The image provenance & privacy field guide
Know what your image shares about itself.
C2PA credentials, EXIF and AI source tags tell different stories. Learn to read the evidence, protect private details, and handle a platform label with the right next step.
Four signals. Four different questions.
| Signal | What it can tell you | What it cannot establish |
|---|---|---|
| EXIF / GPS | Camera settings, device details, dates and sometimes location. | Whether an image was or was not generated by AI. Fields can be absent or edited. |
| XMP / IPTC source tags | Declared tools, source types, editing information and attribution. | That every pixel shares the same origin, or that a declaration is independently verified. |
| C2PA credentials | Signed provenance records and validation findings about those records. | That an image is necessarily AI-generated, or that every stated claim is true. |
| Invisible watermarks / pixel signals | A separate class of signals embedded in or inferred from the content. | Our metadata checker does not test these signals. Removing file metadata does not remove them. |
The checker reads supported file records; it does not produce a visual “AI probability” score. Missing metadata is an unknown about provenance, not a certificate of authenticity. Read the Content Authenticity Initiative documentation ↗
Open the file. Inspect the evidence.
These examples let you reproduce the checks yourself. The PNG fixtures contain deliberately authored metadata; the C2PA image is a signed SDK sample. Reports are generated live by the checker.
An editor name is not an AI verdict
A photograph can be cropped or color-corrected in Photoshop. A software name alone does not identify generative editing. Inspect explicit source declarations and credentials before drawing a conclusion.
XMP CreatorTool: Adobe PhotoshopLook for: Editing software found; no recognized AI source declaration.
Illustrative PNG with authored metadata, not a camera original.
An explicit AI source declaration
A source-type tag declares AI generation. It may refer to a component or an earlier step rather than every pixel in a final composition. Metadata is editable, so consider the record alongside the original and editing history.
DigitalSourceType: trainedAlgorithmicMediaLook for: AI source metadata found, with the exact declaration shown.
Illustrative PNG with an authored IPTC source declaration.
Location privacy without an AI claim
A file can reveal a location without declaring anything about AI. Inspect before sharing, create a separate privacy copy when needed, and verify the GPS result again. Keep the original in your own archive.
GPSLatitude + GPSLongitudeLook for: GPS found; the privacy copy can remove it while preserving decoded pixels.
Illustrative PNG; fictional coordinates at 0°, 0°.
Signed credentials on a camera image
Content Credentials can record capture and ordinary edits as well as AI generation. Read the actions and source fields. A locally valid signature is different from checking a signer’s identity against an online trust list.
Embedded signed C2PA manifestLook for: Embedded credentials found. Read the live validation result; online trust is not checked.
Signed camera sample from the official C2PA SDK, distributed under MIT.
Reading credentials locally does not contact certificate trust lists or revocation services. C2PA sample license
The same file can receive different platform labels
A platform label is a decision about a post or account. A file report is one piece of evidence. Keep your original export and capture the exact label before deciding how to follow up.
Instagram & Facebook
Meta distinguishes AI generation from AI editing. Its September 2024 update moved labels for detected AI editing into the post menu. Read the “AI info” explanation first; editing records do not necessarily mean a fully generated image.
TikTok
Check whether a label was added automatically or by the creator. TikTok states that an automatic AI-generated label cannot be removed from the original post. Cleaning a local copy cannot change that post’s label.
Pinterest uses metadata, classifiers and creator disclosures. A label can therefore appear even without obvious file markers. If you believe a label on your Pin is incorrect, Pinterest directs you to its support team to appeal.
Official guidance reviewed November 5, 2026. Follow the linked pages for changes to policies or available controls.
Choose the cleanup that matches your goal
Preserve the encoded image
For supported JPG, PNG and WebP, the checker’s privacy copy removes descriptive metadata and verifies decoded pixels, color data and orientation. Credential removal requires an explicit choice.
Publish responsive web images
Resizing and converting create new encoded images. Source metadata is not copied into the asset set. Keep the original and carry necessary attribution or disclosures into your publishing workflow.
Prepare a product collection
Background removal changes visible pixels. Preserve source files, inspect cutout edges and review the destination’s requirements. Re-encoding is not proof that a product photo was made without AI.
A practical publishing checklist
Keep the source
Save the camera original or generation output and the editing project. A smaller delivery file should not become your only archive.
Inspect what you share
Review GPS, names, copyright and provenance before sharing the file or a metadata report. Reinspect the copy after any cleanup.
Document the workflow
Keep a brief record of capture, AI-assisted steps and export settings. Use factual evidence when reporting a suspected incorrect label.