C2PA information is lost on all generated images (Content Authenticity)

[zodiac1978]

Since August 2026 the AI Act (2024/1689) demands all AI providers to make AI-generated images to be machine-readable as AI-generated.

There is a de-facto standard arising from the Coalition for Content Provenance and Authenticity (C2PA) which is trying to solve this technical problem.

Unfortunately all those metadata gets stripped for all thumbnail images. Even if we disable this via:

<?php
add_filter( 'image_strip_meta', '__return_false' );

You can test this with these online tools:
​https://verify.contentauthenticity.org/
​https://contentauthenticity.adobe.com/inspect

There is also a CLI tool for it:
​https://github.com/contentauth/c2pa-rs/blob/main/cli/README.md

The C2PA specifications can be found here:
​https://spec.c2pa.org/specifications/specifications/2.3/specs/C2PA_Specification.html

Original EU documents with more details:
​https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202401689#art_50
​https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content

The problem is, that we can't just copy the info to the new images. We need to create new content credentials and reference the original images as parent, as this is an "edit" for the C2PA spec.

Fortunately the EU knows about this general technical problem and allows other ways to declare AI-generation, but maybe in the future we need to have this fixed.

Just a heads up!

[zodiac1978]

Drupal has a solution for this problem: ​https://www.drupal.org/project/c2pa_sign

Their solution is not to "rescue" the metadata, but create new content credentials with the official c2patool. But this needs a certificate/key. And this is a module, not added to Drupal core.

[adamsilverstein]

Hey @zodiac1978 - thanks for the bug report.

A couple of clarifying questions:

• Is the data still present in your original uploaded file? My assumption is you are talking about the sub-sized images we generate when you upload.
• Can you check uploading in the media library vs. uploading by dragging and dropping an image onto the editor canvas? We use a new approach there since 7.1 and I want to confirm if the issue is present (and needs fixing) in both places.

[zodiac1978]

Replying to adamsilverstein:

• Is the data still present in your original uploaded file? My assumption is you are talking about the sub-sized images we generate when you upload.

Yes, it is about the sub-sized images (thumbnail, medium, larhe) which are auto generated via GD/Imagick by WordPress.

• Can you check uploading in the media library vs. uploading by dragging and dropping an image onto the editor canvas? We use a new approach there since 7.1 and I want to confirm if the issue is present (and needs fixing) in both places.

Yes, this is also true for media uploaded in the editor.

It is much more complicated than just metadata, because it seems to involve certification and trust chains.

[ocean90]

Related: ​https://github.com/WordPress/ai/issues/421 / ​https://github.com/WordPress/ai/pull/459

[adamsilverstein]

Thanks for the additional details @zodiac1978 and for the links @ocean90 - I will study up to understand the issue better.

[adamsilverstein]

@zodiac1978 as you pointed out, this will require cryptographic signing to add to the sub-sizes, and will likely need to happen on the server to keep keys secure.

I see there is an existing PHP effort with a compatible license, maybe this could help:

• ​https://github.com/provemark/content-credentials

A good place to start would be in the AI plugin eg. propose that WordPress create new credentials for the sub-sized images. This would be related (but slightly different) to the Issue @ocean90 linked above (​https://github.com/WordPress/ai/issues/421) I didn't see one for the subsized images, but may have missed something.

[JeffPaul]

A good place to start would be in the AI plugin eg. propose that WordPress create new credentials for the sub-sized images. This would be related (but slightly different) to the Issue @ocean90 linked above (​https://github.com/WordPress/ai/issues/421) I didn't see one for the subsized images, but may have missed something.

See ​C2PA: new Content Credentials for generated sub-sizes on the AI plugin roadmap, though needs someone to help pick that up.

[mauricevanloon]

I measured what WordPress and the most-used image plugins do to signed images. WordPress keeps the original as it was, Content Credentials included. The sizes it makes, the -scaled copy too, have none. So a visitor only gets valid credentials when the page shows the original itself.

Some plugins also replace the original and keep the signed file only as a backup. EWWW keeps none for large images, and WP-Optimize deletes its backups after 50 days. Then there's nothing left to sign the sizes from.

The write-up: ​https://provemark.github.io/articles/image-plugins-and-content-credentials/

Scripts and results: ​https://github.com/provemark/wp-image-c2pa-measurements

Checking is possible in plain PHP, also on shared hosting. I wrote a verifier for that:

​https://github.com/provemark/c2pa-verifier

And a plugin that shows the result in the Media Library:

​https://wordpress.org/plugins/tracefern-image-check-for-c2pa/

Signing the sizes, as comment:6 suggests, is still open. For the AI plugin, as comment:7 proposes, I opened an issue for it in September:

​https://github.com/WordPress/ai/issues/1058