AI Content Provenance: SynthID, C2PA and India's IT Rules 2026

AI content provenance is verifiable evidence of where a piece of media came from and whether AI created or changed it. Two technologies carry most of that evidence today. Google DeepMind’s SynthID hides a watermark inside the content itself. C2PA, the open standard behind Content Credentials, attaches a cryptographically signed record of the file’s origin and edits.

In India, AI content provenance stopped being a research topic on 20 February 2026. From that date, the amended IT Rules require platforms that let users create or share synthetic audio, images or video to label it and embed provenance data, and require the largest social platforms to check what users upload.

Much of what circulated about those rules describes the October 2025 draft rather than the text MeitY notified. The two differ in ways that change the scope of work, so the rule sections below follow the notified version and point out where the draft said something else.

Watermark, manifest and label are three different things

The word “watermark” gets used for all three, and the confusion travels straight into requirement documents.

• A visible label is a notice a person can see or hear, such as “AI-generated” on a video frame or a spoken disclosure before a clip.
• An invisible watermark is a signal embedded in the pixels, audio or word choices of the content. Software can detect it. People cannot.
• A provenance manifest is a signed data record about a file: what created it, which tools edited it, and whether it has changed since.

SynthID is an invisible watermark. C2PA is a manifest standard. Neither is a visible label, which matters because India’s rules ask for a label as well as embedded provenance.

Tap to enlarge

One boundary before going further. Provenance for AI-written code, meaning which commits an agent produced and who approved them, is a separate problem with different tooling, covered under governance in the AI-native SDLC. This article is about media.

What is SynthID, and how does it watermark AI-generated content?

SynthID is Google DeepMind’s technology for embedding an imperceptible watermark into AI-generated content at the moment it is generated, and for detecting that watermark later. It works on images, video, audio and text. Because the watermark lives in the content rather than in file metadata, re-saving a file without its metadata does not remove it.

How SynthID embeds the mark depends on the medium.

Images and video. The watermark is embedded directly in the pixels of the image or video. Google says it is designed to survive cropping, filters, frame-rate changes and lossy compression. DeepMind’s own launch post in August 2023 was plain about the limit: SynthID “isn’t foolproof against extreme image manipulations.”

Audio. Google applies an inaudible watermark to audio generated with its Lyria music model and says the mark withstands added noise, MP3 compression and speed changes.

Text. There are no pixels in a paragraph, so SynthID Text works on word choice. It runs as a logits processor inside the generation pipeline: a keyed pseudorandom function slightly adjusts the probabilities of candidate tokens, leaving a statistical pattern that a detector holding the same keys can score. Google DeepMind open-sourced SynthID Text in October 2024, and a production implementation ships in Hugging Face Transformers from v4.46.0.

Google’s developer documentation states two limits of SynthID Text that belong in any internal policy note. The watermark is less effective on factual responses, where the model has few valid ways to phrase the answer. And detector confidence “can be greatly reduced” when AI-generated text is thoroughly rewritten or translated into another language.

SynthID detection results are easy to misread. A SynthID detector finds SynthID watermarks and nothing else. Google launched the SynthID Detector portal in May 2025, initially for early testers through a waitlist, and the Gemini app can now check uploaded media for the watermark. A “not detected” result means the content was not marked by a SynthID-enabled system, or the mark did not survive. It does not mean a person made it.

Coverage is widening. In May 2026 Google said it had watermarked more than 100 billion images and videos with SynthID, and that OpenAI, Kakao and ElevenLabs “are bringing SynthID technology to more of their AI-generated content.” Both statements are Google’s own.

What is C2PA, and how is it different from a watermark like SynthID?

C2PA, the Coalition for Content Provenance and Authenticity, publishes an open technical standard for attaching a tamper-evident provenance record to a media file. Products display that record as “Content Credentials”. Where SynthID hides a signal inside the content, a C2PA manifest is a signed statement about the content that travels with the file.

A C2PA manifest works in four steps:

1. Assertions record facts about the asset, for example that a generative AI tool created it or that an editor cropped it.
2. The claim gathers those assertions together with a hard binding, a cryptographic hash of the asset (the specification gives SHA2-256 as an example).
3. The claim is signed with an X.509 certificate. A validator checks the signature against a trust list and recomputes the hash. Any alteration to the asset after signing breaks the match.
4. The manifest is usually embedded in the file, though the specification also allows it to be stored externally.

C2PA’s main weakness is written into its own explainer: “Can the provenance metadata be removed? Yes it can.” A screenshot is a new file that does not carry the original manifest. Neither does the output of an upload, resize or transcode step that drops metadata, and dropping it is sometimes the default: the Node.js image library sharp, for one, removes all metadata unless told otherwise. Once the manifest is gone, the file carries no C2PA evidence either way.

