Content provenance glossary

The record of where a piece of content came from and how it changed, carried with the content itself.

Content provenance is a signed record of a piece of content's origin and edit history. It travels inside the file or the text, so a checker can read it without asking a separate database. The C2PA standard defines how the record is built and checked. A check either passes or fails: it shows who signed, what they declared, and whether the content changed since. It does not judge whether the content is true.

Enlarge picture

• C2PA
• C2PA manifest
• Content Credentials
• Digital signature
• Content provenance guide
• Verify a file

The public name for a C2PA label, often shown as a small CR icon that opens who signed the content and what they declared.

Content Credentials is the consumer-facing name for C2PA provenance. Apps that support it show an icon on an image or video; opening it shows the signer, the tools used, any AI declaration, and whether the file changed since signing. Under the icon is a standard C2PA manifest.

• C2PA manifest
• C2PA
• Content Authenticity Initiative
• Content Credentials explained

Being able to check who published content and that it has not changed since. It says nothing about whether the content is true.

Content authenticity is the property that a piece of content can be checked against a signed record: who signed it, when, what they declared, and whether any bit changed since. A digital signature fails if the signed bytes change. Authenticity is about origin and integrity, not accuracy: a signed false claim is still false.

• Content provenance
• Digital signature
• Content Authenticity Initiative
• How verification works

Data stored beside the content in a file, such as author, camera or date. Many tools strip it when they copy or upload a file.

Metadata is descriptive data a file carries alongside its content: author, caption, camera settings, copyright notice. Formats such as EXIF, IPTC and XMP hold it. Plain metadata is not signed, so anyone can change it, and many upload and resize pipelines drop it. A C2PA manifest is signed metadata: a change to it, or to the content, shows up when it is checked.

• IPTC
• XMP
• C2PA manifest
• Metadata stripping
• Recover stripped metadata

A mark placed in the content itself, visible or hidden, so it can be found again after the file is copied.

A watermark is a signal embedded in the content rather than stored beside it. Visible watermarks are logos or text on the image. Invisible watermarks hide a signal in pixels, audio samples or characters. Some are statistical and are read by a detector that returns a likelihood; cryptographic watermarks carry or point to a signed record that either checks or fails. In C2PA, a watermark can act as a soft binding that finds a label again.

• Cryptographic watermarking
• Statistical watermarking
• Soft binding
• Cryptographic watermarking

The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it.

A C2PA manifest is the signed record attached to a piece of content. It holds a set of assertions (statements about the content, such as actions taken, AI involvement and a hash of the content), one claim that lists those assertions by hash, and a claim signature made with the signer's X.509 certificate. In media files it sits in a JUMBF box; in text it is encoded as invisible characters. A checker needs no outside database to validate it.

Enlarge picture

• Manifest store
• Claim
• Assertion
• JUMBF
• COSE
• Manifest structure

The set of all manifests a file carries, one per signed version; the newest one is the active manifest.

A manifest store is the collection of manifests in one asset. Each edit-and-sign step can add a manifest, and the last one added is the active manifest, the one a checker reads first. Earlier manifests stay in the store as ingredients, so the history can be followed back.

• C2PA manifest
• Ingredient
• Provenance chain

The part of a C2PA manifest that lists every assertion by hash and is then signed, so no assertion can change unnoticed.

In C2PA, the claim is the data structure that the signer actually signs. It lists each assertion in the manifest by a hashed reference, names the signing tool, and through that list includes the hard binding that ties the manifest to the content. The claim signature, a COSE signature over the claim, is what makes the whole manifest tamper-evident.

• Assertion
• C2PA manifest
• COSE
• Hash

One statement inside a C2PA label, such as what was done to the content, whether AI was used, or the content's hash.

An assertion is a single statement in a C2PA manifest. Standard assertions record actions (created, edited, AI-generated), hashes that bind the manifest to the content, ingredients, thumbnails and metadata. The claim lists every assertion by hash, so changing one breaks the signature check.

• Claim
• Actions assertion
• Hard binding
• C2PA manifest

The part of a label that records what was done to the content, such as created, edited or redacted, and by what.

The actions assertion (c2pa.actions) lists the actions taken on the content, such as c2pa.created, c2pa.edited or c2pa.redacted, with the tool used and, where declared, the digital source type. Each signed version adds its own actions, so the record grows with the content.

