For most of the internet’s history, the default assumption about a video was that it was real unless something suggested otherwise. Generative AI inverted that. Synthetic and manipulated media are now trivial to produce, and audiences, advertisers, and regulators can no longer take a stream’s origin on trust. C2PA — the Coalition for Content Provenance and Authenticity — is the open standard built to answer that problem, not by detecting fakes after the fact but by cryptographically recording where content came from and what happened to it along the way.
Until recently this was mostly a photography and newsroom story. That changed in December 2025, when C2PA 2.3 extended provenance to live and broadcast video. For anyone running a streaming platform there’s now a second reason to pay attention: the EU AI Act’s Article 50 transparency obligations enter into force in August 2026, requiring machine-readable labelling of AI-generated content. This guide explains what C2PA actually is, how it applies to video and live streaming specifically, where the chain tends to break in a real delivery pipeline, and — just as importantly — what the standard cannot do.
What C2PA Is
C2PA is an open technical specification for recording and verifying the provenance of digital media. It was founded as a joint initiative by Adobe, Arm, Intel, Microsoft, and Truepic, and now involves camera manufacturers, news agencies, platforms, and standards bodies. The consumer-facing name for the data it produces is Content Credentials — the badge you may have seen on images in some apps and social platforms. The specification itself is published by the C2PA, which also runs the conformance programme described later in this guide.
The core idea is a shift in burden. Detection-based approaches try to spot synthetic media after it exists, which is a losing race against continuously improving generative models. Provenance inverts it: content that carries valid credentials proves its own origin cryptographically, so it doesn’t need to be detected as genuine. Everything else is simply unverified — which is a far more tractable distinction to operate on.
How C2PA works
The unit of provenance is a manifest bound to the media asset. Inside it are assertions — structured statements about the content, such as what device captured it, what edits were applied, and whether generative AI was involved. Those assertions are gathered into a claim, and the claim is cryptographically signed using a certificate issued by a trusted authority. The signature is what makes the record tamper-evident: alter the media or the assertions, and validation fails.
Verification is deliberately self-contained. All the certificates needed to validate a manifest travel inside it, so a conforming validator can check a file offline without calling back to whoever signed it. That property is what makes the model useful in newsrooms, courtrooms, and any situation where the original platform might be unavailable or untrusted — and it’s the fundamental advantage over proprietary platform labels, which stay behind on the platform that applied them and can’t be independently verified elsewhere.
A useful analogy: think of a manifest as a tamper-evident shipping seal with a packing list inside. The packing list says what’s in the box and who handled it; the seal proves nobody opened the box since it was packed. Break the seal and you can still see the contents, but you can no longer trust the list.
Who gets to sign: trust and conformance
A signature is only meaningful if you trust the authority that issued the certificate behind it, so the standard needs a governance layer as well as a technical one. C2PA maintains a Trust List of certificate authorities whose certificates are recognised as valid, which replaced an earlier interim list during 2025. That earlier list was frozen at the start of 2026: content signed under it during its validity period remains valid under the legacy trust model, so existing signed assets weren’t invalidated, but products going forward need certificates from authorities certified under the current list to be considered conformant.
Alongside it sits a conformance programme, launched in 2025, which independently tests products — generators, validators, and certificate authorities — against the specification. This distinction matters commercially and is easy to miss: joining the broader content-authenticity coalition is a statement of intent, while appearing on the conformance list means a product has actually been verified against the spec. Thousands of organisations have done the former; far fewer have done the latter. When a vendor tells you their encoder or player supports C2PA, that’s the difference worth probing.
The chain of custody
Provenance is only as good as the chain. In an ideal video workflow, signing starts at capture — hardware-backed signing in the camera itself, which records what the device observed at the moment of creation and is the strongest possible signal. Editing tools then preserve and extend the record rather than discarding it, adding assertions for each transformation. Packaging, delivery, and playback carry the manifest through untouched, and the player or a verification tool can surface it to the viewer.
Hardware signing is genuinely shipping. Professional broadcast cameras with native C2PA signing arrived in 2025, several major camera manufacturers now have C2PA-capable products, and at least one flagship smartphone signs every photo by default rather than only AI-edited ones. Software-applied credentials — added after capture — are still useful, but they can’t offer the same chain-of-custody guarantee, because they can only attest to what was true from the point they were applied onward.
