What the check reads
Two markers a file can carry about how it was made. Content Credentials, the signed record defined by the C2PA standard, can name the tool that wrote the file and, on each action it records, a digital source type. The same IPTC source types can also sit in the file's XMP metadata as a plain, unsigned line. IPTC names three of them after generative AI: Created using Generative AI, Edited using Generative AI, and Composite including generative AI elements.
- Says AI-made
- One of the markers names one of those three source types.
- Content Credentials
- A signed record is there, and it names no generative AI source type.
- Declares its source
- The XMP names another source type, such as Digital capture sampled from real life, and there is no record.
- No markers
- Neither marker is in the file.
Which files it reads
JPEG, PNG and WebP images, and MP4, MOV, HEIC and AVIF files. Each format keeps the record in its own place, a set of segments near the start of a JPEG, a chunk of a PNG or WebP, a box of an MP4, and the check looks in each. In a long video it reads only those parts, so the length of the video hardly matters. A GIF or any other format is listed as not read.
A file with more than one record
Each record in a file is one step of its history. When an ad is edited in a tool that supports the standard, or assembled from other files that carry records, the earlier records come along. The C2PA explainer calls those source files ingredients: “Each ingredient that is used in the (composed) asset is recorded in that asset's provenance”, which makes “a tree of provenance, much like a family tree”. The check counts the records, names the tool behind the latest one, and says AI-made when any record in the tree names a generative AI source type. A product photo from a camera with an AI background added later counts.
What the platforms say they do with them
Meta reads them. Its help page says it uses “industry-standard detection methods, such as C2PA” to identify ad content created or edited with third-party generative AI tools, and “When we detect this metadata, we label the content accordingly.” The AI info label usually sits in the ad's About this ad screen rather than on the ad. For posts, Meta's newsroom described tools that read “the ‘AI generated’ information in the C2PA and IPTC technical standards”, the two markers this check reads.
TikTok labels posts that arrive with a record: its support page says a post is labelled when a creator “uploads AI-generated content that has Content Credentials attached”, and the label can't then be removed. For ads it puts the duty on you, with a mandatory disclaimer for “AI-generated, synthetic, or manipulated media” that you switch on in TikTok Ads Manager whatever the file carries.
YouTube lists “Content that contains C2PA metadata” among the videos it may label automatically. Google Ads gives each asset a setting, “Label this asset as created or edited with AI”, and says it may also label ads itself “when we get signals to do so from other platforms”. What Meta, TikTok and Google require has the detail for each.
In the EU, Article 50(2) of the AI Act asks the providers of generative AI tools to mark their output in a machine-readable way, which is what these markers are. The Commission's guidelines say the advertiser “cannot rely on the machine-readable marking embedded in the content by the provider” for its own duty to disclose a deep fake. What the AI Act asks of advertisers covers that duty.
Why a file can lose its markers
Asked whether Content Credentials can be removed, the C2PA explainer answers “Yes it can.” Saving a new copy in software that doesn't support the standard can drop the record, and the explainer notes that when a file is “cropped using a non-Content Credentials aware tool, the provenance data may not be updated to reflect that action.” So check the file you will upload, after the last export, rather than the one the AI tool gave you.
What to do with the result
Knowing which files say they are AI-made tells you which ads Meta may put an AI info label on, and which files already carry the machine-readable mark the AI Act asks of the tools that made them. It doesn't decide whether you have to disclose anything yourself: that depends on the platform, the region and what the ad shows. Meta documents no delivery or eligibility consequence for its label, and how Meta detects AI in ads goes through why stripping the record to avoid it is a poor trade.
Two results are worth a second look. A file that says nothing while you know AI made it has probably been through an editor or an export that dropped the record; if you need the mark kept, export again from a tool that carries it over. And a file whose record names a tool you don't recognise came from somewhere in its history you may want to ask about before it runs under your name.
What a signature check adds
This check shows what a record says. Whether the record is intact and who signed it takes a validator, which hashes the file and checks the signer's certificate. Content Credentials Verify, at verify.contentauthenticity.org, is one that runs in a browser. The explainer is clear about the limit of either: Content Credentials “do not provide value judgments about whether a given set of provenance data is ‘true’”.