• Assertion
• Digital source type
• Ingredient chain

A field in the label that says how content was made: captured by a camera, made by AI, or a mix.

Digital source type is a value in a C2PA actions assertion, taken from the IPTC vocabulary, that declares how the content was produced. Examples: digitalCapture (a camera), trainedAlgorithmicMedia (made by an AI model), compositeWithTrainedAlgorithmicMedia (a mix). It is how a C2PA manifest declares AI involvement in a form software can read, which is what EU AI Act Article 50 marking asks for.

• Actions assertion
• IPTC
• Article 50
• Machine-readable marking

A source file used to make new content, recorded in the new content's label with a link to its own label.

In C2PA, an ingredient is an asset used to create another asset: the photo inside a layout, the clip inside an edit. The new manifest records each ingredient and, where the ingredient was signed, points to its manifest, so a checker can follow the history.

• Ingredient chain
• Manifest store
• Provenance chain

The links from a finished piece of content back through every signed source file used to make it.

An ingredient chain is formed when each manifest references the manifests of its ingredients. Following the references leads from the final output back to its signed sources. Unsigned sources appear as gaps: the chain shows only what was signed.

Enlarge picture

• Ingredient
• Provenance chain
• C2PA manifest

The full signed history of a piece of content, from first creation through each signed edit.

A provenance chain is the history built from manifests and their ingredient references. It can start at a camera or a model, pass through edits, and end at the published version. It is complete only where every step was signed; an unsigned step is a visible gap.

• Ingredient chain
• Manifest store

A hash of the content's signed bytes stored in the label, so a change to those bytes makes the check fail.

A hard binding ties a manifest to one exact version of the content. The manifest stores a cryptographic hash of the content bytes (a data hash, or a BMFF hash for video and other box-based files). The checker hashes the file again; if one hashed byte changed, the hashes differ and the binding fails. Ranges listed as exclusions, such as the manifest itself, are not hashed. Every standard C2PA manifest needs one.

Enlarge picture

• Soft binding
• Hash
• Claim
• BMFF
• Manifest structure

A watermark or fingerprint that can find a content label again after the file was copied or its metadata stripped.

A soft binding links content to its manifest in a way that survives changes a hard binding does not, such as re-encoding or metadata removal. It is a watermark embedded in the content or a fingerprint computed from it. A checker reads the watermark or computes the fingerprint, then looks up the matching manifest. It finds a label; the hard binding and signature still decide whether the label checks.

Enlarge picture

• Hard binding
• Watermark
• Fingerprinting
• Metadata stripping
• Recover stripped metadata

JPEG Universal Metadata Box Format: the container that holds a C2PA label inside a media file.

JUMBF (JPEG Universal Metadata Box Format, ISO/IEC 19566-5) is a box-based container for metadata. C2PA stores the manifest store in JUMBF boxes inside images, audio, video and documents. Apps that do not read C2PA skip the boxes, so the file still opens normally.

• C2PA manifest
• CBOR
• BMFF

Concise Binary Object Representation: a compact binary form of JSON that C2PA uses to store a label's data.

CBOR (Concise Binary Object Representation, RFC 8949) encodes the same kinds of data as JSON in a smaller binary form. C2PA writes claims and most assertions as CBOR, and COSE signatures are CBOR structures.

• COSE
• JUMBF
• C2PA manifest

ISO Base Media File Format: the box structure behind MP4, MOV, HEIF and similar files.

BMFF (ISO Base Media File Format, ISO/IEC 14496-12) organizes a file as nested boxes, each with a type and a length. MP4, MOV, M4A, HEIF and AVIF use it. C2PA puts its manifest in a dedicated uuid box, which other tools skip, and hashes the file box by box (a BMFF hash), so large media can be checked in parts.

• Hard binding
• JUMBF
• Video provenance

Extensible Metadata Platform: a common way to store metadata in files. Like EXIF, it is not signed and is often stripped.

XMP (Extensible Metadata Platform, ISO 16684) stores metadata in images, PDFs and video. EXIF is the older camera metadata format. Neither is signed. C2PA can point to a manifest from XMP and can carry the same fields inside a signed assertion.

