C2PA — Content Credentials

What Is C2PA?

C2PA stands for the Coalition for Content Provenance and Authenticity. It is a cross-industry technical standard that defines how cryptographically signed manifests are embedded in media files — images, video, audio, and documents — to create a tamper-evident record of content origin and edit history.

When you see a "Content Credentials" badge on an image, that is C2PA in action.

How a C2PA Manifest Works

A C2PA manifest is a data structure attached to a media file at creation time. It contains signed assertions — claims about the file — such as:

• Who created the content (identity assertion, optionally tied to a verified identity)
• What tools were used (e.g., Adobe Photoshop, Midjourney, Gemini)
• What edits were made and when
• Whether AI was involved in generation or editing
• Where the content was captured (GPS coordinates for cameras)

Each assertion is cryptographically signed by the creating tool or service. If the file is tampered with, the signature fails verification — the tampering is detectable.

Who Has Adopted C2PA

C2PA is backed by a coalition including Adobe, Microsoft, Google, Intel, the BBC, Reuters, the Associated Press, the New York Times, and Leica and Nikon. As of 2025, C2PA is the de facto standard for publisher-facing content authenticity in the professional media industry.

C2PA vs. Watermarking

C2PA and AI watermarking solve related but different problems. C2PA is a provenance tool — it answers "where did this come from and who touched it?" Watermarking is a detection tool — it answers "is this AI-generated?" regardless of origin metadata.

C2PA manifests can be stripped from files (though stripping is itself detectable). Watermarks like SynthID survive more transformations. Best-practice implementations combine both.

Limitations

C2PA does not prevent creation of synthetic content — it only attaches verifiable provenance. Platform adoption is fragmented: our C2PA platform audit found only 4 of 12 major platforms implement full manifest verification at the point of display. Most users never see Content Credentials even when they exist.