What Changed for Live Streaming
This is the development that moved C2PA from an adjacent concern to a streaming-infrastructure one. Before version 2.3, provenance could only be applied to static assets — finished files and video on demand. The reason is structural: the approach used for VOD hashes the complete asset into a Merkle tree and signs it, which requires knowing the whole asset in advance. A live stream, by definition, doesn’t exist yet.
C2PA 2.3, released in December 2025, closed that gap by defining signing at the CMAF segment level. Each segment — typically one to ten seconds of video — is independently signed as it is produced, so the provenance record builds continuously alongside the stream rather than being applied to a finished file.
The practical significance for operators is how little it demands. Segment-level signing works with existing HLS, DASH, CDN, and DRM infrastructure. No changes to manifests or codecs are required, and players that don’t understand provenance simply ignore the extra data and play the stream normally. That backward compatibility is the reason this is deployable rather than theoretical, and it’s why broadcast-oriented groups pushed for it: news and live event workflows are exactly where an unbroken chain from camera to audience matters most. At least one major public broadcaster has already implemented C2PA in a cloud pipeline, publishing the implementation under an open-source licence — which suggests this doesn’t require heroic infrastructure investment to trial.
Where the Chain Breaks
Here is the operational reality that vendor messaging tends to skip: signing content is the easy part. The chain breaks the moment something in the pipeline discards the manifest — and a great deal of ordinary media handling does exactly that. Uploads, re-encoding, format conversion, screenshots, and platform transformations routinely strip embedded metadata. A platform can genuinely support Content Credentials and still strip them in practice at a different stage of its own pipeline.
For a streaming operator, that makes provenance a pipeline question rather than a feature you switch on. Every stage that rewrites the media is a candidate failure point — and transcoding is the obvious one, since producing multiple renditions means re-encoding the source repeatedly. If your encoder, packager, storage layer, or delivery path drops the manifest, the credential is gone by the time the viewer could have checked it, no matter how carefully the content was signed at capture.
The industry’s answer to this is Durable Content Credentials — pairing the manifest with invisible watermarking and content fingerprinting, so that if the metadata is stripped, a recoverable identifier still survives and the provenance record can be looked up again. It’s a pragmatic acknowledgement that metadata alone is too fragile to carry the whole burden across an internet that constantly re-encodes things.
Adoption reflects that friction. According to Reuters Institute research, fewer than 1% of news images or videos published globally currently include C2PA metadata — and that’s among the publishers most motivated to use it. The infrastructure exists; routine use of it does not yet. Treating that gap as the current state rather than a permanent verdict is the sensible read.
A practical audit for your pipeline
If you want to know where you stand, the questions are concrete:
- Does anything in your ingest path strip metadata on upload?
- Do your encoding and transcoding steps preserve or discard the manifest when producing renditions?
- Does your packager carry provenance data through into HLS or DASH output?
- Does your storage and delivery layer pass the data through untouched?
- Can your player surface credentials to viewers, or would verification happen out of band?
Most teams find at least one break. Knowing where it is turns provenance from an aspiration into a scoped engineering task — and the answer may reasonably be that you preserve credentials for some content classes (news, rights-sensitive material) rather than everything.
What C2PA Does Not Do
Several misconceptions circulate widely enough to be worth correcting directly, because building policy on them leads to bad decisions.
- C2PA is not AI detection. It records what was declared at the time of signing. It cannot examine an arbitrary file and determine whether it was AI-generated. Provenance and detection are complementary — detection is what you fall back on for the vast quantity of content that carries no provenance at all.
- C2PA does not prove content is truthful. A validly signed video can still be misleading in framing, editing, or caption. The standard is a transparency layer describing origin and handling, not a verdict on accuracy.
- Absence of credentials is not proof of fakery. The overwhelming majority of legitimate content is unsigned, including everything created before adoption. Unsigned means unverified, not false.
- Support is not the same as conformance. A product claiming C2PA support is making a marketing claim; a product that has passed independent testing appears on the publicly accessible Conforming Products List. The gap between claimed and certified is still wide, so verify before you rely on a vendor’s badge.