• Metadata
• IPTC
• Metadata stripping

Photo details stored in an image file, such as date, camera and settings.

EXIF fields sit in the image header and record capture details: date, camera, lens, exposure, sometimes location. Many social sites and image services delete them on upload. EXIF is not signed, so anyone can change it; a C2PA manifest is signed, so a change to it shows.

• Metadata
• XMP
• Metadata stripping

The outer structure of a file that holds the picture, sound or text plus extra data.

Every media format has a container with places for extra data: boxes in BMFF, chunks in RIFF and PNG, frames in ID3, entries in ZIP-based documents. C2PA defines where the manifest goes in each one, so the label sits in the file without changing the picture or sound.

Enlarge picture

• BMFF
• RIFF
• ID3
• JUMBF

The chunk-based file layout behind WAV, AVI and WebP.

A RIFF (Resource Interchange File Format) file is a list of tagged chunks. C2PA stores its manifest in a chunk of its own, beside the sound or picture chunks, so players that do not read C2PA ignore it.

• File container
• JUMBF

The tag block in an MP3 file that holds its title, artist and other details.

ID3v2 is a block of frames at the start of an MP3 file. C2PA stores the manifest in a GEOB (general encapsulated object) frame marked with the C2PA media type.

• File container
• Metadata

A label stored in a separate file or at a web address instead of inside the content, linked by a reference.

A sidecar manifest is stored next to the asset (a .c2pa file) rather than embedded in it. A remote manifest is fetched from a URL the asset points to. Both keep the file unchanged, at the cost of the label not traveling with the bytes on its own.

• C2PA manifest
• Soft binding

The standard that gives every character in every writing system a number, so text looks the same on every device.

Unicode assigns a code point to every character, including letters, emoji and invisible control characters. Because text is stored as code points, characters that render as nothing can still travel inside text. That is what lets a label ride inside plain text.

• Variation selector
• Zero-width character
• Unicode normalization

An invisible Unicode character that normally picks a glyph style. Strung together, they can carry data inside text.

Unicode defines 256 variation selectors (U+FE00 to U+FE0F and U+E0100 to U+E01EF). They normally choose between glyph styles, for example text or emoji presentation, and display as nothing on their own. The C2PA text-provenance standard encodes manifest bytes as a run of variation selectors, so the label is invisible to readers.

• C2PA text-provenance standard
• Unicode

A Unicode character that takes no space on screen, such as a zero-width joiner.

Zero-width characters, such as the zero-width space and zero-width joiner, are Unicode characters with no visible width. Some text marks encode data with them. Some editors and cleanup tools remove them, which is why mark designs differ in which characters they use.

• Unicode
• Unicode normalization

Encypher's default invisible mark for text on the web, in email and in most apps.

The default text mark carries Encypher's signed label in characters readers do not see. It is compact and repairs small damage. It stays hidden in browsers, Google Docs and most PDFs. Microsoft Word shows it as boxes, so text bound for Word uses the Word-safe text mark. The checker reads both.

• Word-safe text mark
• Provenance markers
• C2PA text-provenance standard

Encypher's alternative invisible text mark, for text that will be edited in Microsoft Word.

The Word-safe text mark carries the same signed label as the default text mark and stays hidden when text is copied and pasted in Microsoft Word. It is longer than the default mark. It is chosen through the Encypher API, and the checker reads both.

• Default text mark
• Provenance markers

Encypher's general name for invisible characters that carry a signed label inside text.

Provenance markers are the invisible characters that carry a signed provenance payload in text. Encypher offers a default text mark and a Word-safe text mark for documents edited in Microsoft Word. The term separates them from visible watermarks and from statistical watermarking.

• Default text mark
• Word-safe text mark
• Invisible embedding

Placing a label in content without changing how it looks or sounds.

Invisible embedding hides data in content with no visible effect. In text, it uses invisible characters. In images and audio, the C2PA manifest sits in the file container rather than in the pixels or samples. A watermark goes further and alters the content signal itself, imperceptibly.

• Provenance markers
• JUMBF
• Watermark

Text cleanup that rewrites characters into a standard form. Some forms remove invisible marks.

