What Is C2PA? How to Verify Content Credentials and Why They Can Disappear
An image with C2PA credentials goes into WhatsApp.
The image comes out. The credential does not.
It sounds like a joke, but it sums up one of the main problems with digital traceability: we can create perfectly valid cryptographic evidence and lose it as soon as the file starts travelling across the internet.
C2PA attempts to answer a question that will become increasingly important:
How can we know where an image came from, which tool created it and what changes were made to it?
What is C2PA?
C2PA stands for Coalition for Content Provenance and Authenticity. It develops an open technical standard for recording the origin and history of digital content.
Credentials created using this standard are known as Content Credentials.
They can be understood as a digital label associated with a file. This label may contain information about:
- The tool or device used to create the content.
- The applications used to edit it.
- Changes declared during the editing process.
- The possible use of artificial intelligence.
- The organisation that signed the credential.
- The cryptographic integrity of that information.
C2PA is not an AI detector that examines pixels and tries to guess what happened. It records information provided and signed during the creation or editing of a file.
That is an important distinction.
An AI detector says: “This looks like it was generated by AI.”
A C2PA credential says: “This tool declares that it participated in creating this file and cryptographically signs that information.”
You can learn more in the official C2PA documentation.
How is C2PA related to the EU AI Act?
The transparency requirements established by Article 50 of the EU AI Act became applicable on 2 August 2026.
Providers of generative AI systems must ensure that certain synthetic outputs can be identified in a machine-readable format. In cases such as deepfakes and some AI-generated texts published to inform the public about matters of public interest, visible disclosure requirements also apply.
The regulation does not specifically require the use of C2PA. It requires marking methods to be effective, interoperable, robust and reliable. C2PA has become one of the main technical standards for meeting those requirements.
The European Commission has also published a Code of Practice on Transparency of AI-Generated Content.
Failure to comply with these obligations may result in penalties of up to €15 million or 3% of a company’s total worldwide annual turnover.
This does not mean that anyone publishing an AI-generated image will automatically receive a fine. The applicable obligations depend on each party’s role: the system provider, the company using it or the organisation publishing the content.
Who uses Content Credentials?
C2PA is no longer a laboratory experiment.
OpenAI includes C2PA metadata and SynthID watermarks in supported images generated through ChatGPT, Codex and its API. Adobe uses Content Credentials across several creation and editing tools. Google has introduced content provenance features, while camera manufacturers including Leica, Sony, Nikon and Canon offer devices capable of signing images.
Some online platforms can also recognise these credentials and display an icon that allows users to inspect the content’s provenance.
On paper, the problem appears to be solved.
Then the file enters the real world.
Why can C2PA credentials disappear?
Content Credentials can be embedded in a file or linked to it. Problems arise when another application processes the content without preserving its provenance information correctly.
This can happen when:
- An image is sent through an application that recompresses it.
- The file is converted to another format.
- It is uploaded to a CMS that generates new versions.
- Image optimisation tools are applied.
- It is published on certain social media platforms.
- Someone takes a screenshot.
A screenshot does not copy the original file. It creates a new one. It may look identical, but it does not necessarily contain the original credentials.
Something similar happens when a platform reduces an image’s dimensions or quality. The user continues to see the same photograph, but technically receives a different file.
Our test with LinkedIn
LinkedIn announced its adoption of the C2PA standard in 2024 and can display provenance information for certain types of content.
However, when testing a standard post, we uploaded an image containing valid C2PA credentials and then downloaded the published version.
The image was still there.
The credentials were not.
This does not mean that LinkedIn never uses C2PA. Its documentation describes support in specific contexts, including certain sponsored content. Our test demonstrates something different: support for C2PA does not guarantee that credentials will survive every publishing and download workflow.
That is the real pipeline problem.
Regulation requires traceability. The standard creates it. But every intermediate conversion can introduce a leak.
How to verify C2PA credentials with Sellat
Sellat allows you to check whether a file contains Content Credentials and inspect the available C2PA information.
You can do this using our C2PA reader:
Verify C2PA credentials with Sellat
When analysing a file, Sellat reads the C2PA information it detects and displays the provenance data that the file still contains.
If no credentials are found, this does not prove that the content was created by a person. It may mean that:
- The file never contained C2PA credentials.
- The tool that created it does not support the standard.
- The credentials were lost during a conversion.
- A platform removed the metadata.
- The content came from a screenshot.
The absence of C2PA does not prove that an image is either fake or authentic. It only means that no verifiable credential was found in that particular file.
Sellat includes C2PA data in its certificates
Sellat’s C2PA compatibility is not limited to its public reader.
When Sellat detects C2PA information during the sealing process, it includes that information in the generated certificate alongside the proof associated with the file.
The certificate therefore brings together two different layers:
- The provenance declared through Content Credentials.
- External proof of which exact file existed and when it was sealed.
C2PA describes the history associated with the content.
Sellat generates a SHA-256 fingerprint of the file and independently anchors proof of its existence. The file does not need to remain stored by Sellat for its integrity to be verified later.
If a platform subsequently removes the credentials, the certificate retains a record of the C2PA information found in the original file when it was sealed.
It does not reconstruct lost metadata or turn a modified copy back into the original. It preserves evidence related to the file that was actually analysed and sealed.
C2PA and Sellat do not do the same thing
C2PA and Sellat solve different parts of the same problem.
C2PA provides context about a file’s provenance, the tools used and its declared editing history.
Sellat proves that a file with a specific digital fingerprint existed at a particular moment and records the credentials it contained at that time.
One technology does not replace the other.
They complement each other.
A credential that exists only inside a file may disappear during its journey. External proof continues to exist even when the pipeline breaks.
Frequently asked questions about C2PA
Can C2PA tell whether an image was generated by AI?
It can indicate the use of AI when the tool that generated or edited the image includes that information in the credential. C2PA does not examine an image and guess whether it came from an AI system. It reads signed declarations about how the content was created.
Is an image without C2PA credentials authentic?
Not necessarily. It may be a real photograph taken with a device that does not support C2PA, an AI-generated image that was never marked or a file whose credentials were removed.
Can Content Credentials be deleted?
Yes. File conversion, recompression, screenshots and platforms that do not preserve metadata can all produce a new file without the original credential.
Does C2PA prove that an image is true?
No. C2PA provides verifiable information about the file’s provenance and declared history, but it does not guarantee that what appears in the image is true or presented in the correct context.
Does Sellat replace C2PA?
No. Sellat reads C2PA information and includes it in its certificate while also generating external proof of existence and integrity. The two technologies provide different and complementary forms of evidence.
How can I check whether an image contains C2PA credentials?
Upload it to the Sellat C2PA reader to check whether it contains Content Credentials and inspect the available information.
Check whether your images still contain their credentials
You do not need to wait for an image to go viral before discovering that its provenance information disappeared during the first upload.
Analyse the original original file, inspect its Content Credentials and, if you need to preserve external evidence, seal it before publishing.