Content Credentials and Provenance (C2PA)

Lessons 04 and 05 left you with a problem. Metadata is easy to strip and easy to fake. Pixels can be altered, and detectors guess. So engineers asked a different question: instead of trying to prove after the fact that a file is fake, could a camera or an app record at the moment of creation how the file was made, and sign that record so later changes show up? That is the idea behind provenance. The best-known open standard for it is C2PA.

What C2PA and Content Credentials are

C2PA is the Coalition for Content Provenance and Authenticity. It publishes an open technical standard for recording the origin and edits of digital content, and the user-facing name for the result is Content Credentials. The C2PA site says its steering committee members include Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony Group, TikTok and Truepic, and its pages link to version 2.3 of the specification (checked October 2026). A related group, the Content Authenticity Initiative (CAI), promotes adoption and offers open source tools and a free inspection website.

The technical parts, in plain words:

• Assertions. Statements about the file: it was captured by this device, edited with this software, includes this ingredient (another image), was created by a generative AI model, and so on. The creator chooses what to include. Identity of the person is optional.
• Claim. A tamper-evident package that lists the assertions and the information tying them to the file.
• Signature. The claim is signed with a certificate belonging to the hardware or software that made it. Anyone with the right tool can check that the signature is intact and see who signed.
• Manifest. The signed bundle of assertions, claim and signature. A file can carry a chain of manifests, one for each stage of editing.
• Hard binding. A cryptographic hash, a kind of fingerprint calculated from the exact bytes, that ties the manifest to that version of the file. If a single pixel is changed after signing without a new manifest, the hash no longer matches, and a checker will report that the file does not match its record.
• Soft binding. A looser identifier, such as a perceptual fingerprint or an invisible watermark, that can help find the record again for a re-compressed or slightly changed copy. The specification warns that a soft binding must not be used as a hard binding, since it is not statistically unique.
• Trust list. C2PA manages a list of certificate trust anchors for hardware and software signers. Verification tools can use lists like this to decide which signers they recognize.

The CAI describes the result as tamper-evident, not tamper-proof. It flags changes made after signing; it does not stop them. And the CAI states that credentials show origin and history, not whether content is real (checked October 2026).

Who supports it

Support is real and also incomplete. Some examples verified this session:

• The standard's steering members include a spread of camera, software, media and AI companies (listed above). Being on the committee is not the same as shipping a feature that shows or keeps credentials in every product.
• Google Pixel. Google reports that the Pixel 10 lineup is the first to include Content Credentials across every photo that Pixel Camera creates, for JPEG captures. Google says the Pixel Camera app reached Assurance Level 2, the highest level the C2PA Conformance Program currently defines, relying on hardware-backed security (the Tensor G5 chip, the Titan M2 security chip and Android's hardware-backed APIs). Google Photos can validate and display credentials in the About panel for JPEGs that contain them, and attaches credentials to JPEGs edited with AI or non-AI tools. Google also lists limits: it covers JPEG images from those two apps, security depends on keeping the app and operating system updated, and offline timestamps depend on an on-device clock that is maintained only while the phone stays powered on (checked October 2026).
• AI image and video generators. Several attach credentials marking output as AI-generated, and some also add an invisible watermark. Google's SynthID, for example, is an invisible watermark for AI-generated images, video, audio and text from participating tools, and Google offers a detector portal for image, video and audio files (checked October 2026).
• Cameras and editing software. Some camera makers and editing programs have announced or shipped support. Because lists change, check the current lists on the C2PA and CAI sites rather than relying on this lesson.
• Platforms. Some social platforms read credentials and show a label. Many strip them when you upload, re-encode the file, or show nothing. Behavior varies by service, app version and file type, and I did not verify a current platform-by-platform list, so test with a known credentialed file before you assume.