Unicode normalization converts text to a canonical form (NFC, NFD, NFKC, NFKD) so equal-looking text compares equal. Some platforms normalize text or strip characters they treat as noise. A text mark has to choose characters that survive the normalization its content will meet.

• Unicode
• Variation selector
• Zero-width character

A signed label for text: who signed it, when, and whether the words changed.

Text provenance applies content provenance to articles, posts and AI replies. Because text has no container, the manifest is encoded in invisible characters under the C2PA text-provenance standard. A checker can then show who signed the text and whether it changed, including for an excerpt.

• C2PA text-provenance standard
• Provenance markers
• Content provenance
• Text provenance

Optical character recognition: software that turns a picture of text back into characters.

OCR (optical character recognition) reads text from an image or a scan. The output is new characters, so any invisible marks in the original text are gone; the text must be checked by other means, such as matching against the signed source.

• Provenance markers
• Fingerprinting

An error-correcting code that lets a damaged mark be read back, as on CDs and QR codes.

Reed-Solomon codes add redundant symbols to data so it can be recovered when some symbols are lost or wrong. CDs, QR codes and deep-space links use them. A mark that uses them can still be read after part of it is damaged.

• Watermark
• Provenance markers

A hidden mark that carries or points to a signed record, so a check gives a yes or no rather than a likelihood.

Cryptographic watermarking embeds a mark tied to a signed record of origin. Verification is deterministic: the signature checks or it does not, so there is no false-positive rate of the kind a statistical detector has. For text, Encypher carries the mark in invisible characters; for media, C2PA manifests plus soft-binding watermarks where needed.

• Watermark
• Statistical watermarking
• Digital signature
• Cryptographic watermarking
• How it works

A hidden pattern a model adds while generating content, found later by a detector that returns a likelihood.

Statistical watermarking shifts patterns in generated text, images or audio, then detects them with an algorithm that returns a probability. It can suggest that content came from a given model but cannot say who published it or what rights apply. Paraphrasing or recompression can weaken the signal, and human work can be flagged in error.

• SynthID
• Cryptographic watermarking
• False positive
• Compared with cryptographic marks

Google DeepMind's statistical watermark, added while a model generates content and read by Google's detector.

SynthID is Google DeepMind's watermarking system for text, images, audio and video generated by Google models. It is statistical: a detector reports how likely the watermark is present. Encypher can check SynthID marks that Encypher applied itself; it cannot read SynthID marks applied by Google or anyone else. It complements, and differs from, a signed C2PA manifest.

• Statistical watermarking
• AI detector
• C2PA and SynthID

Computing a compact summary of content and matching it against a database to find copies.

Fingerprinting computes a signature of content's features, such as a perceptual hash of an image or an acoustic fingerprint of audio, and looks for matches in a database. It finds copies even after small edits, but needs a populated database and says nothing on its own about who made the content. In C2PA it can serve as a soft binding.

• Perceptual hash
• Soft binding

A fingerprint based on how an image looks or audio sounds, so similar copies give similar values.

A perceptual hash summarizes what content looks or sounds like rather than its exact bytes, so resized or recompressed copies hash close together. Matching systems use it to find reused media. Unlike a cryptographic hash, small changes give small differences.

• Fingerprinting
• Hash
• Soft binding

A model that guesses whether content was made by AI and returns a probability, not proof.

An AI detector classifies content as likely human-made or AI-made from its statistical features. It returns a score, can be wrong in both directions, and can be fooled by editing. Provenance takes the other approach: it reads what the publisher signed and declared.

Enlarge picture

• False positive
• Statistical watermarking
• Content provenance
• Provenance vs detection
• AI detector

A wrong yes, such as human work flagged as AI-made.

A false positive is a detector saying yes when the answer is no: a human essay flagged as AI, an unmarked image read as watermarked. Every probabilistic detector has a false-positive rate. A signature check has no such rate: a valid signature from a key holder either verifies or it does not.

• AI detector
• Statistical watermarking

Image, audio or video made or changed by AI so it looks real and could fool people.

A deepfake is AI-generated or AI-manipulated media that resembles real people, places or events and could be taken as authentic (EU AI Act Article 3(60)). Article 50(4) requires deployers to disclose deepfakes, with lighter rules for clearly artistic or satirical work. Provenance helps from the other side: genuine media can carry a signed label.

