As AI makes convincing fake media easy, a complementary approach is gaining ground: instead of only trying to detect fakes, prove where authentic content comes from. The leading standard for this is C2PA, developed by the Coalition for Content Provenance and Authenticity, and displayed to users as Content Credentials.

What C2PA is

C2PA is an open technical standard for attaching provenance information to digital content — images, video, audio and documents. The coalition was founded in 2021 by organizations including Adobe, Microsoft, Arm, Intel, the BBC and Truepic, and has since been joined by many technology, camera and media companies, including major AI developers.

How it works

  1. When content is created or edited, the tool records a manifest: who or what created it, which tool was used, whether AI was involved, and what edits were made.
  2. The manifest is cryptographically signed and bound to the content, so tampering can be detected.
  3. Each subsequent edit can add to the history, creating a chain of provenance.
  4. Viewers can inspect the credentials with compatible apps or verification websites, often through a small “CR” icon.

Cameras with built-in C2PA support can sign photos at the moment of capture, offering strong evidence that an image came from a real camera.

Provenance vs. watermarking

  • Provenance metadata (C2PA) records detailed history but can be stripped — for example when an image is screenshotted or re-uploaded to a platform that removes metadata.
  • Invisible watermarks embed signals in the pixels or audio itself. Google DeepMind’s SynthID, for example, watermarks content generated by Google’s AI models. Watermarks survive some edits but can be weakened by heavy manipulation, and detection usually requires the provider’s tools.

The two approaches are complementary, and some systems combine them.

Who uses it

  • AI image generators adding Content Credentials to mark AI-generated images;
  • camera makers offering signing in professional cameras;
  • news organizations using provenance to show the authenticity of their photos and videos;
  • social and media platforms reading credentials to label content.

Limits

  • Absence proves nothing: most content has no credentials, so a missing label doesn’t mean fake.
  • Stripping: metadata can be removed, intentionally or by platforms.
  • Adoption: value grows only as more devices, tools and platforms support the standard.
  • Trust in signers: credentials show who signed, not whether the content is true; a malicious actor can sign misleading content.
  • Privacy: creators may not want to reveal identity or location; the standard allows choices about what to include.

Why it matters

Provenance shifts the question from “is this fake?” — increasingly hard to answer — to “can this be traced to a trustworthy source?”. Regulation is moving in the same direction: the EU AI Act requires machine-readable marking of AI-generated content where technically feasible.

How to check Content Credentials

Where supported, look for a small “CR” icon or a “Content Credentials” label on an image or video. Clicking it shows information such as the tool that created or edited it and whether AI was involved. You can also upload files to verification sites that read the credentials. If no credentials are present, that doesn’t mean the content is fake — many cameras and platforms don’t add them yet, and metadata can be stripped.

Related: deepfakes explained.

What to watch next

  • Smartphone makers adding capture-time signing.
  • Social platforms preserving and displaying Content Credentials.
  • Technical standards for AI-content marking under the EU AI Act.
  • Watermark robustness research and attacks.

Key takeaways

  • C2PA is an open standard for cryptographically signed provenance of digital content.
  • Content Credentials record who created content, with which tools, whether AI was used and what edits were made.
  • Metadata can be stripped; invisible watermarks such as SynthID are complementary.
  • Missing credentials don’t prove content is fake, and signatures don’t prove it is true.
  • Value grows with adoption by cameras, AI tools and platforms.

Frequently asked questions

How can I check Content Credentials?

Use apps or websites that support C2PA, such as the Content Credentials verification tool, or look for the credentials icon on supporting platforms.

Does C2PA detect deepfakes?

Not directly. It provides verifiable history for content that carries credentials; it does not analyze content lacking them.

Is C2PA free to use?

Yes, it is an open standard, and open-source implementations are available for developers.