# C2PA Content Credentials for product images, and what your shop platform strips What C2PA Content Credentials are, how to check a product image for them, and why many shop platforms and CDNs strip them before a customer sees the file. - URL: https://humblebob.com/journal/c2pa-content-credentials-product-images - Publisher: HUMBLEBOB (https://humblebob.com) - Published: 2026-09-29 - Updated: 2026-09-29 --- C2PA Content Credentials are signed metadata inside an image file that record where the image came from and how it was made, including whether AI generated it. For product images they matter because Google, Meta and LinkedIn read them, and marketplaces have started to ask for AI metadata inside the file. They are also fragile. A resize or format change removes them unless the tool is built to carry them over, and Shopify re-encodes every image it serves. Of 163 image files HUMBLEBOB downloaded from seven Shopify stores, not one carried a credential. To check a file, drag it into [Content Credentials Verify](https://verify.contentauthenticity.org/). Below is what a credential contains, what survives where, and a workflow that keeps provenance intact from master file to marketplace. [Video: The short version: 163 product image files checked, not one with a credential, and the order that keeps a credential valid.](https://humblebob-media.humblebob.workers.dev/humblebob-website/content/video/sj-c2pa-a054224223.mp4) (Motion: HUMBLEBOB) > We checked 163 product image files. 0 carried a Content Credential. The signature covers the exact bytes of the file. A resize or a new format removes it. Keep the signed masters in your DAM or PIM. Write the metadata first, then sign. Source: HUMBLEBOB test of seven Shopify stores, September 2026. ## What C2PA is The Coalition for Content Provenance and Authenticity is a project of the Joint Development Foundation, a non-profit. Adobe, Amazon, Google, Meta, Microsoft, OpenAI and TikTok sit on its [steering committee](https://c2pa.org/). Shopify and Zalando were not among the members listed on its site in September 2026. It publishes the technical standard behind "Content Credentials", which is the preferred plain-language name for a C2PA manifest. The current version is [specification 2.4](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html), from April 2026, which added a dedicated assertion for AI disclosure. The building blocks, in plain terms: - **Assertions** are statements about the image: which tool created it, which actions were applied, whether AI was used. - **The claim** bundles those assertions and ties them to the exact bytes of the image with a hash. - **The signature** seals the claim with a certificate, so anyone can check who made the statement and whether the file has changed since. - **Ingredients** are references to the files an image was made from, each of which can carry its own credential. That is how a resized web version can point back to its master. ## Content Credentials, IPTC and watermarks are three different things | | What it is | Survives re-encoding? | Who reads it | |---|---|---|---| | C2PA Content Credentials | Signed metadata embedded in the file | No. Any change to the pixels or the file breaks or removes it | Google's "About this image", LinkedIn, Meta, verify tools | | IPTC Digital Source Type | A plain metadata field (XMP) with values such as "Created using Generative AI" | Sometimes, depending on the tool | Google Merchant Center, Meta, photo software | | Invisible watermark (such as SynthID) | A signal woven into the pixels themselves | Mostly, though not guaranteed | The maker's own detection tools | ![Two folded shirts: a hand holds open scissors against the string of a blank paper tag on one, while the other has a leaf pattern woven into ](https://humblebob-media.humblebob.workers.dev/humblebob-website/content/c2pa-tag-analogy-1536-c23c25fe38.webp) *An analogy: a tag tied on, like metadata, is easily cut off, while a pattern woven into the cloth, like a watermark, is harder to remove but carries less information. (AI-generated image)* The IPTC field uses fixed values from the [IPTC Digital Source Type vocabulary](https://cv.iptc.org/newscodes/digitalsourcetype/). The two that matter most for product imagery are `trainedAlgorithmicMedia` ("Created using Generative AI") and `compositeWithTrainedAlgorithmicMedia` ("Edited using Generative AI"), stored in XMP as `Iptc4xmpExt:DigitalSourceType`. C2PA can carry the same value