What is C2PA? Content credentials and provenance for AI-made ads

By HyperKnown Team·Published September 1, 2026

Every piece of AI-generated media now faces the same two questions: how was this made, and did anyone consent to it? Provenance standards answer the first, and C2PA has become the one the industry settled on. This piece explains what it is, where it is actually deployed in 2026, and how it connects to the consent side of AI advertising.

What is C2PA?

How do content credentials work?

A content credential is a cryptographically signed manifest that travels with the file. It records assertions: which device or tool created the media, whether AI generation was involved, and what edits were applied along the way. Each step in the chain adds its own signed entry, so the finished asset carries an inspectable history rather than a single claim. Anyone can check a credential with free tools such as Content Credentials Verify; a broken or missing signature is itself information.

The standard does not judge content. A credential on an AI-generated ad does not say the ad is good or true; it says, verifiably, that it was AI-generated, by which tool, and what happened to it afterward. That neutrality is why competitors as unlike as news agencies and generative-AI companies can share it.

Who has adopted C2PA?

• Cameras and phones. Leica shipped the first camera with built-in content credentials, and signing at capture has spread through professional bodies from Sony, Nikon, and Canon, plus recent Google Pixel phones and Samsung flagships.
• Creation tools. Adobe's Photoshop, Lightroom, and Firefly attach credentials, as do Microsoft's and Google's image-generation tools; OpenAI adds credentials to DALL-E and Sora output.
• Platforms. TikTok labels AI-generated uploads using C2PA data and has applied such labels to over a billion videos; YouTube, Meta, and LinkedIn read or surface content credentials on uploaded media.
• News organizations. The BBC, Reuters, AFP, and other major newsrooms sign output or run provenance pilots, since authenticity is their product.
• The spec itself. C2PA 2.3, released in December 2025, extended signing to live streams, closing one of the larger gaps.

Why does provenance matter for AI ads?

Because disclosure stopped being optional. Article 50 of the EU AI Act, applying since August 2026, requires AI-generated or manipulated media that resembles real people and could pass as authentic to be disclosed at first exposure, and major ad platforms run their own synthetic-media labeling rules. C2PA's AI assertions are the machine-readable way to carry that disclosure with the asset instead of bolting a caption onto each placement. The law map covers the full regulatory picture.

There is also a softer reason: retrieval. Answer engines and platforms increasingly prefer media whose origin they can verify. An ad with a clean provenance chain is legible to the systems deciding what to show and what to bury, and that legibility compounds as more of the pipeline signs its work.

What are the limits?

Provenance is young. Credentials can be stripped when platforms re-encode uploads, most phone cameras still do not sign at capture, and a file without a credential proves nothing either way. Signing infrastructure has had growing pains, including certificate incidents that paused individual implementations. The honest summary: C2PA tells you how signed media was made, coverage is expanding fast, and it is already the standard every regulation and platform policy points at, but it is a chain that is only as good as its weakest unsigned link.

How does provenance connect to likeness licensing?

This is why HyperKnown treats rights documentation as a provenance problem. Every production starts from an identity-verified creator and a per-project approval, generating consent receipts and license records designed to sit alongside C2PA-style credentials, so a finished ad can answer both questions in a machine-checkable way. The brand workflow piece shows where those records come from.

Adoption facts checked September 1, 2026 against C2PA's published materials and platform announcements. The C2PA site tracks current members and spec versions.