Docs
C2PA, metadata, and a visible label
Three different things, doing three different jobs. Most of the confusion comes from treating them as one decision.
Embedded metadata
Your image file has a header, and the header has room for text fields. The relevant one is IPTC DigitalSourceType, carried inside an XMP packet, whose value is an IRI from a controlled vocabulary — for a generated image, http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia.
It is plain text. Anybody with exiftool can read it, change it or delete it. That is the weakness and also the reason it is the practical answer: every image tool on earth already understands XMP, so the marking is readable everywhere without anyone adopting anything new.
This is what the EU AI Act's “machine-readable format” language is being read to mean in practice, and it is what the labeler writes on every plan including the free one.
C2PA Content Credentials
C2PA wraps the same kind of assertion in a cryptographically signed manifest. The manifest records what was done to the image, hashes the pixel data, and is signed by a certificate. Change one pixel and the claim no longer validates.
That gives you something metadata cannot: proof that a specific party made a specific declaration at a specific time, which nobody can forge after the fact. In a dispute — a takedown appeal, a client arguing about what you delivered — that is a materially stronger record than a text field anyone could have typed.
C2PA also breaks easily in ordinary use. Any resize, re-encode or edit by software that does not understand C2PA invalidates the claim, and most of the software your images pass through does not understand C2PA yet.
A visible label
Text burned into the pixels. It is not machine-readable, so it satisfies nothing in Article 50(2), and it does not appear in your listing description, so it does not satisfy 50(4) either.
It is still worth using, for a reason that has nothing to do with compliance: on a marketplace, buyers open the image before they read the description. A corner label is the only one of the three that a human sees at the moment they form an impression of the product. It is the mechanism that prevents the complaint, rather than the one that wins the appeal.
What survives what
| Metadata | C2PA | Visible label | |
|---|---|---|---|
| Uploading to Etsy or Shopify | Usually survives | Usually survives | Always survives |
| A platform resizing your image | Often stripped | Stripped, and the claim breaks | Survives |
| Screenshotting it | Gone | Gone | Survives |
| Cropping in Canva or Photoshop | Usually kept | Kept if the editor supports C2PA, else gone | Survives unless cropped out |
| Saving from a browser as WebP | Gone | Gone | Survives |
| Someone deliberately removing it | Trivial | Trivial to remove, impossible to forge | Needs an editor and leaves a mark |
So which do you need?
Metadata plus a written disclosure line. That combination covers both halves of Article 50 and costs nothing. Do that first, and do it on every image, before you think about anything else.
Add a visible label on marketplaces where images carry the listing — prints, wall art, digital downloads, anything where the image is the product rather than a photograph of the product.
Add C2PA if you are handling work for clients who may later dispute what you delivered, if you publish to LinkedIn or Meta surfaces where the credential is read and displayed, or if you want a signed record for your own protection. It is a paid feature here because signing costs us certificate infrastructure, not because the disclosure it makes is any better.
Checking your own files
Do not take our word for it. Install exiftool and run it over a file the labeler gave you:
exiftool -G1 -a your-image.jpg | grep -i "digital source"
You should get back [XMP-iptcExt] and the IRI. Then upload the same file to your platform, download it back from the live listing, and run the same command. That second result is the one that tells you whether the marking survived, and it is the only test that matters. What we found when we did that.