inside its own actions. OpenAI puts the trade-off this way: metadata ["can be stripped, lost through uploads and downloads, or broken by transformations like file format changes, resizing, or screenshots"](https://openai.com/index/advancing-content-provenance/), while watermarks survive more but carry less information. That is why the EU's [Code of Practice on AI-generated content](https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content) asks generator providers to use both: signed metadata and an imperceptible watermark. ## Which tools add them - **OpenAI** adds C2PA to generated images, and since 19 May 2026 also an invisible SynthID watermark. Its [verify tool](https://openai.com/verify/) checks both. - **Google** watermarks its AI images with SynthID, and has added C2PA credentials to images from its newer image models [since November 2025](https://blog.google/innovation-and-ai/products/ai-image-verification-gemini-app/). - **Adobe Firefly** [applies Content Credentials automatically](https://helpx.adobe.com/firefly/web/get-started/learn-the-basics/content-credentials-overview.html) to fully generated images. In recent sample images from generators that add C2PA, HUMBLEBOB found a valid C2PA manifest with the "Created using Generative AI" value inside it, but no separate XMP field. That is the field Google Merchant Center asks for. ## How to check an image for Content Credentials - **[Content Credentials Verify](https://verify.contentauthenticity.org/)**: drag an image into the browser and see its credentials and history. Works with JPEG, PNG, WebP, AVIF, HEIC, TIFF and more. - **[c2patool](https://github.com/contentauth/c2patool)**: the open-source command-line tool. On a Mac, `brew install c2patool`, then `c2patool yourfile.jpg` prints the manifest. - **[Adobe Content Authenticity](https://contentauthenticity.adobe.com/inspect)**: a web inspector and a Chrome extension that show credentials on images while you browse. - **[OpenAI's verify tool](https://openai.com/verify/)**: checks for OpenAI's credentials and watermark. A missing credential does not prove an image is not AI-generated. It may have been stripped on the way. ## What survives your shop platform We tested this step ourselves. ![HUMBLEBOB's Shopify test in three figures: 41 product images, 163 files downloaded, 0 with Content Credentials.](https://humblebob-media.humblebob.workers.dev/humblebob-website/content/c2pa-shopify-test-1440-4c755d59b7.webp) *What reached the customer in our test: none of the 163 files served by seven Shopify stores carried a credential. (Diagram: HUMBLEBOB)* **Shopify.** HUMBLEBOB tested 41 product images from seven Shopify stores, each requested in up to four different ways: 163 files in total. None contained C2PA data. Shopify re-encodes images even when you request the original URL, serving a different format depending on the browser. XMP metadata appeared only in some WebP responses, and there it came through in full, down to a camera and lens serial number. One caveat: we could not prove that every original upload carried credentials, so the test shows what reaches the customer, not exactly where the data was lost. Shopify does not document its metadata handling as far as we could find. **Cloudflare.** Cloudflare Images has an opt-in setting, [Preserve Content Credentials](https://developers.cloudflare.com/images/transform-images/preserve-content-credentials/), that keeps existing credentials and signs the transformations it applies. With the setting off, existing credentials "will always be discarded". Its Polish optimisation strips metadata as well. **Social platforms.** LinkedIn [shows a Content Credentials icon](https://www.linkedin.com/help/linkedin/answer/a6282984) on signed images. Meta [reads C2PA and IPTC signals](https://about.fb.com/news/2024/02/labeling-ai-generated-images-on-facebook-instagram-and-threads/) to apply its "AI info" label. Google's ["About this image"](https://blog.google/technology/ai/google-gen-ai-content-transparency-c2pa/) reads C2PA in Google Images and Lens. ### HUMBLEBOB Shopify test > **HUMBLEBOB Shopify metadata test, September 2026.