A provenance standard records edits, not the truth of a file

What happened

The Coalition for Content Provenance and Authenticity, C2PA, publishes an open specification for recording how a digital file was created and edited. Its steering committee, as listed on the coalition's own site when retrieved on 16 September 2026, includes Adobe, Amazon, BBC, Google, Meta, Microsoft, OpenAI, Sony and TikTok. The specification, version 2.0, states its own date as January 2024, and defines the format marketed as Content Credentials. The Content Credentials site, also as retrieved, compares the manifest to 'a nutrition label for digital content'. Music distribution is not among the founding members.

What the documents say

The specification text builds a manifest from 'assertions' covering creation, edits, capture device and ingredients, wrapped into a digitally signed 'claim'. Crucially, it disclaims judging the content itself: C2PA data should show only whether assertions 'can be validated as associated with the underlying asset, correctly formed, and free from tampering', not whether content is authentic in any everyday sense. It also separates a hard binding, a cryptographic hash tying the manifest to exact bytes, from a soft binding such as a watermark that could survive re-encoding, and states plainly that version 2.0 defines no approved soft-binding algorithm at all. For audio, the specification references formats such as AIFF but sets out no audio-specific assertion type.

Why it matters for makers

A manifest is a chain-of-custody record, not a lie detector. If the plug-in, generator or export step that produced a file never writes one, that silence says nothing about whether the underlying audio was generated. Where a manifest is present, it records the tool and edit actions the exporting software chose to declare, not the training data behind a model or whether a credited human performed the work. Because the current standard leans on hard, byte-level hashing rather than a defined audio watermark, an otherwise untouched manifest can still be invalidated by an ordinary bounce, format conversion or loudness-normalising upload that most releases go through anyway.

What to check before you use it

Confirm whether the specific tool in your chain, the generator, the DAW's export, or your distributor's ingest, actually writes or preserves C2PA data; most audio tools do not yet. If a manifest is attached, check the sources it names rather than assuming a checkmark equals a licence. This is an editorial reading beyond the specification: treat a present manifest as one input to a rights check, and treat its absence as inconclusive, since the standard depends entirely on tools opting in.

• Does the software that produced or edited this file write a C2PA manifest at export, and does the destination platform keep it intact?
• If a manifest exists, does its hard binding still validate after your own bounces, conversions or uploads?
• What does the manifest actually assert about this file, as opposed to what you are inferring from its mere presence?

C2PA gives the industry a shared vocabulary for describing a file's declared history, which is worth more than nothing. It is not yet a music-specific proof of authorship, consent or training-data status, and the specification's own text warns against reading it as one.

Continue in Rights & release, or DeepMind watermarked its own generated music, not music generally.