Standards guide
C2PA and Content Credentials: Truth and Digital Privacy
Last reviewed: September 16, 2026
What is C2PA and Content Credentials?
The Coalition for Content Provenance and Authenticity (C2PA) is an open technical standards body established by Adobe, Microsoft, Intel, Arm, Google, and camera manufacturers like Sony, Leica, and Nikon. Its objective is to address digital deception, unauthorized alterations, and AI-generated media by embedding cryptographic provenance metadata into digital assets.
Content Credentials serve as a tamper-evident digital nutrition label for media files. They can record when an image was captured, which camera model was used, which editing software was applied, and whether generative AI tools contributed to the final output.
Technical structure of provenance manifests
Unlike traditional EXIF tags which consist of simple key-value pairs that anyone can edit with standard tools, C2PA manifests use cryptographic signing and verification.
- • JUMBF (JPEG Universal Metadata Box Format): The standardized container format used to encapsulate C2PA manifest stores within JPEG and other file types.
- • Cryptographic Signatures: Manifests are signed using digital certificates issued by recognized certificate authorities, allowing viewers to verify that the file has not been altered since publication.
- • Assertion Chains: Records individual historical events, such as cropping, color adjustments, AI generation prompts, and author identity hashes.
The privacy debate surrounding Content Credentials
While Content Credentials provide powerful benefits for journalism, law enforcement, and combating synthetic disinformation, they also present significant privacy challenges for vulnerable creators, whistleblowers, and regular citizens.
If a camera manufacturer cryptographically signs an image with a device hardware key, that photo can be permanently linked to a specific physical camera unit. Furthermore, personal identity credentials linked to creative software accounts can inadvertently expose a creator real name or organizational affiliation.
CleanMyPhoto approach to provenance
CleanMyPhoto focuses on inspecting and stripping standard consumer metadata formats (EXIF, XMP, IPTC, and QuickTime atoms). When re-encoding an image to a clean JPEG, embedded JUMBF boxes and provenance manifests are omitted from the export. However, users requiring cryptographic provenance verification should use dedicated C2PA validation suites.