An open standard anyone can implement
C2PA is a standards body. It defines how provenance manifests are structured, embedded, and verified. It is not a platform or a certification body.
C2PA standard
The C2PA standard
The Coalition for Content Provenance and Authenticity defines how cryptographic provenance is embedded in digital content. 400+ member organizations, with 6,000+ members in the Content Authenticity Initiative. C2PA 2.4 is the current specification.Encypher authored the C2PA standard for unstructured text, published in C2PA 2.3 on January 8, 2026 - the framework for embedding and verifying provenance in articles, posts, and unstructured text.
400+
Member organizations
2021
Year founded
2.4
Latest specification
The coalition
What Is C2PA?
The Coalition for Content Provenance and Authenticity (C2PA) is a standards body that publishes open technical specifications for digital content provenance. It defines how content provenance manifests are structured, embedded, and verified. It does not sell a product, run a platform, or certify anyone.
Free to implement
The specification is open and free to implement, governed as a community specification under the Joint Development Foundation, an affiliate of the Linux Foundation, with working groups for specific media types and use cases.
Backed by the industry
Adobe (which operates the Content Authenticity Initiative), Microsoft, Google, BBC, Reuters, OpenAI, Qualcomm, Intel, Arm, NVIDIA, Sony, and Truepic are members. Encypher co-chairs the Text Provenance Task Force.
History
C2PA History and Versions
2021
C2PA founded by Adobe, Arm, Intel, Microsoft, Qualcomm, and Twitter. Content Authenticity Initiative (CAI) launched to promote adoption.
2022
C2PA 1.0 published. First specification defining the JUMBF manifest structure, COSE signing, and claim format for images and video.
2023
C2PA 1.3 published. Added support for audio, live streams, and expanded ingredient chain capabilities. Adoption grows in camera hardware (Leica, Nikon) and social platforms (LinkedIn, TikTok).
2024
C2PA 2.0 published. Significant revision to the manifest structure, improved cross-platform compatibility. EU AI Act enters into force (August 2024). Google, OpenAI join as major members.
Jan 8, 2026
C2PA 2.3 published. The standard for unstructured text was included as Section A.7, authored by Encypher, and renumbered to Section A.8 in C2PA 2.4. It provides a framework for embedding and verifying provenance in unstructured text. EU AI Act Article 50 marking obligations have applied since August 2, 2026.
Current
C2PA 2.4 is the current published specification. Coalition membership has grown to 400+ member organizations, with over 6,000+ members in the Content Authenticity Initiative.
Under the hood
How C2PA Manifests Work
A C2PA manifest contains four main components. You do not need to understand the technical details to use C2PA - the Encypher API handles all of this automatically - but understanding the structure helps in evaluating the standard.
JUMBF
JUMBF Container
For images and media files, the manifest is stored in a JUMBF (JPEG Universal Metadata Box Format) container embedded in the file's binary. JUMBF is a standardized format for metadata boxes that supports nesting - a manifest can contain multiple claims, each with its own signature. The container is part of the file but ignored by applications that do not implement C2PA.
CBOR
Claim Structure
A claim is the core data unit in a C2PA manifest. It records: who created or modified the content (the assertion), what actions were taken (the actions list, such as "created," "edited," "transcoded"), the content hash at signing time, and any ingredients (source files used to produce this file, with their own manifests). Claims are structured as CBOR (Concise Binary Object Representation) for compact encoding.
COSE
COSE Signature
COSE (CBOR Object Signing and Encryption) is the signing standard used for C2PA claims. It is the same cryptographic foundation as JOSE (JSON Object Signing and Encryption) but uses CBOR encoding for compactness. The COSE signature covers the claim hash. If the claim is altered after signing, the signature verification fails. The signer's public key certificate is included in the manifest for independent verification.
X.509
Certificate Chain
The manifest includes the signer's X.509 certificate chain, which allows any verifier to validate the signature without a central registry. Publishers sign with an Encypher-managed certificate, or with a white-label identity certificate issued from the Encypher root Certificate Authority for organizations that want their own tool and organization identity. The chain anchors to a trusted root certificate authority, the same infrastructure used for TLS and code signing.
Text provenance
C2PA for text: the unstructured-text standard
Standards Authority
Encypher authored the C2PA standard for unstructured text, part of the C2PA 2.3 specification. Erik Svilich co-chairs the C2PA Text Provenance Task Force. This is the definitive standard for embedding provenance in unstructured text content.
The official C2PA Conforming Products List records Encypher as a conformant generator product at assurance Level 1, with generation and validation coverage across 20 media types (conformance dated May 26, 2026). Encypher's claim-signing and timestamp authorities appear on the official C2PA Trust Lists.
Text presents unique challenges for content provenance. Unlike image or video files, plain text has no binary container to embed a JUMBF manifest. The C2PA standard for unstructured text defines three encoding approaches:
Invisible Text Encoding
Encypher's text provenance technology embeds C2PA manifest data invisibly within text content. The encoding is undetectable to readers and survives copy-paste across digital platforms. This is Encypher's primary text encoding method.