How to inspect a file

The Content Authenticity Initiative runs a free inspection page at verify.contentauthenticity.org. You add a file, and it looks for Content Credentials and shows what it finds. Its older address, contentcredentials.org/verify, redirects there (checked October 2026). The page needs JavaScript, so I could confirm its address and purpose but not read its full help text; follow the instructions on the page for accepted file types and limits. Some browsers and apps also show credentials directly: Google Photos, as noted, displays them for supported JPEGs.

1. Get the best copy. Download the original file if you can, not a screenshot. Credentials live in the file data, and a screenshot is a brand-new image with none.
2. Check the result. A tool may show the signer, the capture device or software, the editing steps, whether AI was used, the date and any ingredients. Note what each statement is: assertions made by the signer.
3. Read the validity message. It may say the credential is valid, that the file was changed after signing, that the signer is unrecognized, or that no credentials were found. Each means something different.
4. Compare to the claim. Does the record fit the story? A photo said to be a phone snapshot from last night but whose record shows an AI image generator is worth a hard look. A photo whose record shows capture on a camera at 9:12 on the stated date is a good lead, not a verdict.
5. Keep checking. Source, corroboration and context still apply (lessons 02 and 03).

What a credential does not show

• It does not show the scene is true. A camera can photograph a staged event, a poster, or a screen showing a fake. A valid credential means the file came from that camera, not that what the camera saw was real.
• It does not show the caption is true. The record may be sound while someone writes a false story around it. A swapped caption (lesson 05) works with genuine credentials.
• It does not show who is honest. A signer is vouching for a record. A trusted-looking signer can still be wrong, and a stolen or misused signing key is a risk any signature system has. Verifiers use trust lists and certificate checks to reduce this, not eliminate it.
• It does not show completeness. Creators choose what to include. Edits made in tools that do not record them, before or after, may not appear. Some information may be redacted for privacy, which the CAI says is allowed.
• It does not enforce rights. The CAI says it does not enforce permissions, and a displayed name may differ from the true owner or be hidden by a platform.
• It does not survive everything. Stripping metadata, screenshots, re-recording a screen or speaker, and some conversions remove the record. A soft binding may help recover it, but not always.

Missing credentials do not mean fake

The central error to avoid is "no credentials, so it must be fabricated." Most media made before the standard existed has none. Most current cameras and phones do not attach any. Editing programs that do not support it drop it. Social platforms re-encode uploads and often remove the data. A photojournalist's honest photo and a forged one will frequently look the same on this test: no credential.

The reverse error is also real: "it has a credential, so it must be genuine." Someone can use a genuine camera on a fake scene, or generate an image with a tool that attaches a credential that says it is AI-generated (in which case the credential is doing its job, and is telling you the truth about its origin). The credential answers a narrow question about file history. Keep your other questions.

Watermarks and their limits

A watermark is a mark added to media to signal origin. There are two broad kinds.

• Visible watermarks (a logo or text on the image) are easy to see and easy to crop, blur or paint over. They also can be added by anyone to any image, so a logo on a photo shows only that someone placed a logo.
• Invisible watermarks are patterns hidden in pixels or audio samples. Google describes SynthID as designed to survive edits such as cropping, filters, frame-rate changes and lossy compression in images and video, and noise, MP3 compression and speed changes in audio. Those are the developer's design goals and statements, and they are not a guarantee against a determined attempt to remove a watermark. A detector can only recognize watermarks from the systems that use that scheme. Content from tools that do not watermark will not be flagged, and Google lists partner coverage that is still growing (checked October 2026).

NIST's report on reducing risks from synthetic content discusses provenance data tracking, labeling and watermarking as complementary approaches to transparency (NIST AI 100-4, checked October 2026). The honest summary: credentials in the file data are rich but strippable, watermarks in the content are harder to strip but carry little information and cover only participating tools, and neither tells you whether a scene is true. Use them as extra clues.

Provenance for your own photos and publishing

If you take photos for a newsletter, a town group, a small business or a news outlet, you can make your own work easier to trust. None of this requires special equipment.

