C2PA stands for the Coalition for Content Provenance and Authenticity, a standards body whose specification defines a way to attach a signed provenance record to a media file. The record is called a content credential, and it travels with the file as a cryptographically signed manifest.
The manifest can state who or what created the asset, what edits were applied, and which tool or device produced it. Because the manifest is signed, a verifier can check whether the record has been altered since it was issued. This is the key difference from EXIF: EXIF is descriptive text that anyone can rewrite, while a content credential is a signed claim that can be validated or found invalid.
A practical reading of a content credential has three outcomes:
- Valid signature and a named capture device: the file is consistent with an authentic capture, though the device itself could be misused. - Valid signature and a named generative tool: the file is consistent with AI generation. - Missing or invalid signature: the file has no verifiable provenance, which is common for ordinary photos and does not by itself indicate AI generation.
Adoption is still uneven. Many cameras, editing tools, and platforms do not yet write or preserve content credentials, and stripping the manifest is as easy as stripping EXIF. A valid credential is strong positive evidence; its absence is weak evidence.