How to prove a real photo is real with C2PA

Most C2PA discussion starts with AI-generated images. There is a second, equally useful side: recording that a photograph came from a camera. For newsrooms, property listings, insurers, marketplaces and brands, that can make a real image easier to distinguish from a convincing synthetic one.

This is a technical guide, not legal advice. It explains what a C2PA digitalCapture record can show, and what it cannot.

A caption is a claim. A signed record is evidence.

Anyone can write “original photo” below an image, and ordinary metadata can be removed or altered. A C2PA Content Credentials record is cryptographically signed. It can state that an image was captured by a particular device or workflow, and it can record later edits without pretending the image is untouched.

Start at capture, not at publication

The strongest record begins as close as possible to the camera or ingest step. If a photographer exports a JPEG, sends it through several editors and only then adds a label, the later label cannot reconstruct the original capture history. It can only describe the point at which it was added.

For a working process, identify the first controlled point: a camera that supports Content Credentials, a phone capture workflow, a newsroom ingest service, or a trusted archive. Sign there, keep the original, and make later changes part of the record.

Editing does not make a photo “fake”

Crop, exposure correction, colour grading and retouching are normal production steps. C2PA is useful precisely because it can record these changes. The goal is not a simplistic “unedited” badge; it is an understandable chain: captured, then edited in these known steps.

That also means the workflow needs a decision for AI-assisted edits. If generative fill or an AI image tool materially changes a photo, record the tool and change honestly. Do not use a camera-origin claim to hide later synthetic work.

Test the copy the audience receives

A valid record in the original does not guarantee that it survives your CMS, image CDN, download service or social upload. Keep two files for the test: the signed source and the actual delivered copy. Check both, note the route and date, then fix the step that strips the record.

AI Detective’s free file check is a simple first check for supported image, video, audio and PDF files. For a repeatable record, use the same route a real user takes — not a convenient copy from an internal folder.

A small, practical capture checklist

• Keep the original capture or signed ingest file unchanged.
• Record the camera, capture or ingest system that created the first provenance record.
• List every editor, export, CDN and publication step after it.
• Check the source and delivered copies separately.
• Keep the date and verification result with both files.