• Deployer
• Article 50
• AI detector
• Deepfake detection

Writing a file's hash to a public ledger to show it existed at a given time.

A blockchain is a ledger copied across many parties, where entries cannot be changed once added. Timestamping writes a content hash and a time to it. The file itself carries nothing that points to the ledger, so a reader needs the original file and the transaction to check it. A C2PA manifest is checked from the content itself.

Enlarge picture

• Hash
• Timestamp authority
• C2PA manifest
• Provenance vs blockchain

A lookup service that takes an ID found in a watermark or fingerprint and returns the matching provenance record.

A C2PA soft binding points to a record outside the file. A resolver is the service that answers that pointer and returns the manifest. Recovering a stripped label needs both a supported mark and a reachable resolver.

• Soft binding
• Watermark
• Fingerprinting

The European Union's law on artificial intelligence, which includes rules for marking AI-made content.

The EU AI Act (Regulation (EU) 2024/1689) regulates AI systems by risk level. For content, the key rule is Article 50: providers must mark AI-generated audio, images, video and text in a machine-readable way, and deployers must disclose deepfakes. The Act applies in stages; Article 50 applies from August 2, 2026, with systems already on the market given until December 2, 2026. It applies to anyone placing AI systems on the EU market, wherever they are based.

• Article 50
• Provider
• Deployer
• Code of Practice on AI-generated content
• EU AI Act guide

The EU AI Act rule that AI-made content be marked in a form software can read, and deepfakes disclosed.

Article 50 of the EU AI Act sets transparency duties for AI systems. Providers of generative AI must mark synthetic audio, image, video and text output in a machine-readable, detectable way (Article 50(2)); deployers must disclose deepfakes and AI-written text on matters of public interest. The duties apply from August 2, 2026; providers of systems already on the market have until December 2, 2026. Fines reach EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher (the lower of the two for SMEs and start-ups).

Enlarge picture

• EU AI Act
• Machine-readable marking
• Code of Practice on AI-generated content
• Digital source type
• EU AI Act guide

The EU AI Act article on classifying general-purpose AI models with systemic risk. The marking rule is Article 50.

Article 52 of the EU AI Act sets the procedure for classifying general-purpose AI models as having systemic risk. It is often confused with the transparency rule because earlier drafts numbered that rule 52. The obligation to mark AI-generated content is Article 50.

• Article 50
• EU AI Act

Under the EU AI Act, the company that builds an AI system or puts it on the EU market under its own name.

A provider (Article 3(3) of the AI Act) develops an AI system or model, or has one developed, and places it on the market under its own name. Providers carry the Article 50(1), (2) and (5) duties, including machine-readable marking of AI output.

• Deployer
• Machine-readable marking
• EU AI Act

Under the EU AI Act, a company that uses an AI system in its own work, such as a newsroom publishing AI-edited text.

A deployer (Article 3(4) of the AI Act) uses an AI system under its authority in a professional activity. Deployers carry the Article 50(3), (4) and (5) disclosure duties, such as telling people that a deepfake is AI-made.

• Provider
• Deepfake
• Article 50

A label software can read that says content was made or changed by AI.

Article 50(2) of the EU AI Act requires covered AI output to be marked in a machine-readable format and detectable as AI-generated. A visible "made with AI" note is for people; machine-readable marking is for software, such as a signed C2PA manifest with a digital source type, or a watermark.

• Article 50
• C2PA manifest
• Digital source type
• Watermark

The EU's voluntary rulebook on marking and labeling AI content, published in final form on June 10, 2026.

The European Commission's Code of Practice on Transparency of AI-Generated Content, published in final form on June 10, 2026, sets out how providers and deployers can meet Article 50. It is voluntary, not law; following it is one way to show compliance.

• Article 50
• Machine-readable marking

California's law requiring generative AI providers to hide an AI disclosure in the images, video and audio they make or edit, and offer a free tool that reads it.

The California AI Transparency Act (SB 942, amended by AB 853 and by SB 1000 and AB 2713, approved on September 30, 2026) requires covered generative AI providers to embed latent disclosures in images, video and audio their systems create or alter, and to offer a free disclosure verification tool that reads them. If a provider knows that a licensee modified the system so it 'no longer complies with this chapter', it must end the licensee's authorization or notify the licensee within 72 hours. Text is outside the provider duties. SB 1000 took effect at once as an urgency statute and removed the user threshold for covered providers. AB 2713 rewrote the large-platform duties that start on January 1, 2027.