** > > **Method:** 41 product images from seven Shopify stores, each downloaded in up to four ways (163 files), checked for Content Credentials (C2PA) and XMP metadata. > > **Result:** none of the 163 files carried Content Credentials; XMP appeared only in some WebP responses. > > **Limitation:** we could not see the original uploads, so the test shows what reaches the customer, not where the data was lost. > > **Source:** HUMBLEBOB, [this page](https://humblebob.com/journal/c2pa-content-credentials-product-images#humblebob-shopify-test) ## What marketplaces ask for - **Google Merchant Center** [requires](https://support.google.com/merchants/answer/14743464) that "All images created using generative AI must contain meta data indicating that the image was AI-generated", using the IPTC `TrainedAlgorithmicMedia` value, and asks you not to remove it. The page does not say whether Google reads the value from inside a C2PA manifest or only from XMP. Since the generator files we checked carry it only inside C2PA, the safe choice is to write the XMP field as well. - **Amazon** asks sellers to add the keyword `contains-synthetic-performer` to the XMP subject field when the people in an image are [entirely generated by AI](https://sellercentral.amazon.com/help/hub/reference/external/G1881). - **Zalando** requires [identifying data in the metadata or an invisible watermark](https://partner.zalando.com/university/article/zalando-image-guidelines) in AI-generated files by December 2026, and puts the burden on the seller: "Ensure metadata is permanent so it isn't stripped during upload." ## Order matters: write metadata first, then sign A C2PA signature covers the exact bytes of the file. Any change afterwards breaks it: adding the IPTC field to an already signed file turns the credential from valid to invalid, and a resize or format conversion removes it, unless the tool is built to carry it over. ![Five steps: write the metadata, sign the master, make web versions, sign each one again, verify after upload.](https://humblebob-media.humblebob.workers.dev/humblebob-website/content/c2pa-sign-order-1440-49149150da.webp) *The fixed order: metadata first, then the signature, and every resized or converted copy signed again with the master as its ingredient. (Diagram: HUMBLEBOB)* So the order is fixed. Write the IPTC and other metadata first, then sign. For every derivative, such as a resized web JPEG or a WebP, sign the new file again and reference the master as an ingredient. That keeps the chain from master to web version verifiable. ## Credentials are not a label Under the EU AI Act, a visible disclosure is required for deep fakes, and the Commission's guidelines are explicit that deployers ["cannot rely on the machine-readable marking"](https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems) for that, because customers cannot see it. Content Credentials support transparency. They do not replace the label. See [our article on Article 50](https://humblebob.com/journal/eu-ai-act-article-50-fashion-ecommerce) for what the label has to look like. ## A workflow for product images 1. **Keep signed masters** in your DAM or PIM. They are the record, even if the storefront strips everything. 2. **Write the IPTC Digital Source Type** into every generated or AI-edited image before signing. 3. **Sign every derivative** you create, with the master as an ingredient. Signing needs a certificate, and C2PA keeps a trust list of the authorities that issue them, so in practice this is a job for your image vendor, your DAM or a CDN that signs its own transformations. 4. **Check how your images are served.** If you use Cloudflare, turn on Preserve Content Credentials. For other CDNs and shop platforms, test what they serve. 5. **Verify after upload.** Download a few images from your live product pages and marketplaces, and check them with c2patool or Content Credentials Verify. 6. **Follow each marketplace's rule** for AI metadata, and add a visible label where the law requires one. ![An open plan-chest drawer of large product photo prints between tissue, with gloved hands lifting one print by its edges.](https://humblebob-media.humblebob.workers.dev/humblebob-website/content/c2pa-master-archive-1536-2133def93f.webp) *Masters kept as the record: even when a storefront strips the credentials from what it serves, the signed master in your DAM or PIM still holds them. (AI-generated image)* Ask your image vendor, HUMBLEBOB included, which provenance data its files carry. Files keep their credentials only if the platforms after the vendor let them. --- About the publisher: HUMBLEBOB is a production partner for fashion imagery. We read your brand, sort your briefing, make the assets, deliver them ready for your channels and put what we learn into the next drop.