CoAI
Guide

What Is C2PA? How Content Credentials Work, How to Check Them and How They Differ from Watermarks

C2PA is an international standard that records, as signed information in a file, "when, by whom and with which tool" an image, video or other content was created and how it was edited. Based on official information, this guide covers how it works, support in ChatGPT, Google Pixel and elsewhere, how to check it, its limitations and how it differs from digital watermarks such as SynthID.

October 9, 20268 min read

Was that photo you saw online really taken with a camera, or was it created or altered with AI? C2PA tries to answer that question with "a record of how the content was made." This information is now attached to images created in ChatGPT and photos taken on Google Pixel, and it has started to appear as labels on social media. Based on official information as of October 9, 2026, this guide covers how C2PA works, which services support it, how to check it, its limitations and how it differs from digital watermarks such as SynthID.

What C2PA is

C2PA (Coalition for Content Provenance and Authenticity) is the name of both an organization that creates technical standards for showing the provenance (where something came from) and authenticity of digital content, and the standard itself. It was founded in February 2021 by Adobe, Arm, BBC, Intel, Microsoft and Truepic.

Provenance information attached according to the C2PA standard is commonly called Content Credentials. Like a nutrition label on food, it lets you check "when, by whom and with which tool" a piece of content was created and how it was edited.

As of October 2026, C2PA's steering committee lists 11 companies: Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. Japanese companies and organizations such as Canon, Nikon, Fujifilm, NHK and NTT Docomo also participate as general members.

How C2PA and CAI relate

The CAI (Content Authenticity Initiative) often comes up alongside C2PA. CAI is an initiative Adobe launched in 2019 that provides open-source tools for implementing the C2PA standard and promotes its adoption. The division of roles is that C2PA "creates the standard" and CAI "spreads the standard."

How it works: attaching a signed "provenance record" to a file

In C2PA, a provenance record called a manifest is attached to content. A manifest contains information such as:

  • Assertions: individual pieces of information, such as creation and editing actions, the tools or AI used and the camera that took the picture
  • Claim: a bundle of the assertions, digitally signed by the creator (issuer)
  • Content hash: a value calculated from the file's contents. If the contents are altered it no longer matches, so tampering can be noticed

Because the digital signature uses a certificate, you can verify who attached the record. With each round of editing, the previous manifest is carried over and a new record is added, so the editing history can be traced.

Safeguards for when metadata is lost

Because the manifest is stored as information attached to the file, it can be lost through screenshots or re-saving. To make up for this weakness, the C2PA standard also defines a mechanism (Durable Content Credentials) for finding a stored manifest using a digital watermark or a fingerprint (features calculated from the content) as a clue.

The latest specification

Version 2.4 of the specification, published in April 2026, added dedicated fields for indicating the use of AI and made it possible to embed provenance in text such as HTML documents and Markdown. In addition, a conformance program that certifies products that correctly implement the standard has been running since 2025.

Main support

The main support confirmed in each company's official information is as follows.

  • OpenAI: attaches Content Credentials to images generated in ChatGPT and elsewhere. Images and audio also carry Google's SynthID watermark.
  • Google: attaches Content Credentials to every JPEG photo taken with the Pixel 10 camera, which can be checked in Google Photos. Search's "About this image" also makes use of C2PA information. On YouTube, videos shot on a camera without editing are labeled "Captured with a camera."
  • Microsoft: automatically attaches Content Credentials to all images generated with Azure OpenAI.
  • Adobe: offers the Adobe Content Authenticity app and a Chrome extension for attaching and checking Content Credentials.
  • Social media: LinkedIn shows an icon on images and videos that have C2PA information. TikTok and Meta (Facebook, Instagram and Threads) read C2PA information and label AI-generated content created on other services as well.
  • Cameras and smartphones: the Leica M11-P was announced in 2023 as the first camera with built-in Content Credentials. Samsung's Galaxy S25 series attaches Content Credentials to images edited with AI.
  • Delivery infrastructure: Cloudflare offers a feature that preserves Content Credentials when transforming images.

How to check C2PA information

You can check whether a file has C2PA information in the following ways.

  • Verify site: upload an image or other file to the verification site run by CAI (contentcredentials.org/verify) to see its provenance record.
  • Browser extension: Adobe's Chrome extension lets you check the information of images on web pages.
  • Labels in each service: you can check through the details panel in Google Photos, "About this image" in Search, LinkedIn's "CR" icon, and the AI labels on Meta and TikTok.
  • OpenAI's verification tool: you can check whether an image or audio file came from OpenAI at openai.com/verify.

Limitations and caveats of C2PA

C2PA is a powerful mechanism, but it has limitations such as the following.

  • The information is easily lost: taking a screenshot or converting a file can strip the provenance information. Many services remove attached information on upload.
  • No information does not mean fake: supporting C2PA is optional. YouTube also states that the absence of a label does not mean the content has been altered.
  • It does not guarantee truth: what C2PA shows is provenance, meaning "who recorded that they made it, and how." It does not show whether the content itself is accurate.
  • Implementation flaws can happen: it was reported that in 2025 a problem was found with Nikon cameras that allowed images other than the actual captured image to be signed, and a related service was suspended.
  • Adoption is still in progress: only a limited number of products have been certified so far under the conformance program.

How it differs from digital watermarks

Besides C2PA, another way to show where AI content came from is a digital watermark such as Google's SynthID.

  • C2PA: a signed record attached to the file. It shows a detailed history from creation through editing, but is lost if the attached information is removed
  • Digital watermark: an invisible signal embedded in things like image pixels or audio waveforms. It tends to survive even when attached information is removed, but it tells you little more than whether the content was made with a supporting AI

The two complement each other, and OpenAI and Google combine both. Digital watermarks are covered in "What is SynthID?", and the differences between methods are explained in detail in "AI watermarks compared".

Regulation

Regulations requiring AI-generated content to be marked are also driving C2PA adoption.

  • EU: Article 50 of the AI Act obliges providers of generative AI to mark their output in a way that machines can detect as AI-generated. Article 50 has applied since August 2, 2026. However, under the 2026 amendment to the AI Act (the Digital Omnibus), only AI systems placed on the market before that date get a grace period until December 2, 2026 for the machine-readable marking obligation. A code of practice setting out concrete methods was finalized in June 2026.
  • California, US: the AI Transparency Act (SB 942) had its effective date changed to August 2, 2026 by a 2025 amending law (AB 853). It requires large generative AI providers to embed invisible disclosures in images, video and audio and to provide a free detection tool.
  • Japan: in Japan, trials of Originator Profile (OP), a technology for verifying who published a website or piece of content, are under way with participation from news organizations and others.

Summary

C2PA is an international standard that keeps the history of how content was created and edited as a signed record in the file. Major companies such as OpenAI, Google, Microsoft and Adobe support it, and it is spreading to cameras and social media.

However, the information can be lost, and the absence of information does not prove that something is fake. The realistic approach is to treat C2PA labels as one clue and use them together with watermark checks and source verification.

Sources

Tools mentioned in this article

ChatGPTOpenAI’s conversational AI for answering questions, writing, summarizing, coding, and exploring ideas.GeminiGoogle's conversational AI, integrated with Search and Workspace.Adobe FireflyAdobe's image-generation AI, designed with commercial use in mind.

Back to guides