What are Content Credentials (C2PA)?
A signed record inside an image of how it was made and edited. What it contains, who adds it and what it can reveal about you.
Content Credentials are a record stored inside an image file that says how the image was made and changed: which camera or app created it, which edits were made, and sometimes who made it and whether AI was involved. The record is signed, so changes to it can be detected. The standard behind it is C2PA, from the Coalition for Content Provenance and Authenticity, whose members include Adobe, Google and Microsoft.
Who adds them
- Phones and cameras: the Google Pixel 10 adds them to every JPEG photo its camera takes, and some newer professional cameras can add them too.
- Editing apps: Adobe Photoshop and Lightroom can add them when you export, and Google Photos when you edit.
- AI image tools: many add them to everything they make, to say the image was generated with AI.
What they can reveal
Content Credentials are meant to show where an image comes from, which is useful for news photos and for showing your own work is yours. When you share a private photo, the same record can tell people more than you meant:
- the device and apps you use, and when the photo was taken or edited;
- sometimes your name or account, if an app adds it;
- the earlier images it was made from, sometimes with small previews of them, such as the photo before it was cropped;
- sometimes a link to a copy of the record kept online.
Where you see them
LinkedIn shows a small CR icon on images that carry them (what it shows). Facebook, Instagram and Threads read them to decide whether to label a photo “AI info” (why). To look inside a file yourself, the free PhotoCleanr report lists the apps its Content Credentials name and whether they say AI was used.
Removing them
PhotoCleanr removes Content Credentials together with the location and other metadata, without re-encoding the picture. It doesn’t remove them when they contain author or rights information, limits on AI training, or records it can’t read: it leaves that image unchanged, at no cost, and the report says why. Removing them from a file doesn’t delete a copy kept online.
Content Credentials aren’t the same as an invisible watermark, such as Google’s SynthID, which is hidden in the pixels themselves. PhotoCleanr doesn’t change pixels, so it leaves those. And removing the record doesn’t change where an image comes from: if it was made or changed with AI, any duty to say so when you publish it stays.