Google Ships AI Detection. I Shipped the Royalty Layer Nobody Is Building.

Submission for the Google I/O 2026 Writing Challenge.
I shipped Phase 1 of a C2PA marketplace on Tuesday. Google shipped SynthID into Chrome on Wednesday. This post is what I learned in the 48 hours in between.

Detection is the half I no longer care about

I want to be honest about why I almost did not write this post.

I have been heads-down on a small marketplace called Vericum for three months. The product is one sentence. A marketplace for human-authored content with cryptographic proof of origin and an automatic royalty chain. I shipped Phase 1 last week. C2PA verification engine. Stripe Connect payouts. Buyer verification fee. RLS on every table. Nothing flashy.

Then Google I/O 2026 dropped and a friend pinged me on Telegram with a single line.

"lol they just took your floor and put it in Chrome"

He meant SynthID rolling into Chrome. He meant C2PA Content Credentials shipping native to the Pixel camera. He meant the entire bottom rung of my marketplace becoming a free browser feature inside 72 hours.

He was not wrong. He was wrong about which half mattered.

What Google actually shipped at I/O 2026

I am going to be brief here because the keynote is everywhere and the judging criterion for this post is depth not summary. The detection slate from I/O 2026, in one paragraph:

SynthID watermark detection is now embedded in Chrome, Lens, Circle to Search, and AI Mode. C2PA Content Credentials are now native to the Pixel camera on the 8, 9, and 10 series. The same week, OpenAI, ElevenLabs, and Kakao announced SynthID adoption.

One more detail that most coverage missed. LinkedIn has quietly been showing Content Credentials on uploaded images since May 2024. The platform layer has been converging for two years. This week was just the consumer rollout.

That is the entire detection slate I care about for this post. Any one of these rollouts sounds like it obliterates the bottom rung of the marketplace I have been building.

It does not. Here is why.

"Is it AI" is solved. "Who gets paid" is not

Let me draw the line I think most coverage of this announcement is missing.

There are two questions a piece of media can prompt on the open web.

1. Provenance. Is this real or synthetic. If synthetic, generated by what. If captured, captured by whom, when, where.
2. Economy. When someone reuses this piece of media, who gets paid, how much, on what schedule, with what audit trail.

Google just shipped a credible answer to question one for free into every Chrome tab. SynthID gives you a binary on synthetic content. C2PA gives you a manifest on captured content. Between the two, the average user can now answer "is this AI" inside one second of seeing an image. That is a public good. It is also a commodity from this week forward.

Question two is not solved. It is not being shipped by Google. It is not being shipped by Adobe. It is not being shipped by the C2PA standards group. It is sitting in the gap between detection and marketplace, and nobody large enough to own it is building it.

I think the reason is structural. Question one is a protocol problem. Big companies are good at protocols. Question two is a marketplace problem. Big companies are bad at marketplaces. Especially marketplaces that distribute royalties to long-tail individual sellers because the unit economics are terrible at Google scale and great at indie scale.

The four layers above detection

Vericum is one attempt at filling the second half. The architecture is four layers stacked on top of detection.

Layer A. C2PA verification. This is the floor. It is what Google just shipped into Chrome. We read the manifest, we score it, we display the result on the listing. This is the entrance ticket. From this week forward it is also the easy part.

Layer B. Per-buyer forensic watermarking on every sold copy. Netflix solves film piracy by embedding a unique per-stream invisible watermark in every playback session. The same fingerprint that lets the buyer enjoy the content lets Netflix trace a leaked file back to one user account. We apply the same idea to stock content. Every download from the marketplace gets a unique perceptually invisible steganographic watermark. The buyer sees nothing different. We can identify any subsequent copy in the wild.

Layer C. Match chain across the open web. A crawler plus reverse image search plus perceptual hash plus the watermark from Layer B. The crawler runs continuously. When it finds a piece of sold content on a news site or a social post or a derivative work, it logs a match. The watermark tells us which copy. The C2PA manifest from Layer A confirms which original. Two anchors. Deterministic match.

Layer D. Ongoing royalty distribution. This is the payoff. When the match chain in Layer C detects that a buyer used a sold image, modified it, and monetized the derivative, the royalty engine fires. The original seller gets a contracted percentage. Stripe Connect handles the transfer. The buyer signed a royalty_rate agreement at purchase. The marketplace is the arbiter of record.

Google solved Layer A for everyone. Layer B is the next eight weeks of Vericum work. Layers C and D are scaffolded in schema and in roadmap. None of them are commodities yet.

What this looks like in code today

I do not want this post to be a pitch deck. I want it to be the kind of post I wish other builders had written for me three months ago. So let me be concrete about what is actually live as of this week.

Stack. Next.js 14 App Router. TypeScript strict. Supabase Postgres with the schema declared across nine supabase/migrations/ files. RLS enforced on every table in the live database (verified at write time). Stripe Connect Express for seller payouts. c2pa-js and c2pa-node for verification, lazy loaded, with a JUMBF marker fallback when the full library fails to import.

