Measuring C2PA and AI Watermarking: KPIs That Prove Value

Content Credentials are metadata: a signed record of who created a file, with which tools, and what edits were made. Anyone can inspect them with tools like the Content Credentials verify site. Their weakness is that metadata can be stripped, intentionally or by software that ignores it.

Watermarks are embedded in the content itself. SynthID, for example, is applied by Google to content generated with some of its models and is designed to survive common edits such as compression. Watermarks are harder to remove but carry less information and need a specific detector to read. The two methods complement each other, and C2PA has added ways to bind credentials more durably to content.

Define KPIs across the asset lifecycle: creation, publishing and reception.

• Coverage: share of official images, videos and audio files that carry Content Credentials at creation.
• Survival: share of those files that still carry valid credentials after passing through your CMS, social scheduler and press distribution.
• Disclosure accuracy: share of AI-generated or AI-edited assets correctly marked as such.
• Platform display: share of published assets where LinkedIn, Meta, YouTube or other platforms show a provenance or AI label.
• Verification requests handled: how often journalists or partners ask whether an asset is genuine, and time to answer.

Survival is usually the eye-opening KPI. Many teams find that files leave the design team with credentials and arrive on the website without them, because an image optimiser or plugin stripped the metadata along the way.

Run a pipeline test. Create a set of test files with Content Credentials, using cameras or software that support C2PA, such as Adobe Photoshop and Lightroom or Firefly. Push each file through every route it normally travels: CMS upload, image optimisation, social schedulers, press release distribution, email tools.

Then download the published versions and inspect them with a verification tool. Record which routes kept the credentials and which removed them. Repeat after any change to your stack, because a plugin update can change behaviour without warning.

Fixing common strip points

Image compression plugins, CDN transformations and some resizing services discard metadata by default. Check their settings for an option to preserve metadata, or switch to tools that support C2PA. Where a platform strips credentials and cannot be changed, keep the original signed file in an accessible press archive so it can be verified on request.

Several major platforms read C2PA data. LinkedIn has shown Content Credentials information on some images, Meta has used industry signals including C2PA to apply AI labels, and YouTube has added labels for content captured with C2PA-compatible tools and asks creators to disclose realistic synthetic content. Behaviour differs across platforms and changes over time, so record what you observe rather than assuming.

Track platform display as a KPI because it shows what audiences actually see. A file with perfect credentials that no platform displays provides proof on request but no visible trust signal.

The value is mostly risk reduction, which is hard to count until something goes wrong. Still, a few indicators help build the case.

Track incidents: fake or altered assets attributed to the company, and how quickly they were rebutted. Track verification requests from media and how fast your team answered with evidence. Track the number of press assets reused correctly by publications. Over a year, these show whether provenance makes the communications team faster and more credible during disputes.

Provenance proves origin; it does not prove truth. A signed photo can still be misleadingly framed. And absence of credentials does not mean a file is fake, since most content online still carries none. Communicate this clearly, so stakeholders do not over-read either signal.

Watermark detection is also limited to the systems that apply it. A SynthID detector finds SynthID marks, not marks from other providers. No universal detector exists at the time of writing.

A short written policy turns the KPIs into routine. Keep it to a page and review it twice a year.

• Which tools must have Content Credentials switched on.
• Which asset types are always signed: press photos, executive video, official statements.
• How AI-generated and AI-edited assets are labelled on each channel.
• Where signed originals are archived and who can access them.
• Who answers verification requests, and the target response time.