What are Content Credentials (C2PA)

Two distinct things hide behind the term, and they are worth separating. C2PA (Coalition for Content Provenance and Authenticity) is the consortium that writes the technical specification; «Content Credentials» is the name under which that specification reaches the end user, in the form of an icon, an information panel and a verifiable file. The coalition was announced on 22 February 2021 with Adobe, Arm, BBC, Intel, Microsoft and Truepic, and it operates as a project of the Joint Development Foundation.

The steering committee today brings together Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Publicis Groupe, Sony, TikTok and Truepic. Google joined in February 2024 and TikTok moved up to committee member in July 2026, so the line-up shifts from year to year.

The first specification was published in January 2022. The version in force is 2.4, from April 2026, which added among other things a dedicated AI disclosure assertion and the ability to embed credentials in HTML documents and structured text files. The public transparency icon, that small «cr» in the corner of some images, was introduced in October 2023.

Every compatible file carries a manifest store. A manifest groups assertions, which are statements about the file: which camera or program produced it, which editing actions were applied, whether a generative model was involved, which thumbnail corresponds to the original. Those assertions are collected in a claim, and the claim is digitally signed. The specification describes that signature as the digital signature on the claim created with the private key held by the signer.

The link between the manifest and the actual pixels is called a hard binding: one or more cryptographic hashes that uniquely identify the whole file or a portion of it. If someone alters a pixel, the hash no longer matches and the validator flags the file as tampered with. There is also the soft binding, a non-unique identifier such as a fingerprint or an invisible watermark, meant to recover the provenance when the manifest no longer travels attached to the file.

When you edit an image that already had credentials, the earlier version enters the new one as an ingredient, and that is how the edit history is chained together. Not everyone may sign: only X.509 certificates are accepted, and the validator checks them against a trust list. The official C2PA Trust List has been running since mid-2025 under the conformance programme, which also imposes security requirements on products that generate or validate credentials. The earlier interim list was frozen on 1 January 2026, although certificates already issued remain valid for content signed during their period of validity.

Here comes the uncomfortable part. Metadata survives the journey across the internet badly. Many platforms recompress or rewrite files on upload, content management systems re-export them without the manifest, and a screenshot wipes everything: the result is a new file, unsigned, indistinguishable from any other. That is why the absence of credentials proves nothing. Neither that an image is genuine nor that it was manipulated.

The standard itself promises nothing else. The specification states that it should not pass value judgements on whether a given set of provenance data is good or bad, and confines itself to checking whether the assertions are correctly formed, associated with the file and free from tampering. The Content Authenticity Initiative documentation is just as explicit: credentials report origin and history, but they are not meant to rule on whether a piece of content is real.

What the signature attests to is the identity of whoever signed and the fact that the bits have not changed since then. It does not attest that what was signed is true. A signer with a valid certificate can still misdescribe what they did, and the specification acknowledges that the signer is not responsible for the accuracy of metadata outside the manifest, even where the hard binding covers it. Anyone selling Content Credentials as proof of authenticity is selling something the standard does not claim.

• Keep the signed originals in your own archive, with a backup. If one day you have to establish the provenance of a photo, the version published on the website probably no longer carries it.
• Check what your content management system does when you upload an image. WordPress and most CMS platforms generate crops and optimised variants; verify whether the manifest survives that processing before you promise it to anyone.
• Ask the agency or the photographer for files with credentials enabled and put in writing which tool signed them. A contract that only says «original image» is worth nothing two years later.
• Verify files received from third parties with a validation tool before publishing them, especially when they come from stock libraries or social networks.
• Document your editorial process separately: who reviewed each piece, when and against which criteria. That internal record survives the loss of metadata, and that loss is going to happen.
• Treat the credential as additional information for anyone who wants to inspect it, not as a quality seal and not as a sales argument.

• Reading the absence of credentials as a sign of manipulation. Most images in circulation never had any, and many that did lost them along the way.
• Confusing the standard with a detector. Credentials describe what someone declared and signed; they do not analyse the image to work out whether it is synthetic.
• Assuming social networks preserve the manifest. Some read the credentials in order to label automatically, others discard them on recompression, and the behaviour changes with every product update.
• Announcing on the website that all your own images carry Content Credentials without having checked the file the visitor actually receives. One validator run is enough to disprove it.
• Conflating this technical mechanism with the legal duty to label AI-generated content. They are separate matters: signing a file does not by itself satisfy a labelling obligation, and a visible notice supplies no verifiable provenance.