Where did this image come from? The question 2026 is forcing the internet to answer

Three years ago, "where did this image come from?" was a question only forensics teams asked. In 2026 it's being answered — or at least attempted — by your phone, your browser, and your regulator. Provenance has quietly become the most important property of an image that almost nobody can actually verify, and this is the year the industry decided to change that.

Origin went mainstream this year

The pieces landed fast. Samsung's Galaxy S25 and Google's Pixel 10 now sign photos with C2PA Content Credentials directly in the native camera app — the first time cryptographic provenance ships in mainstream consumer hardware, not just a $9,000 Leica. On the reading side, Google is rolling out Content Credentials and SynthID verification across Gemini, Search, and Chrome, and OpenAI attaches C2PA metadata to generated media. For the first time, an ordinary person can right-click an image and ask it to explain itself.

Then there's the legal clock. On August 2, 2026, Article 50 of the EU AI Act starts applying: providers of generative AI systems must ensure their outputs are marked in a machine-readable way and detectable as AI-generated. The European Commission's Code of Practice on transparency of AI-generated content — finalized just ahead of the deadline — even sketches a standardized "AI" label and a taxonomy separating fully AI-generated content from AI-assisted edits. Across the Atlantic, California's SB 942 has required provenance disclosures since January. In eighteen months, machine-readable origin went from a nice-to-have to a compliance requirement on two continents.

How we got here

It's worth remembering how thin the old answer was. For most of the internet's history, an image's "origin" was whatever its EXIF block said — a camera model and a timestamp that any editor could rewrite in one line of code. When that failed, we leaned on forensics: error-level analysis, sensor noise patterns, experts squinting at shadows. Forensics doesn't scale to a platform ingesting millions of uploads a day.

Generative AI broke the remaining trust. When any image can be synthesized in seconds, "it looks real" stopped meaning anything, and the burden of proof flipped: instead of asking "can you prove this is fake?", platforms, newsrooms, and courts started asking "can you prove where this came from?" That reversal — from detecting fakes to proving origins — is the actual story of 2026.

What "origin" actually means

An origin claim is really four claims bundled together: who created the content (a camera, a model, a person), what produced it (device or model identity), when it happened, and what changed since (the edit chain). C2PA packages these as signed assertions inside the file: each step in the content's life — capture, edit, export — can append a cryptographically signed "manifest," forming a chain of custody a verifier can walk backwards. It's a genuinely good standard, designed by people who understood the problem — when the metadata survives.

The catch: the internet doesn't preserve bytes

That's the weak point everyone in the ecosystem now acknowledges: provenance that lives inside the file dies with the file. Social platforms strip metadata on upload — not maliciously, but because re-encoding images is how they've saved bandwidth for twenty years. Screenshots create a brand-new file with no history. WhatsApp forwards, Slack previews, CDN optimizers, and "save image as" all quietly launder away the manifest. A C2PA credential is only as durable as the least careful hop in the image's journey, and the average image makes a lot of hops.

Watermarks like SynthID take the opposite bet — hide the signal in the pixels themselves — and survive more abuse, but each watermark only covers one vendor's models, can't carry rich provenance data, and requires that vendor's detector to read. And pure AI detectors, the third option, return a probability rather than a record: useful as a screening signal, but they need retraining every time a new model ships, and a probability is not something you can show a regulator.

So today's Content Credentials are best understood as a provenance signal — valuable when present, meaningless when absent, and absent most of the time.

Proof that outlives the file

The alternative is to stop attaching trust to the bytes. At 0byte, the proof lives outside the image: at generation time we compute a perceptual fingerprint of what the content looks like and anchor a signed origin record — model, provider, timestamp — in a public, append-only log. The shipped image stays byte-for-byte untouched. Because the fingerprint describes appearance rather than bytes, a screenshot of a re-encoded crop still matches the registered record: the exact transformations that destroy embedded metadata leave the proof intact. And because the log is public, anyone can verify it — free, with no account, without trusting us or the platform the image happened to travel through.

The two approaches aren't rivals, either. An image can carry C2PA credentials for the hops that preserve them and have a registry record for the hops that don't. Belt and suspenders — which is roughly what "layered provenance" means when Google and OpenAI use the phrase.

If you ship images, here's your checklist

Whether or not the EU deadline applies to you directly, the direction of travel is clear. Three things worth doing this quarter:

1. Stamp at creation. Provenance is cheap at generation time and impossible to retrofit later. If your product generates or edits images, attach origin data the moment the pixels exist — signed metadata, a registry record, ideally both.
2. Verify at ingestion. If you accept uploads, check for credentials and fingerprints at the gate, not after something goes viral. A provenance check is one API call; a moderation crisis is not.
3. Don't treat absence as innocence. Most legitimate images have no provenance yet. Missing credentials mean "unknown," not "fake" — design your UI and policies around that distinction, because mislabeling real photos is how you burn user trust fastest.

The question becomes a protocol

The industry spent 2026 agreeing that every image needs an answer to "where did this come from?" Phones now write the answer, browsers now read it, and regulators now require it. The next step is making sure the answer survives contact with the actual internet — every screenshot, re-encode, and forward between creation and the person finally asking the question. That's the difference between a label and a protocol. Labels get stripped. Protocols get adopted.

Further reading: The State of Content Authenticity in 2026 · C2PA adoption status 2026 · Google on C2PA transparency · EU AI Act, Article 50 · EU Code of Practice on transparency of AI-generated content