Provenance 102: C2PA
The C2PA provenance standard: adding trust into metadata.
Over the past few years, a number of standards — both technical and regulatory — have been proposed, developed, and implemented. On the regulatory side, the most consequential is the EU AI Act, whose Article 50 comes into force on 2 August 2026 and cites C2PA-style cryptographic provenance as an exemplar technology. For the latest overview (as of Q4 2025), we recommend Building Trust in Multimedia Authenticity through International Standards, a policy paper from the IEC, ISO, and ITU published through the AI and Multimedia Standards Collaboration (AMAS).
The most prominent content authenticity standard for the past few years has been the C2PA standard.
#What Is C2PA?
The Coalition for Content Provenance and Authenticity (C2PA) is an open-source provenance standard centered around cryptographic metadata. For provenance, traditional metadata falls short because it is easily falsified: anyone can pull up an image editor and change the timestamp attached to an image. With C2PA, that metadata is secured by a digital signature. The HTTPS protocol that now powers the Internet operates on similar principles.
Any time content is distributed — whether from an organization to the public, or from a camera to editing software — cryptographic metadata is recorded, producing a chain of provenance information that spans the full content lifecycle. Downstream recipients then know with certainty whether the content was published by the organization or captured by the camera. The most important aspect of C2PA is that it is an open standard: if you add the information, downstream consumers will recognize it.
Of course, a substantial burden is placed on the trust model underlying these signing entities. As of October 2025, after a year of careful design, C2PA has a mature trust model rooted in its conformance program. Trufo is one of the three inaugural Root CAs, alongside Google and SSL.com. For more details, see 105: The Role of Cryptography.
There are a dozen or so working groups within C2PA where industry experts iterate on the specifications. Anyone can join C2PA (there is a fee), and the coalition follows W3C patent policy.
#Terminology
At a high level, content provenance breaks down into two components. Annotations are the factual information recorded about the content; associations are the connection between the annotations and the content.
The annotations can contain any sort of information, but the two most common are the origin (AI, camera, art) and the publisher (artist, organization, celebrity). The associations also come in many forms, including signed content hashes, invisible watermarks, indexed fingerprints, and more.
In the case of C2PA, the terminology is a bit more technical. Here are the main terms:
| Term | Definition |
|---|---|
| Assertion | Any standard item of information, to be included in the metadata. |
| Hard binding | A SHA hash of the raw content (or a designated slice of it); a type of assertion. |
| Claim | A list of assertions by index, along with their respective SHA hashes; at least one assertion must be a hard binding. |
| Manifest | A JUMBF/CBOR structure comprising the assertions, the claim, an EdDSA signature of the claim, and the X.509 certificate of the signer. |
This structure guarantees that, insofar as the signer of the manifest is trustworthy, the content and the metadata are cryptographically tied together.
For more details, see the official C2PA specifications (version 2.2).
#What Is CAWG?
Perhaps the most important function of provenance is the ability to prove identity: which entity (individual or organization) created the content? For any type of brand — news media, marketing, celebrity — identity is crucial. But identity is also complicated: there are many types of identities, each with their own privacy concerns and implementation challenges.
CAWG answers this by introducing an identity assertion. The identity assertion is treated like any other assertion by C2PA (thus it is cryptographically tied to the content), but internally its structure is a full manifest, thereby linking the identity of the CAWG signer to the C2PA content. For more details, see 105: The Role of Cryptography.
There are a number of CAWG identity pilots, including Trufo's work with the IPTC and pilots based on social media credentials.
#C2PA++
C2PA alone, as a standard, is not enough to establish a fully-functioning ecosystem. Three essential pieces require further industry support:
- Durability: metadata is easily removed or simply lost. For the information to stick, watermarks and fingerprints are required. Learn more in 104: Watermarks and Fingerprints.
- Trust: C2PA's conformance program requires a new generation of Public Key Infrastructure (PKI) services to support the trust model. Learn more in 105: The Role of Cryptography.
- Complexity: implementing all these moving pieces correctly is difficult, even for large firms; enterprise solution providers are needed. Learn more in 106: Projects in Implementation.
Despite the challenges that come with the lofty goal of re-establishing trust in digital media, the ecosystem is growing rapidly, with leaders like Trufo paving the way.