• Keep originals. Store the untouched camera file, with the filename the camera gave it, in a dated folder. If someone says your photo is fake, the original and neighboring frames from the same burst are the best evidence you have.
• Keep a simple log. Date, place, who took it, what is in it, what you changed (crop, exposure). A note in a spreadsheet beats memory.
• Publish with context. Caption with who, what, where and when. Give the photographer's name. Link to the full-size original when you can, since a stripped copy invites a swapped caption.
• Use credentials where your tools support them. If your phone, camera or editor offers Content Credentials, turn them on and test what survives your upload path. Keep in mind some settings include location or personal details. Review what is included, since creators choose what goes in.
• Know what your platform does. Upload a test credentialed file, download it and inspect it. If the credential is gone, put the original on your own site or archive and link it.
• Be careful with privacy. Stripping location data before posting a photo of a child, a home or a protected person is sensible. Jeff's free AVPrep browser tool includes a metadata strip. Stripping also removes any embedded credential from that copy, so keep an unstripped original.
• Correct openly. If you get a caption or date wrong, correct it visibly (lesson 10).
• Label synthetic media you create. If you publish an AI-generated illustration, say so in the caption. A label protects your readers and your own credibility, and in Idaho a candidate-related synthetic video or audio has its own disclosure rule (Idaho Code 67-6628A, lesson 06).

Questions and answers

Is C2PA a government program?

No. It is an industry coalition publishing an open standard. Government bodies such as NIST write about provenance and watermarking approaches in their reports but C2PA itself is a coalition of companies and organizations.

Do I need special software to see credentials?

Not always. The CAI's Verify page lets you add a file for inspection, and some apps display credentials themselves. The right tool depends on your file type. Check the tool's page for current support.

Why would a credentialed photo lose its credentials?

Uploading to a service that re-encodes the image, taking a screenshot, converting file formats, or editing in a program that does not preserve the data. That is why you want the original file.

Can someone fake a credential?

A forged signature should fail a proper check, because the manifest is signed and bound to the file by a hash. The practical risks lie elsewhere: a compromised signing key or device, a trust list that includes a poor signer, a record that is true about a staged scene, or a verification tool that is misread. That is why the standard includes a trust list and conformance levels.

Does the credential tell me where a photo was taken?

Only if the creator included location, and only as a statement they signed. It is optional. Treat any location as an assertion to compare with the scene.

Can I use credentials on audio and video?

The standard covers images, video, audio and some documents. Whether your recorder or editor writes them depends on the product. Test with your own gear.

What does an AI-generated label from a credential mean?

The signer's record says generative AI was used. That is useful and honest when present. It does not say the image is harmful or deceptive. Plenty of AI illustrations are labeled and fine.

Is a watermark better than credentials?

They answer different needs. Credentials carry rich information but live in file data that can be removed. A watermark lives in the content and may survive edits but carries little information and covers only participating tools. Used together they help, and both can fail.

Hard questions

If most media has no credentials, does the system matter?

It matters in places where it is switched on: a phone camera that signs every photo, a newsroom pipeline, an AI generator that labels output. Its value grows with coverage, and today coverage is partial. For now it is a bonus clue when present, not a gate that media must pass.

Could credentials be used to pressure people to prove their photos are real?

That is a fair worry. If the unsigned majority of honest photos gets treated as suspect, the standard would hurt ordinary people and independent photographers. The sensible rule, which the CAI's own limits support, is that no credentials is no information. Newsrooms and platforms should not penalize unsigned work as a category.

Who decides which signers to trust?

Verification tools and organizations decide, often using lists such as the C2PA trust list. Different tools may recognize different signers. That makes the trust decision partly a policy choice, and a reason to read what a result says rather than only look for a green check.

Can a determined bad actor defeat all of this?

Yes, in some ways. They can strip data, re-record a screen, use a tool that does not sign, or stage a scene for a real camera. Provenance raises the cost of some forgeries and gives honest creators a way to show their work. It is a layer, and the other layers in this course remain necessary.