The Label Survives Until Somebody Takes a Screenshot
Content Credentials are the closest thing the industry has to a standard answer for "prove where this came from" — signed, verifiable, and increasingly named in the same breath as AI transparency rules. They are also metadata, which means they are one re-encode away from gone. Building a disclosure programme on them alone is building on a layer that a CDN can delete without telling you.
What Is Actually Inside the Manifest
A Content Credential is a set of assertions plus a signature. The assertions describe the asset's history: the software that created it, whether a generative model was involved and in what role, which edits were applied, and optionally who the issuing party is. The signature binds those assertions to a hash of the file, so any change to the bytes invalidates the credential unless the editing tool understands the format and writes a new one that references the old.
That chaining behaviour is the genuinely useful part. A properly credentialed asset carries not one claim but a lineage: generated here, cropped there, colour-graded in this application, exported by that one. Verification is not "is this real" — it is "here is what the tools that touched this file were willing to sign for."
Note what is missing from that list. There is no assertion that the content is true, no assertion that the depicted event occurred, and no assertion that the signer is honest. A bad actor with a valid certificate can sign a manifest that accurately records a generative pipeline and still publish something profoundly misleading. Provenance answers a narrow question well.
The Two-Layer Shape of a Disclosure Obligation
Transparency requirements that touch synthetic media almost always resolve into two distinct duties, and teams get into trouble by satisfying one and reporting the job done.
The first is machine-readable marking: the artefact should carry, in a form other systems can detect, an indication that it was generated or materially altered by AI. This is where provenance metadata and watermarking live. The second is a disclosure to the human being in front of the content — a caption, an on-screen indicator, an audible statement, a line in the interface — that a reasonable person would actually perceive.
A C2PA manifest is a strong answer to the first and a non-answer to the second. Nobody scrolling a feed inspects metadata. If your compliance memo says "we attach Content Credentials" under a heading about consumer notice, the memo has a gap in it.
Where the Credential Dies
Assume the manifest is lost unless you have specifically tested that it is not. Common destroyers, roughly in order of how often they catch teams by surprise:
- Your own image pipeline. Resize-and-optimise steps in a CDN or build process re-encode the file and drop non-essential metadata by default. This is the single most common failure, and it happens inside the publisher's own infrastructure.
- Platform upload processing. Behaviour varies by platform and changes without announcement. Some preserve and display; some transcode and discard.
- Screenshots. The most-shared form of an image online is a photograph of it. No metadata survives.
- Format conversion and unaware editors. Any tool that does not implement the specification writes out a clean file.
- Messaging and compression. Aggressive recompression for bandwidth is indifferent to what it is deleting.
The practical response is not to abandon provenance. It is to stop treating it as the delivery mechanism for a legal obligation and start treating it as durable evidence at the source — something you can point to when asked what you generated and when, even if the copy in the wild no longer carries it.
Watermarks Fail in the Opposite Direction
Statistical watermarking embeds a detectable signal in the generated content itself. Because it lives in the pixels or the waveform rather than beside them, it survives re-encoding, cropping and screenshotting far better than a manifest does. What it cannot do is carry detail. A watermark tells a detector "this probably came from that model family." It does not tell you the edit history, the operator, or the time.
It is also asymmetric in a way that matters legally: detection generally requires the generator's own tooling or key, so a third party cannot independently verify. And determined removal is an active research area, which means "the watermark is gone" is never proof of anything either.
Metadata is precise and fragile. Watermarks are durable and coarse. Visible labels are the only layer a consumer sees. The reason mature programmes run all three is that each covers a different failure of the other two.
A Workable Programme for a Small Team
- Decide what triggers disclosure. Fully synthetic media, material alteration of a real person or event, and synthetic voice are the categories that carry the most exposure. Purely decorative or heavily abstracted output is a different risk profile. Write the line down; do not leave it to individual judgement.
- Put the visible label in the template. If a caption slot is a required field in the CMS, disclosure survives staff turnover. If it depends on someone remembering, it does not.
- Sign at the last transformation. A credential attached before your optimiser runs is a credential you have already deleted. Move the signing step to the end of the pipeline and verify a published asset, not a staging one.
- Keep the source-side record regardless. Model, prompt or input reference, operator, timestamp, and the output hash, retained in your own systems. This is what answers a regulator or a plaintiff months later, and it does not depend on any downstream platform's behaviour.
- Write the "absence proves nothing" rule. Any internal process that consumes provenance — moderation, vendor intake, evidence review — needs it stated in the procedure, or someone will eventually treat a missing credential as a finding.
The Vendor Question Nobody Asks
If you generate through a third-party API, ask what the provider attaches on output and whether you can configure it. The answers differ widely: some return credentialed assets by default, some offer it as an option, some return bare bytes and leave marking entirely to you. That single answer determines whether your marking obligation is a configuration flag or a build.
Ask the same question of every tool between generation and publication. The chain is only as good as its least aware link, and the least aware link is usually something boring that was installed for performance reasons three years ago.
Common Questions
Are Content Credentials legally required?
No specification is mandated by name in the rules we see. Obligations are written in terms of outcomes — machine-readable marking, effective consumer notice — and C2PA is the most widely deployed way to meet the machine-readable half. Choosing it is a practical decision, not a statutory one.
Do we need credentials on AI-assisted work, or only fully generated output?
Follow your trigger definition, not the tooling. The risk concentrates where an ordinary viewer would be misled about whether something real happened. A generated photorealistic scene needs disclosure; a model-assisted colour correction on a genuine photograph generally does not, and over-labelling trains users to ignore the label.
What certificate do we sign with?
One issued by an authority the verifying ecosystem recognises. A self-signed manifest verifies as intact but does not establish who signed it, so it carries little weight with anyone outside your organisation. Decide early whether you need external recognition or only internal integrity.
Should our detection tooling reject uncredentialed uploads?
Only if you are prepared to reject most authentic content in the world. Adoption is nowhere near universal, and stripping is routine. Use present-and-valid credentials as a positive signal and never use their absence as a negative one.
How long should we keep the source-side provenance record?
Long enough to cover the limitation period for the claims that would make you want it — advertising, publicity, defamation, consumer protection. That is usually years, not months, and it is a different retention decision from the one governing the media asset itself.
Does this apply to text?
The specification is built for media, and text provenance is far weaker in practice because text is copied by retyping and paraphrase as much as by file transfer. Disclosure duties around AI-written material are generally met in the visible layer — a byline note or an interface statement — not through file metadata.
What Does Your Site Say About How You Use AI?
Disclosure is not only a caption on an image. Buyers, regulators and AI assistants all read your public pages first, and what they find there is treated as your stated position on how you generate and handle content.
Run a free scan of your site to see what is actually published about your AI and data practices today.