C2PA

C2PA is the Coalition for Content Provenance and Authenticity, and the open technical standard it publishes. The standard writes a file's history (where an image, video or audio file came from, how it was edited and whether AI was used) into a signed, tamper-evident record attached to the file. That record is called a Content Credential, also known as a C2PA Manifest.

What does C2PA stand for, and what are Content Credentials?

The coalition's home page puts the two names side by side: "The Coalition for Content Provenance and Authenticity, or C2PA, provides an open technical standard for publishers, creators and consumers to establish the origin and edits of digital content. It’s called Content Credentials".

In everyday use the names are interchangeable. Strictly, each means something different:

The C2PA explainer lists what a record can hold: "statements about the asset, such as its origin (i.e., when and where it was created), modifications (i.e., what happened using what tools) and use of AI (i.e., how it was authored)."

What does a Content Credential prove?

That the record is intact and who signed it, not that the picture is true. The explainer is direct about this: Content Credentials "do not provide value judgments about whether a given set of provenance data is 'true', but instead merely whether the provenance information is well-formed and free from tampering, valid and trusted".

The record is tamper-evident because it is bound to the file by a cryptographic hash: "any alteration to either the asset or the provenance, however insignificant" breaks the match. "Trusted" means the signer is "associated with a known trust list".

Can C2PA metadata be removed?

Yes. The explainer's answer to that question opens: "Yes it can." Its fix is "durable Content Credentials", which pair the signed record with a watermark or fingerprint so it can be found again "even if it is removed from the asset".

The record can also go stale without being removed. The explainer gives the example: "if an asset is cropped using a non-Content Credentials aware tool, the provenance data may not be updated to reflect that action."

How does Meta use C2PA in ads?

As one way to spot AI tools. Meta's AI info help page says: "Meta uses industry-standard detection methods, such as C2PA to identify when ad content has been created or edited using third-party generative AI tools. When we detect this metadata, we label the content accordingly." The label is the AI info label.

"Such as" is an open list: C2PA is the method Meta names, not the only one it says it uses. How Meta detects AI in ads covers where that label appears and what Meta does and doesn't say it costs you.

The EU's AI Act puts a related duty on AI tool providers: output "marked in a machine-readable format and detectable as artificially generated or manipulated" (Article 50(2)). That mark is for software, not viewers, and the Commission's guidelines say an advertiser "cannot rely on" it to meet its own duty to label a deep fake. What the AI Act asks of advertisers has the detail.

What it means for your ads

• Expect the label when a file carries AI provenance. If the tool that made your image wrote a Content Credential, Meta has told you it reads that.
• Editing can drop or outdate the record. A re-export through a tool that doesn't support C2PA may leave no record, or an incomplete one.
• Removing it doesn't remove your obligations. Meta's disclosure rule for ads about social issues, elections or politics, and the EU's deep-fake label, apply whatever the file header says.

Common mistakes

• Reading a credential as proof of truth. It proves the record is intact and names the signer. Whether the content is accurate is a separate question.
• Reading no credential as proof a human made it. The explainer's answer to "Should I distrust media without Content Credentials?" is "Maybe": adding provenance "is optional".
• Calling it a watermark. The record is signed data attached to the file. A watermark is one optional way to find it again after it's stripped.

Sources

• C2PA home page — Coalition for Content Provenance and Authenticity: the coalition's name and "It’s called Content Credentials" (fetched, accessed 2026-10-16)
• C2PA and Content Credentials Explainer, version 2.4 — C2PA: Content Credential as "also known as a C2PA Manifest", what assertions cover, the no-value-judgments and tamper-evidence answers, removal and durable credentials, the cropping example, "Maybe" (fetched, accessed 2026-10-16)
• About AI info on ads created or edited with generative AI tools — Meta Business Help Center: C2PA as an example of Meta's detection methods (rendered in a browser, accessed 2026-10-16)
• Regulation (EU) 2024/1689 (Artificial Intelligence Act) — EUR-Lex: the Article 50(2) machine-readable marking duty (rendered in a browser, accessed 2026-10-16, for the linked post)
• Guidelines on transparency obligations for providers and deployers of AI systems — European Commission, 20 July 2026: paragraph 117, deployers "cannot rely on" the provider's marking (read in full, accessed 2026-10-16, for the linked post)

---

The C2PA pages are static and were fetched and read in full on 16 October 2026; the explainer quoted is version 2.4. Meta's help page is client-rendered and was read in a real browser the same day. Meta revises it without notice, so check the source before acting on any of it.

Terrads makes image, video and audio ads for Meta and other placements, with your brand library carried into every one.