Do Content Credentials survive upload? What the standard and platforms say

This page is part of the deepfake detection hub and follows the Content Credentials and C2PA explainer, which covers what a manifest contains. Here the question is narrower: what happens to that manifest between the camera or generator and the screen.

01What the standard says can be lost

The C2PA specification describes a Content Credential as a set of signed statements. "These statements, called assertions, make up the provenance of a given asset", and "These assertions, claims, and the claim signature are all bound together into a verifiable unit called a C2PA Manifest" (C2PA Content Credentials Technical Specification 2.5). The manifest is tied to the file by a hard binding, defined as "One or more cryptographic hashes that uniquely identifies either the entire asset or a portion thereof". Change the bytes the hash covers and the binding no longer validates.

The specification names the failure mode directly: "An asset can become separated from its C2PA Manifest due to removal or corruption of asset metadata". For that case it defines a soft binding, "A content identifier that is either (a) not statistically unique, such as a fingerprint, or (b) embedded as an invisible watermark", which a validator can use to find the manifest again. The Explainer adds the editing case: "if an asset is cropped using a non-Content Credentials aware tool, the provenance data may not be updated" (C2PA Explainer 2.2). So there are two distinct losses: the manifest removed with the metadata, and the manifest present but describing a file that has since changed.

02Where in the pipeline does it break?

The figure traces the five steps. At capture or generation a claim generator writes the assertions; for a generated asset the specification's example manifest starts with a c2pa.created action whose digitalSourceType is trainedAlgorithmicMedia. At signing, the manifest is signed "with the private key of the software or hardware that performed the operations", and "The basis of making trust decisions in C2PA, our trust model, is the identity of the signer". Neither step is where credentials are lost.

Upload and transcoding are. A platform that rewrites the container, strips EXIF-style metadata or re-encodes the video has changed the bytes, and the specification's hard binding is a hash of those bytes. The Explainer states that the manifest is "commonly embedded directly within the asset, though it can also be linked externally through a soft binding system (e.g., invisible watermarks)". Only the second route survives a re-encode, and only if the platform or the viewer's validator looks the manifest up. The re-encoding on social media page describes what that re-encode does to the pixels a detector relies on; this page is about what it does to the signature.

03Which platforms state that they read or keep Content Credentials?

Two platform statements describe their handling, and both are quoted from the platform's own newsroom.

The TikTok statement is the only one of the two that addresses the download side: credentials attached by the platform "will remain on content when downloaded" (TikTok newsroom, 9 May 2024). It also states a condition on the upload side: auto-labelling "needs to have the Content Credentials metadata for us to identify and label it", so a file that arrives stripped arrives unlabelled. The Meta statement describes reading C2PA and IPTC indicators to apply a label and concedes that "it's not yet possible to identify all AI-generated content, and there are ways that people can strip out invisible markers" (Meta newsroom, 6 February 2024).

04Does the conformance program cover platforms?

The C2PA Conformance Program, opened in June 2025 and now at version 0.2, "provides assurance that products adhere to the Content Credentials specification, and fulfill a set of security requirements to ensure they are producing and validating C2PA data correctly" (c2pa.org/conformance). It is "intended to hold generator products, validator products and certification authorities accountable", and conforming products "are placed on a publicly-accessible list", browsable through the Conformance Explorer alongside the C2PA Trust List.

The program's scope is generator and validator products. A platform that reads credentials is acting as a validator and can appear on the list for that; a platform's choice to keep, strip or relink manifests on upload is not what the list certifies. So the conforming products list answers "does this product sign and validate correctly", and the platform's own documentation is the only place that answers "does my credential survive your pipeline".

05What a missing credential does and does not mean

The absence of a Content Credential after upload is not evidence of manipulation, and the standard's authors say so: "it is not the intention of the specification and guidance to create a two-tier media ecosystem where assets without Content Credentials are universally less trusted" (Explainer 2.2). A stripped manifest looks the same as a manifest that was never written. Provenance and detection answer different questions, and the sibling page on deepfake detection tips tested against the evidence shows how little a viewer's eye adds once provenance is gone. The generator side matters too: a credential written by a generator records the generation, while a detector has to infer it from traces, and the GAN against diffusion artefacts page shows those traces also fail to survive resizing and compression.

A present and valid credential is also bounded: "provenance information alone cannot tell you whether the digital content is true, accurate or factual". It establishes who signed and what the signer asserted. The datasets that detectors train on sit outside this system entirely; none of the sets on the ForgeryNet dataset page or its neighbours carries a manifest, because they predate the first release of the specification in December 2021.

A Content Credential proves who signed an asset and what they asserted at that moment; whether the same bytes reach the viewer is a property of every platform in between, not of the standard.