C2PA and SynthID: what marking generated images changes for a publisher

An image generated by an AI in 2026 is no longer an anonymous file. Depending on the provider, it carries signed metadata, an invisible watermark, or both. For a publisher illustrating content with those images, two questions arise: do the marks survive publication, and do they excuse anything? The first depends on the technique. The second calls for a flat no.

Two techniques that do different jobs

The C2PA standard, carried by a coalition that includes Adobe, Microsoft, Google, OpenAI and the BBC, defines Content Credentials: a cryptographically signed manifest attached to the file, describing the content's origin and the operations it has been through. A compatible reader can verify the signature and display the provenance. C2PA's strength is its precision: it says who produced the image, with which tool, and what has changed since. Its weakness is that it lives in the metadata: a crop in a tool that does not support it, a screenshot, or simply an upload to a platform that strips files, and the manifest is gone.

SynthID, developed by Google DeepMind, works the other way: the watermark is written into the pixels themselves, imperceptibly, and it is built to survive compression, cropping, re-encoding and screenshots. It carries no detailed manifest: it lets a detector state that the content was produced by a tool that applies this watermark, and nothing more. Google applies it to its images, its video, its audio and, since late 2024, to text. It is no longer Google's alone: OpenAI adopted it in May 2026 for its images and its audio.

Who marks what in 2026

OpenAI announced the addition of C2PA Content Credentials to its images back in 2024, in a post titled "Understanding the source of what we see and hear online", where the company acknowledges the limit itself: metadata can be removed, deliberately or not. That limit is exactly what has shifted since: OpenAI's documentation states that images generated with ChatGPT, Codex and its API now carry both C2PA metadata and a SynthID watermark, and that its audio carries an inaudible watermark. Stripping the metadata no longer erases the provenance of an OpenAI image. Google marks its output with SynthID and is a C2PA member. The other large providers are on similar paths, pushed by article 50 of the EU AI Act, which requires machine-readable marking from them with a deadline pushed to December 2, 2026 for systems already in service, as we explain in the AI Act timeline.

The movement runs one way: more and more generated images will carry a mark that is hard to strip, and fewer and fewer will pass for photographs after a simple metadata clean. A publisher building a strategy on the idea that "nobody can tell" is already wrong for images.

What marking does not change: the disclosure obligation

Two obligations fall here on two parties that should not be confused. Machine-readable marking is the model provider's obligation. The visible disclosure, where it is due, is the obligation of the publisher. The presence of a SynthID watermark or a C2PA manifest in an image does not excuse a publisher from disclosing a deepfake, and its absence does not release them either. The two mechanisms are independent.

For images, the publisher's disclosure obligation covers deepfakes only: a generated or manipulated image that resembles existing people, objects, places, entities or events and could falsely appear authentic to a person. All five categories matter: a product is an object, a brand is an entity. An abstract illustration, an editorial collage, a diagram, a plainly stylized visual fall outside that category. A realistic photograph of a construction site that never existed, of a client who does not exist, or of a product in a use it does not allow, falls inside.

What a publisher can check alone

Two checks are within any team's reach. The first is to open a generated image in a metadata reader and look for a C2PA manifest: if it is there, you know what the image carries and what a third party will be able to read. The second is to repeat that test after the image has been through the real publishing chain: export from the editing tool, compression by the CMS, upload to social platforms. In most chains the manifest does not survive the second step. There is nothing reassuring in that finding, and it should steer production: what survives is the watermark in the pixels, and that is what detection tools know how to read. The provenance of a generated image should therefore be treated as durably detectable.

A production rule rather than a label

Labeling after the fact is fragile: the disclosure has to be perceived at first exposure, and the image travels on channels where the accompanying text is truncated or missing. Social networks cut captions, stories have none, shares detach the image from its context. Settling the question on every channel and every crop is endless work.

The durable route is upstream, through a three-point production rule:

1. Do not manufacture misleading realism. No fake testimonial in a photograph, no fake client reference, no scene presented as a real event. An owned editorial style (collage, illustration, symbol) is both more distinctive and outside the scope of deepfakes.
2. Keep the provenance where it exists. Do not strip C2PA metadata on export; it costs nothing and documents good faith.
3. Record the decision. For any realistic visual produced anyway, the disclosure is decided at creation and placed where it is seen first, not added when publishing to a given channel.

The decision that makes the question disappear: do not photograph

There is a way to stop deciding visual by visual: produce no figurative images at all. A non-figurative composition, made of shapes, screens, flat areas and overlays, cannot by construction resemble existing people, objects, places, entities or events. It therefore fails the definition of a deepfake, which requires exactly that resemblance and that appearance of authenticity. The disclosure question no longer arises: its object does not exist.

The same choice covers a second regime, one competitors can trigger far faster. Misleading advertising law covers the image as much as the words, and an abstract visual asserts nothing about the product: it shows no result, no construction site, no client. A single production decision, taken once, puts both regimes out of play for every visual on a media property.

It is not free. A staged photograph reads more immediately, and some subjects lend themselves poorly to abstraction. In exchange, a media property publishing every week no longer has legal review to do on its images, gains a recognizable visual identity instead of interchangeable stock pictures, and no longer depends on how well the models render faces and hands, which remains their weak point.

Two limits remain. Abstraction says nothing about the text: a false claim in an article is still misleading, and an environmental claim still has to be documented. And it does not lift the rule on content of public interest, which belongs to the text, not the illustration. It settles the visual, nothing else, but it settles it entirely.

Advertising law bites before the AI Act

A last point the marking debate obscures: on a commercial visual, the regime that applies first is not article 50, it is misleading advertising law, which existed long before AI. An image showing a result the product cannot deliver is misleading, whether it was generated or photographed. In some countries, Germany in particular, competitors can act on that regime within days, without going through any authority. We devote an article to it: "Publishing in Germany: the UWG hits before the AI Act". It is the best reason to adopt this production rule.