What Is C2PA? AI Content Labels & Disclosure Rules Explained

You made a campaign image with AI. You posted it. Instagram quietly stuck an "AI info" label on it, and now you are wondering who decided that, whether it hurts your reach, and whether you were supposed to declare it yourself.

The answer to all three runs through C2PA. This guide is about what it means for you as a publisher: which tools attach it, how each platform reacts, whether labels cost you distribution, and what you are now legally required to disclose.

What is C2PA, in one paragraph?

C2PA is an open technical standard for recording where a piece of media came from. Its user-facing name is Content Credentials. When a compliant tool creates or edits an image, it attaches a cryptographically signed record naming the software, the date, and whether generative AI was involved. Social platforms read that record and use it to label posts automatically.

It stands for the Coalition for Content Provenance and Authenticity. It was founded by Adobe, Arm, BBC, Intel, Microsoft and Truepic, and has since been joined by Google, OpenAI, Meta, Sony, Amazon and most of the major camera manufacturers. That membership list is the reason this matters: it is not a proposal, it is already shipping in the tools you use.

The key difference from ordinary EXIF metadata is signing. Anyone can type a fake camera name into EXIF in seconds. A Content Credentials manifest is signed with a certificate, so altering the image breaks the signature and the tampering becomes visible.

What is actually inside a Content Credentials manifest

Component	What it records
Issuer and certificate	Which company or application signed the file — OpenAI, Adobe, Google, a camera maker.
Generative AI assertion	An explicit flag that a generative model produced or altered the content. This is the field platforms key their labels off.
Ingredient history	Whether the image came purely from a text prompt, used reference images, or was edited afterwards, and which assets fed into it.
Actions	The edits applied — cropped, colour adjusted, generative fill, object removed.
Digital signature	A cryptographic hash binding the manifest to that exact file. Change the pixels and validation fails.

Notably absent: your prompt. Content Credentials record that AI was used, not what you typed. Prompt text lives in a completely different part of the file, which is a separate topic covered in our guide to viewing AI image metadata and prompts.

Which AI tools attach Content Credentials?

Tool	Content Credentials attached?
OpenAI (DALL-E 3, ChatGPT images)	Yes, signed manifest plus an IPTC marker identifying the image as algorithmically generated.
Adobe Firefly & Creative Cloud	Yes, and the most detailed of any — full edit history through Photoshop and Lightroom.
Google (Gemini, Imagen)	Yes, plus SynthID watermarking embedded in the pixels themselves.
Microsoft Designer / Copilot	Yes.
Midjourney	No signed manifest. Identifiable from other metadata fields instead.
Local Stable Diffusion, ComfyUI	No. Self-hosted pipelines sign nothing unless you add it deliberately.

The practical takeaway for a marketing team: your generator choice decides whether your posts get labelled. Firefly and ChatGPT images arrive pre-labelled. A local Stable Diffusion render does not.

Content Credentials vs. SynthID vs. invisible watermarks

These get conflated constantly, and they behave completely differently under editing:

	Content Credentials (C2PA)	SynthID and similar
Stored in	A signed metadata block in the file header.	The pixel data itself, as imperceptible patterning.
Survives re-encoding?	No. Stripped by most social uploads and CDN pipelines.	Largely yes, by design.
Survives screenshotting?	No.	Often yes.
Human readable?	Yes, anyone can inspect it.	No, detection requires the issuer's own tooling.

This is why the industry is converging on durable credentials — pairing a signed manifest with an invisible watermark, so that when one is stripped the other still carries the signal.

How each platform turns credentials into AI labels

Platform	What it does
Instagram, Facebook, Threads	Reads C2PA and other AI signals and applies an "AI info" label automatically. Creators are also expected to self-declare photorealistic AI content.
TikTok	Was the first major platform to auto-label using Content Credentials, and requires creators to toggle an AI-generated switch on realistic content.
YouTube	Requires disclosure of realistic synthetic content during upload, then shows an "altered or synthetic" note in the description or on the player.
LinkedIn	Detects C2PA manifests and surfaces a Content Credentials indicator on the post.

Two things follow. First, labelling is not fully automatic — every one of these platforms also expects you to self-declare realistic AI content, and stripping a manifest does not remove that obligation. Second, because platforms re-encode uploads, a manifest surviving to the viewer is inconsistent. Never assume a missing label means an image was not AI-generated.

Does an AI label hurt your reach?

The honest answer: no platform has said an AI label directly demotes a post, and there is no reliable public evidence of a ranking penalty tied to the label itself. What does affect performance is more mundane:

• Audience response. In some niches an AI label reduces engagement because followers trust the content less. In design, tech, and marketing audiences it often has no measurable effect at all.
• Undisclosed AI that gets caught. This is the real risk. Failing to declare realistic synthetic content breaches platform policy and can cost you distribution or the post itself — a far worse outcome than the label.
• Category matters. An obviously stylised illustration carries a label fine. A photorealistic image of a product or a person invites scrutiny.

The workable position for most brands is to disclose deliberately rather than get labelled by surprise: say it in the caption, in your own voice, on the content where it matters.

What you are actually required to disclose

Disclosure moved from good practice to obligation across 2025 and 2026, on two separate tracks:

• Platform policy. Meta, TikTok, and YouTube all require creators to declare realistic AI-generated or AI-altered content. This applies to you today regardless of any law, and enforcement is a policy matter, not a legal one.
• Regulation. The EU AI Act carries transparency obligations for AI-generated content that apply from August 2026, requiring providers and deployers to make synthetic content identifiable. Advertising regulators and consumer-protection bodies in several markets separately treat undisclosed synthetic endorsements or testimonials as deceptive.

Rules differ by market and by what you are publishing, and this is a summary rather than legal advice — if you run paid campaigns across regions, confirm your obligations with someone qualified. The safe default is simple: if a reasonable viewer could mistake it for a real photograph, say that it is not.

Is it legal to remove a Content Credentials manifest?

Removing metadata from your own images is normal, legitimate practice, and every social platform already does it to you automatically on upload. The intent is what separates routine housekeeping from a real problem:

• Reasonable: stripping prompts, client names, camera GPS and bloated generation data before publishing — standard pre-publication hygiene that also cuts file size.
• Not reasonable: removing a manifest specifically so photorealistic synthetic content passes as a genuine photograph, particularly in news, political, or advertising contexts. That is the behaviour disclosure rules exist to catch, and stripping the file does not discharge your obligation to declare it.

What this means for your workflow

• Know what your generator attaches. ChatGPT and Firefly assets arrive pre-labelled; local Stable Diffusion assets do not. That decides how your posts appear before you write a single caption.
• Check before campaigns, not after. Inspect what a file carries while you can still change the plan.
• Clean prompts and client data before publishing, which is a separate concern from provenance — see how to remove AI metadata from images.
• Disclose in the caption on realistic content. Own the framing instead of letting an automated badge do it for you.

Frequently asked questions