Content Credentials solve half the problem

If you have followed content authenticity at all, you know Content Credentials — the little "CR" pin and the C2PA standard behind it, backed by Adobe, Microsoft, camera makers, and increasingly Google. It is the most important standard in the provenance space, and if you ship content you should absolutely use it. It also solves only half the problem. This is about the half it leaves open — and it happens to be the half where content actually lives.

What C2PA gets right

C2PA attaches a cryptographically signed manifest to a file: a tamper-evident record of how the content was made and edited — the capture device, the editing steps, whether AI was involved — signed by the issuing tool or organization. Alter the pixels or the manifest and the signature breaks, so a viewer can tell.

Three things make this genuinely valuable:

• It is standardized. One interoperable format across tools and vendors, not a proprietary silo.
• It is rich. The manifest can carry a whole edit history, not just a yes/no flag.
• It has momentum. Cameras, creative software, and major platforms are adopting it, building a real capture-to-publish chain.

None of what follows is an argument against C2PA. It is an argument about where C2PA needs a partner.

The half it can't cover: the open internet strips it

C2PA manifests ride inside the file, in an embedded container alongside the image data. And the open internet is hostile to anything embedded in a file. Most social platforms re-encode uploads and discard metadata — studies and hands-on testing have found that Instagram, X, Facebook, and TikTok routinely strip C2PA manifests during upload processing.

That produces a painful paradox, one the Center for Democracy & Technology and others have flagged: the content that most needs verifiable provenance — the stuff that goes viral across platforms — is exactly the content most likely to lose it in transit. A credential that survives in your asset library but not on the open web is protecting the wrong end of the journey.

Two more gaps

• Coverage. A manifest only exists if the tool that produced the content chose to add one. Screenshot a credentialed image, or generate something with a tool that doesn't participate, and there is simply nothing there.
• Recovery. Once a manifest is stripped, there is no way to recover the origin from the pixels alone. The manifest was the only link between the content and its history. Break it and the trail is cold.

The other half: a record keyed to the content itself

This is where an external, content-derived record complements C2PA rather than competing with it. 0byte's approach: compute a perceptual fingerprint of the content and store the signed proof of origin in an external, public transparency log.

The difference that matters is where the link lives. C2PA binds provenance to bytes inside the file. A fingerprint binds provenance to the content's appearance, held in a registry outside the file. So when a platform re-encodes an upload and strips every embedded byte of metadata, the fingerprint of the surviving image still matches the one in the log. Screenshot it, recompress it, convert the format — you can still look the origin back up, because you are matching what it looks like, not what metadata it still carries.

Use both — that's the point

The right architecture is not one or the other. It is belt and suspenders:

• Embed Content Credentials so that, wherever the manifest survives, you get the full, rich, in-file edit history.
• Register a fingerprint + proof in a public log so that, wherever the manifest does not survive, you still have a durable floor you can verify against.

This combination is also how you meet obligations like the EU AI Act's Article 50 transparency rules in the real world — where the requirement is that AI content stays detectable as such even after it leaves your control and travels across platforms that were never designed to preserve your metadata.

C2PA answers "what does this file say about itself?" The missing half answers "and what if the file no longer says anything?" For content that lives on the open internet, you want both.

Further reading: C2PA — Coalition for Content Provenance and Authenticity · Content Authenticity Initiative · The Promise and Risk of Digital Content Provenance (CDT) · EU AI Act, Article 50