitor-overlap detection, showing which creators share audiences with rivals. CreatorIQ sells platform-connected audience analysis to enterprise marketing teams. Between them, they prove the analysis has value.

They also show you the hole. Every one of them serves the buyer of influence. Their customer is the brand or the agency trying to pick creators and grade campaigns, and their data is modeled, estimated, or platform-connected because that's all a buyer can legally get. Start with the seller of influence instead and the raw material changes: the creator's own export, obtained with the creator's authorization, held as the creator's asset. Same math, run in the opposite direction, from a source of truth nobody else can reach.

Birdclaw shows the plumbing works. The open-source tool imports an X archive into local SQLite and handles tweets, DMs, likes, bookmarks, mentions, followers, following, blocks, and mutes, with graph queries, follow-history events, and unfollow tracking. It's an operator's tool for one platform and it stops there, which removes one excuse: archive ingestion and local graph storage are solved problems. The hard part is the layer above them, and that's where the company is.

The product: Graph Vault