C2PA is an open technical standard for content credentials: signed metadata attached to an image, video or audio file that records who made it, with which tools and whether AI was involved. AI watermarking hides a signal inside the content itself. Used together in campaigns, they help brands show where their media came from and meet growing disclosure expectations for synthetic content.
The Coalition for Content Provenance and Authenticity, which publishes C2PA, was founded by companies including Adobe, Microsoft, Intel, the BBC and others; Google, OpenAI, Meta and Amazon have since joined. Adobe’s Content Authenticity Initiative promotes the same credentials under the name Content Credentials, shown by a small “cr” icon. Google’s SynthID is a separate watermarking technology built into its generative models.
What does C2PA actually prove?
A C2PA manifest is cryptographically signed. It can show which organisation signed the file, what tool created or edited it, what earlier versions or ingredients it was built from and whether generative AI was used. If someone alters the file without updating the manifest, verification shows the mismatch.
It does not prove the content is true, and it is worth saying this clearly to clients. A signed photo of a staged event is still staged. It proves provenance, meaning where the file came from and what was done to it, which is a different and narrower claim.
How is watermarking different?
Metadata can be stripped. Many social platforms and messaging apps remove metadata when files are uploaded or compressed, and a screenshot removes it entirely. Watermarking aims to survive that by embedding a signal in the pixels or audio waveform that detection tools can read later.
SynthID, for example, marks content from Google’s Imagen, Veo and Lyria models and some Gemini text output. OpenAI adds C2PA metadata to images from its image generators. Watermarks can still be weakened by heavy editing, and detection tools are usually specific to one provider’s watermark, so neither method is complete alone.
Which tools support content credentials?
Support is growing, though uneven at the time of writing. Check each tool’s current documentation before building a workflow on it.
- Adobe Photoshop, Lightroom and Firefly can attach Content Credentials at export
- Several camera makers, including Leica, Sony and Nikon, have released models or firmware that sign photos at capture
- OpenAI image generation adds C2PA metadata to outputs
- LinkedIn displays a content credentials label on supported images
- Some platforms, including YouTube and Meta, read C2PA signals to help apply AI labels
- The Content Authenticity Initiative’s verify site lets anyone inspect a file’s credentials
Why should brands bother?
Three reasons come up in client conversations. First, regulation: the EU AI Act expects providers of generative systems to mark output in a machine-readable way and deployers to disclose deepfakes. Second, platform rules: Meta, TikTok and YouTube ask for AI disclosure in certain cases and use provenance signals to apply labels. Third, reputation: when a fake image of a brand’s product or executive circulates, being able to point to signed originals helps PR teams respond.
There is also a quieter benefit. A clear record of which assets were AI-generated makes rights management easier when a campaign is reused years later. Copyright protection for purely machine-generated work is limited in several countries, so knowing which images were generated and which were shot or drawn by a person affects what the brand can claim to own. Provenance data answers that question without digging through old email threads.
What are the limits?
Credentials only help if they survive the journey and someone checks them. Many platforms still strip metadata, few audiences know what the “cr” icon means and bad actors simply publish without credentials. Absence of credentials proves nothing. For now, content credentials are most useful as evidence a brand can produce on request, rather than as a label the public reads.
Cost is rarely the barrier. Most of the tools above include credentials at no extra charge; the real work is changing habits so files keep their metadata from export to upload.
Detection also has a gap. A file with no watermark might be human-made, made with a tool that does not mark output, or stripped of its marks. Treat detection results as one signal among several, never as a verdict.
Privacy is another consideration. Manifests can include names, locations and edit history. Decide what information to include before signing, especially for photos of staff or customers.
A practical campaign workflow
Provenance works best when it is part of production rather than added at the end.
Steps per campaign
- Decide in the brief which assets will be AI-generated, AI-edited or fully human-made
- Enable Content Credentials in Adobe tools and keep generator metadata intact
- Sign final exports with the agency’s or client’s credentials where supported, using a certificate the client controls for long-term assets
- Keep master files with full metadata in the asset library
- Add visible disclosure text for realistic synthetic people or events
- Check a sample of published assets on the verify site after upload to see what survived
How Alien Road applies C2PA and AI watermarking
In a typical engagement, discovery reviews the client’s creative pipeline: which design and generation tools are used, where files are stored and which platforms the campaign will run on. We note where metadata is likely to be stripped.
Setup includes enabling credentials in supported tools, a file naming and storage rule for masters, a disclosure line for synthetic media and a short guide for the client’s PR team on how to verify an asset when a fake circulates. Measurement is a post-launch check: a sample of published assets is run through verification tools, and the report shows which platforms kept credentials and which removed them. That record also supports the client’s compliance documentation.
Where to start this week
Take five recent campaign images and upload them to the Content Authenticity Initiative’s verify tool. Note which ones carry credentials and which do not.
Then turn on Content Credentials in your Adobe apps and write a one-line rule in your brief template: every asset is marked as AI-generated, AI-edited or human-made before production starts.
Keep reading: PR Services · Digital PR