C2PA only works if everything is signed
C2PA digitally signs images with cryptographic authenticity metadata, but is currently ineffective because almost no human-taken photos are signed while most AI images are—making signature removal a trivial way to fake human origin. For the system to work, all cameras must sign by default and all platforms must preserve metadata, requiring years of effort and regulation.
Background
- C2PA (Coalition for Content Provenance and Authenticity) is a technical standard that cryptographically signs image files with metadata about their origin — e.g., "taken by a specific camera" or "generated by ChatGPT." It uses public-key infrastructure (PKI), the same trust-chain system behind HTTPS.
- The EU AI Act, effective soon, requires AI-generated content to be marked; C2PA is the most prominent candidate for doing this with signed metadata, though the Act itself does not mandate it.
- The article argues C2PA is structurally sound but practically useless right now: nearly all signed images are AI-generated, while almost no human-taken photos (e.g., from iPhones) carry the signature. A photo without a signature is therefore indistinguishable from one that had its signature stripped — which trivial to do.
- For C2PA to work, every camera and phone would need to sign by default, and every social media platform would need to preserve the (sometimes large) metadata through re-encoding. The author thinks this will eventually happen but will take years of regulation and engineering, and in the meantime, C2PA functions mainly as "safety theater."