Sidecar Manifest
A separate manifest file accompanying the text content. Useful for content management systems where modifying the text itself is not appropriate. The manifest references the text content by hash.
Remote Reference
The text includes a reference (URL or cryptographic identifier) to a manifest stored externally. Provides a path for very long documents where inline embedding would be impractical.
C2PA authenticates text at the document level. Sentence-level Merkle tree attribution - which identifies exactly which sentences were used or modified - is Encypher's proprietary technology, built on top of the C2PA framework.
Comparisons
C2PA vs. Other Approaches
C2PA vs. SynthID
SynthID (Google DeepMind)
Statistical watermarking that embeds imperceptible patterns in AI-generated images and audio. Detection is probabilistic. It cannot prove who created content or when, is fragile under aggressive compression, and is proprietary to Google.
C2PA
Cryptographic: verification succeeds or fails with certainty. It proves the author and the time, stores the manifest in a dedicated container, and is an open standard.
C2PA vs. Blockchain provenance
Blockchain provenance
Records content hashes on a distributed ledger. The record lives on the chain, not in the content, so it is lost when content is copied or redistributed without the chain reference. It also adds transaction cost and latency.
C2PA
Manifests are embedded in the file and travel with it. Verification is free and offline.
C2PA vs. Fingerprinting
Perceptual hashing and fingerprinting
Identifies content by its visual or acoustic characteristics via a database lookup. It requires a populated database and cannot prove creation date or rights terms.
C2PA
A signing system: the manifest carries all verification data and is self-contained, including creation date and rights terms.
C2PA vs. AI detection
AI detection
Classifies content as human or AI with machine-learning models. It produces probabilities, not proof, with significant false-positive rates that carry serious academic and professional consequences.
C2PA
A manifest records what the content is. On AI-generated content it records that the content was AI-generated, and on human-authored content it records that too.
Adoption
Who Implements C2PA
C2PA adoption spans hardware manufacturers, software platforms, AI companies, and news organizations.
Camera Manufacturers
Leica, Nikon, Sony - embedding C2PA manifests at capture for photojournalism authenticity.
AI Image Generators
Adobe Firefly, DALL-E (OpenAI), Midjourney - marking AI-generated images with C2PA digital source type fields.
Social Platforms
LinkedIn, TikTok - displaying Content Credentials badges on supported content.
News Organizations
BBC, Reuters, Associated Press - signing news photography for distribution authenticity.
Tech Platforms
Adobe (Photoshop, Lightroom, Premiere), Microsoft (Bing Image Creator, Designer).
Text Provenance
Encypher - authors of the C2PA text-provenance standard and co-chairs of the Text Provenance Task Force, with patent-pending sentence-level text provenance.
Regulation
C2PA and Regulation
EU AI Act
Article 50 of the EU AI Act requires providers of AI systems that generate images, audio, video, and text to ensure outputs are marked as AI-generated in a machine-readable format. Its transparency obligations apply from August 2, 2026, and non-compliance can trigger fines of up to EUR 15 million or 3 percent of global annual turnover.
C2PA manifests with the appropriate digital source type field provide the machine-readable marking the requirement calls for. The EU AI Act does not mandate C2PA specifically, but C2PA is the dominant open standard aligned with the requirement. Confirm with your legal counsel that your specific implementation satisfies the obligations in your jurisdiction.
US Copyright Law
C2PA does not create legal rights, which are governed by copyright law, but a manifest can carry machine-readable rights terms that preserve a record of what the signer asserted and when.
California AI Transparency Act
California Business and Professions Code sections 22757.1 through 22757.6 require covered generative AI providers to offer detection tools, optional manifest disclosures, and embedded latent disclosures for synthetic media. Those duties became operative on August 2, 2026. Later duties apply to large online platforms on January 1, 2027 and new capture devices on January 1, 2028.
The Act does not name C2PA. Its platform provisions refer to provenance data that follows widely adopted specifications from an established standards-setting body. A C2PA manifest can carry the signed, machine-readable record and support platform detection and display. C2PA alone does not satisfy every duty, including durable latent marking, provider detection, user interface, privacy, and operating controls.
US Federal Landscape
No general US federal AI-content marking mandate exists as of August 3, 2026. Federal proposals and sector-specific rules may still affect synthetic media, impersonation, elections, privacy, and consumer protection. State laws now create binding duties in several settings, but their definitions, media coverage, disclosure methods, and enforcement rules differ. Treat C2PA as an evidence layer, not as a substitute for a law-by-law compliance analysis.
Implementation
Implementing C2PA with Encypher
Encypher provides a full-stack commercial C2PA API across 85+ file and media formats, including the C2PA standard for unstructured text. The official C2PA Conforming Products List records Encypher as a conformant generator product at assurance Level 1, with generation and validation coverage across 20 media types (conformance dated May 26, 2026). Encypher's claim-signing and timestamp authorities appear on the official C2PA Trust Lists. Content we sign validates as trusted in any conformant C2PA reader. Three lines of code sign a document.
