Content Credentials (C2PA): What They Prove and Why They Aren’t a “Birth Certificate” for Everything

A photo of a fire, a politician in a compromising video, the voice of a famous person. With any content like this today, it’s worth asking whether it’s real or was created by artificial intelligence. One of the main technical solutions is the C2PA standard, also known as Content Credentials. It is often described as the “digital birth certificate” of content. It works, but it is neither a mandatory nor an infallible label, as is sometimes claimed.

What is C2PA and Content Credentials?

C2PA is a technical standard created by a coalition of technology companies, media organizations, and camera manufacturers. The goal is to attach a verifiable record of a file’s origin—that is, a photo, video, or audio file—to the file itself. “Content Credentials” is the term used for data signed in this way, which the user can view.

What the record contains

• Information about how the content was created: with a camera, an app, or an AI generator.
• A list of edits, such as cropping, color corrections, or AI intervention.
• Information about who signed the record, along with a timestamp.

How the signature works

The information is cryptographically signed and linked to the file's contents. If the file is modified after signing without updating the record, verification will fail, and the program will notify the user that the content does not match the original signature.

What C2PA Does Not Prove

It is important to distinguish between what the standard says and what it does not. A signature confirms who made a statement about a file and that it has not changed since then. It does not automatically mean that the content is true, nor that the signer is trustworthy. A photograph with a signature may depict a staged scene. This is our conclusion based on how the system works, not a standalone claim from a single source.

Biggest weakness: metadata gets lost

The data is stored as part of the file and can therefore be removed by standard processing. Sources indicate that a screenshot, format change, resizing, or recompression can erase this data. Many social media platforms over-compress images during upload, thereby removing metadata. According to reports, platforms such as Instagram, X, and WhatsApp remove metadata during upload, while TikTok and LinkedIn retain or display it to a limited extent. However, the situation is changing rapidly, and there are discrepancies among sources.

A missing entry does not mean it is a fake

It is often claimed that once metadata is removed, the platform automatically flags the content as manipulated. It’s not that simple. If the image caption disappears, it’s simply not there—and that’s the most common scenario. The absence of data is therefore not proof that the content is fake, nor is it proof that it’s genuine.

Invisible watermarks as an add-on

That is why, in addition to signed metadata, invisible watermarks embedded directly into pixels or audio are also used, as they are better able to withstand format changes. However, such a watermark is usually recognized only by the system that created it and does not, on its own, prove the original chain of edits. Experts therefore recommend a multi-layered approach: a visible label, metadata, and a watermark. The claim that a watermark is “unremovable” is a strong one. None of these methods is unbeatable.

Is C2PA mandatory?

The standard itself is voluntary. The legal obligation is governed by the European Act on Artificial Intelligence: Article 50 requires providers of generative systems to label outputs in a machine-readable format and requires those who publish deepfake content to provide a public warning. It takes effect on August 2, 2026. C2PA is not designated as mandatory in the law; it is merely one of several technical options for complying with the requirement. According to one overview, systems that were on the market prior to this date have until December 2, 2026, to comply with the machine-readable labeling requirement. The European Commission published the final Code of Practice on Transparency on June 10, 2026. This information is from a secondary source, so please verify it before using it in a legal context.

We therefore have no confirmation that “mandatory Content Credentials” are coming for every user. The requirements apply to specific parties, not to ordinary people who share images.

What the average user will see

In practice, the situation is still inconsistent. Some platforms read C2PA data during upload and use it to add their own AI content label. Others remove the metadata but may add a label based on their own recognition or the author’s disclosure. Google has announced C2PA verification in its Assistant app and plans to implement it in other services; however, a single announcement does not in itself mean that the “CR” icon is everywhere. Therefore, we cannot confirm that it appears consistently across all major networks and in the search engine.

What this means for creators and photographers

• Proof of origin. Some cameras and professional tools already support watermarking during creation. Adoption is still uneven and depends on the device and software.
• This is not copyright protection in the legal sense. The signature verifies the declared origin, but does not in itself prevent copying or establish ownership. That is our conclusion.
• Greater reach for verified content. We have not found any sources supporting the claim that algorithms are beginning to prioritize content with Content Credentials.

How to Access the Content

• Do not take the absence of a label as proof of authenticity or forgery.
• Examine the context: who published the content, whether it is corroborated by multiple independent sources, and whether an original, uncompressed file exists.
• If information about the source is available, use it as one piece of supporting evidence, not as a decisive argument.

Conclusion

C2PA is a meaningful step toward transparency: it gives creators and platforms a way to document the origin of content. However, it is not a universal “birth certificate” nor is it mandatory for everyone. The biggest problem remains that data is often lost on its way to the reader. Therefore, it will be important how platforms preserve this data and how the technology is supplemented with additional layers, from watermarks to critical reading.