Tables that matter. Three.

profiles        ( id, role, ... )
contents        ( id, seller_id, content_hash, c2pa_manifest, royalty_rate, sale_type, ... )
purchases       ( id, content_id, buyer_id, payment_provider, client_reference_id, ... )
verifications   ( id, content_id, c2pa_score, ai_detection_score, content_hash, ... )

The interesting field is royalty_rate on contents. It defaults to zero on a Premium sale and lands between five and ten percent on a Royalty sale. The Royalty sale type discounts the purchase price by forty percent in exchange for the long tail. That is the seller side of Layer D. The buyer side is the payment_provider field on purchases, which knows whether to send a future derivative-use payout through Stripe Connect or Toss Payments.

What Phase 1 fixed. Five real bugs. Naming them because shipping the post matters more than looking clean.

1. Seller role check was a coin flip. isSeller: !!user was treating every logged in account as a seller. Fixed to profile?.role === "seller" || profile?.role === "admin".
2. Stripe checkout was rejecting every payment. The webhook reads session.client_reference_id. The checkout session was never setting it. Silent 100% failure. Fixed.
3. Duplicate detection was failing silently. verifications table had content_hash declared NOT NULL but the verify route was inserting empty strings. SHA-256 is now computed in the route before insert.
4. Dashboard was lying. Purchases count was hardcoded to zero on the dashboard page. Replaced with a real Supabase count query.
5. Landing page was a 287-line ghost. The page was reimplementing inline what already existed in src/components/landing/*. Replaced with five component imports.

All five are in git log. I am not proud that they were in main. I am proud that they are not anymore.

What Phase 2 ships next. The watermark engine. Layer B. I expect about eight weeks. The reference implementation I am studying is imWatermark from Stable Diffusion's invisible-watermark library, ported to a Node runtime so it fits inside a Next.js API route. Per-buyer salt derived from purchase.id. Detection runs on any uploaded sample from the field.

The argument for why Google could not have built this

I want to address the obvious objection. If royalty layers are valuable, why isn't Google shipping them.

I have one answer. Unit economics.

Detection is a protocol problem. It scales with users. The marginal cost of running SynthID on the billionth image is near zero. The marginal revenue is also near zero because it is a feature, not a transaction. Google makes money on the surrounding ad surface, not on the detection itself. The numbers work because users are free.

Royalty distribution is a marketplace problem. It scales with transactions. Every payout is a Stripe call, a tax ledger entry, a chargeback risk, a seller-support ticket. The marginal cost of the billionth payout is not near zero. The marginal revenue is a commission on a transaction. Google could ship this. Google has shipped marketplaces before. None of them have been the company's center of gravity for a reason that is not a mystery if you have worked at any big company. A 15% commission on a $10 photograph is a rounding error inside a $300 billion company. It is rent inside a marketplace.

I am a one person company. Phase 1 is functional but not yet populated. Seller onboarding begins next week. A 15% commission on a $10 photograph is the rent.

This is not a moat argument. Google can build this any time. It is a focus argument. Google has not built it because it has better things to do. The window for an indie marketplace to occupy the royalty layer above the standards layer is real and it is open for at least the next two years.

The window is the 6 months between standard and meme

Six months ago C2PA was an Adobe-only research curiosity. Today it is a Chrome feature. Six months from now it will be a meme.

Phase 2 of Vericum has to be live before the meme arrives. The meme is what turns the standards layer into table stakes and the layers above it into the actual product. Ship the upper floors before the foundation becomes invisible. Ship after the foundation is visible enough that buyers know to look for it. The window between "novel" and "expected" is roughly 6 months on the consumer side. That is the window every marketplace builder watching this announcement is timing.

What I learned shipping Phase 1 the same week Google shipped Chrome detection

Two things, briefly.

One. Standards adoption is good for marketplaces, not bad. Every browser that ships C2PA reading is a free integration test for my listing pages. Every buyer who learns to look for SynthID is a buyer who already knows what authenticity means. The standards layer is not a competitor. It is infrastructure that lets the marketplace exist.

Two. The post nobody wrote about I/O 2026 is the post about what Google did not announce. No royalty layer. No buyer-side derivative tracking. No automatic enforcement chain. No marketplace integration. Those are the seams. The next two years of indie building is in those seams.

What I am going to do this week

Stop reading I/O coverage. Stop writing tweets about which keynote slide was prescient. Ship Phase 2.

If you are also building in this gap I would love to talk. I am @wildeconforce on dev.to and X. Vericum is at vericum.com. Phase 2's watermark engine will open-source the detection half when it ships.

For builders thinking about this gap.

1. The standards layer is now infrastructure. Build on top of it. SynthID and C2PA should appear on your listing pages and your verification reports. They are not competition. They are free integration tests that ship inside every Chrome update.
2. The economy layer is the 6-month window. Schema first. Engine later. Get royalty_rate and per-buyer purchase identity into your tables this quarter. The watermark engine can ship in eight to twelve weeks after the schema is right.
3. Open-source the parts that grow the ecosystem. Keep the parts that grow the marketplace. Detection libraries belong in public repos. Royalty matching and seller-to-buyer attribution belong inside your product.

I started this post explaining why I almost did not write it. Here is why I did.

The detection half of authenticity is now a commodity. That is good. The economy half is open. That is also good. The builders who notice the difference are going to ship interesting things in the next twenty four months. I wanted to be on the record about which half I picked.

Google ships the protocol. I ship the economy.

---

Built and shipped by Jack An. Indie. Seoul. Phase 1 of Vericum live this week. Phase 2 watermark engine in progress. Open to seller pilots and dev collaborations. @wildeconforce on dev.to.