Looking to implement C2PA? Trufo provides tooling to take care of everything from certificates and timestamping to watermarking and fingerprinting. Learn More

The C2PA Provenance Standard

adding trust into metadata

v2025.10.16

Over the past few years, a number of standards---both technical and regulatory---have been proposed and developed and implemented. On the regulatory side, the most consequential is the EU AI Act, whose Article 50 comes into force on 2 August 2026 and cites C2PA-style cryptographic provenance as an exemplar technology. For the latest overview (as of Q4 2025), we recommend this policy paper from the AI and Multimedia Standards Collaboration (AMAS):

Building Trust in Multimedia Authenticity through International Standards

A comprehensive policy paper from the IEC, ISO, and ITU examining international standards for multimedia content authenticity and trust in the digital age.

View ITU Policy Paper (PDF) →

The most prominent content authenticity standard for the past few years has been the C2PA standard.

What is C2PA?

The Coalition for Content Provenance and Authenticity (C2PA) is an open-source provenance standard centered around cryptographic metadata. For provenance, traditional metadata falls short because it is easily falsified: anyone can pull up an image editor and change the timestamp attached to an image. With C2PA, however, that metadata is secured by a digital signature. The HTTPS protocol that now powers the Internet operates on similar principles.

How C2PA works is that any time content is distributed, whether from an organization to the public or from a camera to some editing software, cryptographic metadata is recorded, thereby producing a chain of provenance information that spans the full content lifecycle. Then, downstream recipients will know with certainty if the content was published by the organization or captured by the camera, respectively. The most important aspect of C2PA is that it is an open standard. if you add the information, downstream consumers will recognize it.

Of course, a substantial burden is placed on the trust model underlying these "signing entities" in the ecosystem. As of October 2025, after a year of careful design, C2PA now has a mature trust model rooted in its conformance program. Trufo is one of the three inaugural Root CAs, alongside Google and SSL.com. For more details, see 105: The Role of Cryptography.

There are a dozen or so working groups within C2PA where industry experts iterate on the specifications. Anyone can join C2PA (there is a fee), and they also follow W3C patent policy.

Terminology

At a high level, content provenance can be broken down into two components: the annotation(s) and the association(s).

Annotations: the factual information recorded about the content.

Associations: the connection between the annotations and the content.

The annotations can contain any sort of information, but the two most common ones are the origin (AI, camera, art) and the publisher (artist, organization, celebrity). The associations are also come in many forms, including signed content hashes, invisible watermarks, indexed fingerprints, and more.

In the case of C2PA, the terminology is a bit more technical. Here are the main ones:

Assertion: any standard item of information, to be included in the metadata.

Hard Binding: a SHA hash of the raw content (or a designated slice of the raw content); it is a type of assertion.

Claim: a list of assertions by index, along with their respective SHA hashes; at least one assertion must be a hard binding.

Manifest: a JUMBF/CBOR structure comprising the assertions, the claim, an EdDSA signature of the claim, and the X.509 certificate of the signer.

This structure guarantees that, insofar as the signer of the manifest is trustworthy, the content and the metadata are cryptographically tied together.

For more details, please see the official C2PA specifications:

C2PA Specifications, Version 2.2

The official technical specification for the Coalition for Content Provenance and Authenticity (C2PA) standard, detailing the complete architecture for content provenance and authenticity.

View C2PA Specification →

What is CAWG?

Perhaps the most important function of provenance is the ability to prove identity: which entity (individual or organization) created the content? For any type of brand---news media, marketing, celebrity, etc.---identity is crucial. However, identity is also complicated: there are many types of identities, each with their own set of privacy concerns and implementation challenges.

CAWG is the answer to this, by introducing an identity assertion. The identity assertion is treated as any other assertion by C2PA (thus it is cryptographically tied to the content), but internally its structure is a full manifest, thereby linking the identity of the CAWG signer to the C2PA content. For more details, see 105: The Role of Cryptography.

There are a number of CAWG identity pilots, including Trufo's work with the IPTC and including social media credentials.

C2PA++

C2PA alone, as a standard, is not enough to establish a fully-functioning ecosystem. In particular, there are three essential pieces that require further industry support:

Durability: Metadata is easily removed or even just lost. In order for the information to stick, watermarks and fingerprints are required. Learn more in 104: Watermarks and Fingerprints.

Trust: C2PA's conformance program requires a new generation of Public Key Infrastructure (PKI) services to support the trust model. Learn more in 105: The Role of Cryptography.

Complexity: Implementing all these moving pieces correctly is difficult, even for large firms; enterprise solution providers are needed. Learn more in 106: Projects in Implementation.

Despite the challenges that come with the lofty goal of re-establishing trust in digital media, the ecosystem is growing rapidly, with leaders like Trufo paving the way.