There’s also a human limitation the technology can’t solve. Even where credentials are displayed correctly, viewer engagement with them is low — years of synthetic content have taught people to be sceptical of everything regardless of what a badge says. Industry research has consistently found that no single method, whether provenance, watermarking, or fingerprinting, prevents digital deception on its own. Provenance is a necessary layer, not a complete answer.
Why Streaming Operators Should Care Now
Beyond the general trust argument, three forces make this concrete in the near term.
The first is regulation. The EU AI Act’s Article 50 obligations take effect in August 2026, requiring machine-readable labelling of AI-generated content that is effective, interoperable, and robust. Proprietary, platform-specific labels don’t satisfy that across jurisdictions because they don’t travel with the content. An open, portable standard does — which is a large part of why C2PA has moved from voluntary good practice toward a compliance baseline.
The second is commercial. For rights-sensitive categories — news, live sports, advertising, regulated industries — verifiable provenance has practical value in contract negotiation, rights management, and legal review. It’s evidence, not just reassurance, and it sits naturally alongside the protections you already run such as encryption and geo-restriction.
The third is architectural lead time. Because provenance depends on an unbroken chain, retrofitting it into a mature VOD or live delivery pipeline is considerably harder than accounting for it while you’re already making decisions about encoding, packaging, and CTV distribution. Even if you don’t intend to sign anything this year, knowing which stages of your pipeline destroy metadata is worth establishing now.
Where to Start
A sensible sequence for a streaming team in 2026:
- Audit, don’t adopt. Establish where in your pipeline metadata survives and where it’s stripped, before committing to any signing strategy.
- Scope by content class. Decide which content genuinely needs provenance — news, sports rights, sponsored material — rather than treating it as all-or-nothing.
- Check conformance, not claims. When evaluating tools, use the Conforming Products List as the evidence base.
- Track the regulatory line. If you serve EU audiences, map the Article 50 obligations to your AI-assisted content workflows specifically.
- Plan for durability. Assume metadata will be stripped somewhere downstream and consider whether watermarking or fingerprinting belongs in your approach.
5centsCDN doesn’t currently offer C2PA signing or provenance preservation as a product feature — we’d rather say that plainly than imply otherwise. What we do provide is the secure delivery layer around your content: encrypted video streaming and live delivery, token-based access control, geo-restriction, and global edge distribution for OTT and media platforms. If you’re working through how provenance would fit alongside your encoding and delivery setup, or you want to know how our pipeline handles your content, get in touch and we’ll give you a straight answer.
Frequently Asked Questions
What does C2PA stand for?
C2PA stands for the Coalition for Content Provenance and Authenticity. It is an open standard for cryptographically recording where digital content came from and how it was modified. The user-facing implementation of the standard is branded Content Credentials.
Can C2PA be used with live streaming?
Yes, as of C2PA 2.3, released in December 2025. It defines signing at the CMAF segment level, where each segment of roughly one to ten seconds is independently signed as it is produced. It works with existing HLS, DASH, CDN, and DRM infrastructure, requires no manifest or codec changes, and players that do not support it simply ignore the provenance data.
Does C2PA detect AI-generated content?
No. C2PA records what was declared when the content was signed — it provides provenance, not detection. It cannot analyse an arbitrary file and determine whether AI was involved. AI detection tools take a separate, probabilistic approach and address content that carries no provenance data at all.
Why do Content Credentials disappear from my video?
Most likely something in the pipeline stripped the metadata. Uploads, re-encoding, transcoding, format conversion, and platform transformations all commonly discard embedded manifests. Durable Content Credentials, which combine the manifest with invisible watermarking and fingerprinting, are designed so a recoverable identifier survives that process.
Is C2PA required by law?
Not directly, but regulation is moving toward it. The EU AI Act’s Article 50 obligations, effective August 2026, require machine-readable labelling of AI-generated content that is interoperable and robust. C2PA is the leading open standard that satisfies that kind of requirement across platforms and jurisdictions, which is why adoption is increasingly framed as a compliance question rather than a voluntary one.