• Covered provider
• Latent disclosure
• Manifest disclosure
• Provenance data
• California AI Transparency Act

Under California law, anyone who makes a generative AI system that the public in California can use.

The California AI Transparency Act defines a covered provider as 'a person that creates, codes, or otherwise produces a generative artificial intelligence system that is publicly accessible within the geographic boundaries of the state' (Bus. and Prof. Code 22757.1). SB 1000 removed the earlier user threshold on September 30, 2026. Covered providers carry the latent disclosure and free verification tool duties.

• California AI Transparency Act
• Latent disclosure
• California AI Transparency Act

Under California law, a hidden label inside a file that says which AI system made or changed it and when.

A latent disclosure is the California AI Transparency Act's term for a hidden disclosure in content that software can read (Bus. and Prof. Code 22757.3). SB 1000 removed the Act's definition of 'latent' but kept the duty. As amended, it names the provider, the system name and version, the time and date of creation or alteration, a unique identifier and whether AI created or altered the content. A C2PA manifest is the common way to carry it.

• California AI Transparency Act
• Manifest disclosure
• Provenance data

Under California law before SB 1000, a label people could see that says content was made by AI.

A manifest disclosure was the California AI Transparency Act's term for a visible notice that content is AI-generated. SB 1000 removed the duty to offer it and the definition of 'manifest'; the latent disclosure remains. The word manifest here means visible, not a C2PA manifest.

• Latent disclosure
• California AI Transparency Act

Under California law, information about where content came from and how it was changed, in a standards-based format.

California defines provenance data as information about the origin of a piece of digital content and its history of modifications 'in a format that is compliant, or interoperable with, widely adopted specifications adopted by an established standards-setting body'. System provenance data is the part that names the device or system and cannot be tied to a person. A C2PA manifest is the common example.

• C2PA manifest
• Latent disclosure
• California AI Transparency Act

Copyright infringement done knowingly. US law allows up to $150,000 in statutory damages per work.

Willful infringement is infringement where the infringer knew, or recklessly disregarded, that the use infringed. Under 17 U.S.C. 504(c)(2), statutory damages can reach $150,000 per work, against up to $30,000 for ordinary infringement and as little as $200 for innocent infringement. A signed rights notice that travels with copies that keep the label can be evidence of notice. Legal outcomes depend on the facts and counsel.

• Innocent infringement
• Statutory damages
• Formal notice
• Legal implications

Copyright infringement where the user had no reason to know the work was protected. Damages can drop to $200 per work.

Under 17 U.S.C. 504(c)(2), a court may reduce statutory damages to as little as $200 per work when the infringer was not aware and had no reason to believe the use infringed. Notice carried with the content makes that defense harder to claim. Legal outcomes depend on the facts and counsel.

• Willful infringement
• Formal notice
• Statutory damages

Damages set by law per infringed work, under 17 U.S.C. 504(c), with no need to prove actual loss.

US copyright law lets a rights holder of a registered work elect statutory damages instead of proving actual loss: $750 to $30,000 per work, up to $150,000 if willful, or as little as $200 if innocent (17 U.S.C. 504(c)).

• Willful infringement
• Innocent infringement

Documentation that tells a user a work is protected and which terms apply, which matters for willfulness.

Formal notice tells a potential infringer that a work is protected and states its terms. Willfulness turns on knowledge, so notice matters to damages. Rights terms in a signed manifest travel with copies that keep the label, so a system that processes such a copy has the terms in hand. Legal outcomes depend on the facts and counsel.

• Willful infringement
• Machine-readable rights
• Copyright management information

The author, title and terms attached to a work. Knowingly removing it can violate 17 U.S.C. 1202.

Copyright management information (CMI) is identifying information conveyed with a work: title, author, owner and terms of use. Section 1202 of the DMCA (17 U.S.C. 1202) prohibits knowingly removing or altering CMI to hide infringement. A signed manifest that names the author and terms can be CMI.

• Formal notice
• Willful infringement
• Metadata stripping