# Sign text with C2PA manifest
curl -X POST https://api.encypher.com/api/v1/sign \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: $(uuidgen)" \
-d '{"text": "Your content here", "metadata": {"author": "Jane Smith"}}'
Keep reading
Related Topics
What Is Content Provenance?The definitive guide to content provenance: why it matters, how it works, and how it applies across 85+ file and media formats.Cryptographic WatermarkingHow deterministic proof of origin is embedded in content and why it is fundamentally different from statistical watermarking.C2PA TerminologyDefinitions for JUMBF, COSE, claim structure, ingredient chain, digital source type, and other C2PA terms.C2PA and EU AI ActHow C2PA provides the machine-readable marking Article 50 requires.C2PA and the California AI Transparency ActWhat California requires now, what follows in 2027 and 2028, and where C2PA fits.Conformance ExplorerBrowse all products that have passed C2PA conformance testing. Search by company, product type, or media format.Talk to an Expert
FAQ
Frequently Asked Questions About C2PA
What does C2PA stand for?
C2PA stands for Coalition for Content Provenance and Authenticity. It is the standards body - not a product or platform - that defines how content provenance manifests are structured, embedded, and verified. The coalition has 400+ member organizations.
Who founded C2PA?
C2PA was founded in 2021 by Adobe, Arm, Intel, Microsoft, Qualcomm, and Twitter (now X). The Content Authenticity Initiative (CAI), operated by Adobe, provides a public-facing interface and verification tools. The two organizations work in parallel: CAI raises awareness, C2PA defines the standard.
What is a C2PA manifest?
A C2PA manifest is a structured record embedded in a content file that contains: who created the content, when it was created, what tools were used, any edits or transformations made, and a cryptographic signature proving the record has not been altered. For images and video, the manifest is stored in a JUMBF container. For text, it is embedded using the C2PA standard for unstructured text.
What is the C2PA standard for unstructured text?
The C2PA 2.3 specification defines how provenance manifests are embedded into unstructured text - articles, social posts, and any text-based content. It defines encoding methods, integrity verification, and the claim structure for text content. Encypher authored this standard. It was published on January 8, 2026 as Section A.7 of C2PA 2.3; in the current C2PA 2.4 it is Section A.8.
Is C2PA free to implement?
Yes. The C2PA specification is free to read and implement. Open-source verification libraries are available in multiple languages. The standard is governed as a community specification under the Joint Development Foundation.
Does C2PA work across the internet?
C2PA manifests are embedded in content files and travel with the content. Any party with the signed content and access to the publisher's public key can verify provenance independently, without network access to a central registry. The certificate chain within the manifest provides the verification path.
What is the difference between C2PA and the Content Authenticity Initiative (CAI)?
C2PA is the technical standards organization that publishes the specification. The Content Authenticity Initiative (CAI), run by Adobe, is a broader coalition that promotes adoption and provides consumer-facing tools like the Content Credentials browser plugin. CAI implements C2PA; it does not replace it. The CAI has grown to over 6,000+ members, while C2PA has 400+ member organizations.
How does C2PA handle AI-generated content?
C2PA defines a "digital source type" field in the claim that identifies how content was produced. AI-generated content is marked with c2pa.digitalSourceType of trainedAlgorithmicMedia or compositeWithTrainedAlgorithmicMedia. This machine-readable flag provides the EU AI Act Article 50 marking for AI-generated images, audio, video, and text.
Industries
C2PA by Industry
What the standard changes for your sector, and which assertions matter.
C2PA for News PublishersHow news publishers use the C2PA standard to prove who published an article and when, survive syndication, and build licensing leverage.C2PA for Academic PublishingHow journals use C2PA manifests to protect the version of record, link revisions cryptographically, and label AI-generated material in submissions.C2PA for Music IndustryHow labels, distributors, and artists use C2PA manifests to prove ownership of masters, document samples and remixes, and separate human recordings from AI audio.C2PA for GovernmentHow agencies use the C2PA standard to make official documents, statements, and public records verifiable by anyone, without a call to the agency.C2PA for LegalHow law firms and in-house teams use C2PA manifests for tamper-evident contracts, filings, and independent proof of when a document existed in what form.C2PA for HealthcareHow healthcare organizations use the C2PA standard to keep patient-facing information and official communications verifiable against AI-generated misinformation.C2PA for Ad TechHow advertising platforms use C2PA verification to separate authentic publisher inventory from AI-generated made-for-advertising content.C2PA for AI CompaniesHow AI companies use the C2PA standard to mark generated outputs machine-readably, document licensed content provenance, and prepare for EU AI Act Article 50.
Implement C2PA Today
A full-stack commercial API that signs and verifies 85+ file and media formats, including the C2PA text-provenance standard for unstructured text. Free signing tier available.