C2PA’s answer is durable Content Credentials. The hard binding is paired with a soft binding, an invisible watermark or a content fingerprint, which lets a tool look the manifest up in a repository even after it has been stripped from the file. The current specification is C2PA 2.4, published in April 2026.

C2PA also makes no judgement about truth. Its explainer says provenance information alone “cannot tell you whether the digital content is true, accurate or factual.” A valid manifest proves who signed what. It does not prove the scene happened.

How SynthID and C2PA relate

Google joined the C2PA steering committee in February 2024 and now ships both. Since November 2025, images generated by Nano Banana Pro (Gemini 3 Pro Image) in the Gemini app, Vertex AI and Google Ads carry C2PA metadata. In May 2026 Google began rolling out C2PA verification in the Gemini app, with Search and Chrome to follow.

SynthID and C2PA are still two systems, not one. C2PA maintains a public list of registered soft-binding algorithms, the watermarks and fingerprints a C2PA tool can use to recover a lost manifest. On 14 September 2026 that list held 53 entries, including watermarks from Adobe, Microsoft and Digimarc. SynthID was not among them. Do not expect a standard C2PA validator to use a SynthID watermark to find a stripped manifest; treat the two as independent signals.

Both signals matter more as generators move from single images to entire navigable scenes. That shift, and whether your team needs to learn the models behind it, is what AI world models covers.

Watermark vs manifest: a practical comparison

The last row is an interpretation, not an official mapping. The rules name no technology.

Use a manifest when you need to show a file is unaltered since your system produced it. Add a watermark when you need a signal that survives metadata stripping and compression. For India, either one still needs a visible label next to it.

What do India’s IT Rules 2026 require for AI content labelling, and who is responsible?

This section summarises published rule text for planning purposes. It is not legal advice. Confirm how the rules apply to your product with qualified counsel.

India’s Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (Gazette notification G.S.R. 120(E), notified 10 February 2026, in force 20 February 2026) place AI labelling duties on intermediaries, meaning platforms and tools, rather than directly on the people who create content. Services that let users create, alter, publish or share synthetic media must label it and embed provenance data. Significant social media intermediaries must collect a declaration from uploaders and verify it before publishing.

What counts as “synthetically generated information”

Under Rule 2(1)(wa) of the IT Rules as amended, synthetically generated information (SGI) is audio, visual or audio-visual information that is artificially or algorithmically created or altered so that it appears real, authentic or true, and depicts a person or event in a way likely to be perceived as indistinguishable from a real person or real-world event.

Three kinds of content are excluded from SGI:

• routine or good-faith editing, such as colour correction, noise reduction, compression or transcription, that does not materially alter the meaning;
• routine creation of documents, presentations, PDFs, and training or research material, as long as no false document or false electronic record results;
• use of tools solely to improve accessibility, clarity, quality, translation or searchability, without manipulating a material part of the content.

Text on its own is not SGI. MeitY’s FAQ on the rules states that “pure text / written outputs, by themselves, are not SGI”. A chatbot’s written answer falls outside the SGI framework, although the general rules on unlawful content still apply to it.

Who carries which duty

A significant social media intermediary is a social media platform above a government-notified number of registered users in India. That threshold was set at 50 lakh in 2021.

Tap to enlarge

What the rules do not say

Some coverage described a labelling duty on “creators” or “first uploaders”. The notified text contains no standalone obligation on creators to label their own content. A user’s part runs through the platform: the declaration at upload on large social platforms, and the terms and warnings attached to AI tools. “First originator” does appear in the IT Rules, but in Rule 4(2), an older provision requiring large messaging services to identify a message’s originator under a court or Section 69 order. It has nothing to do with labelling.

Neither SynthID nor C2PA is named. The rules specify outcomes (a visible label, embedded provenance with an identifier, protection against removal) and leave the choice of technology to the intermediary.

How the notified rules changed from the October 2025 draft

• Label size. The October 2025 draft required a label covering at least 10% of the visual display, or the first 10% of an audio clip’s duration. The notified rule dropped the percentage. Visual labels must be prominent, easily noticeable and adequately perceivable; audio gets a prefixed disclosure.
• Scope. The draft defined SGI as any information that “reasonably appears to be authentic or true”, which on its face included text. The notified definition covers only audio, visual and audio-visual content depicting people or events, and adds the three exclusions.
• Label and metadata. The draft asked for a label or embedded metadata. The notified rule asks for a label and embedded provenance, with the metadata duty qualified by technical feasibility.
• Blocking duty. The draft had no list of prohibited SGI. The notified rule adds one that services must actively prevent.

The rules are still moving. On 30 March 2026 MeitY published a draft Second Amendment that would require visual labels to be “continuous and clearly visible” throughout the duration of the content. That Second Amendment was still a draft when we checked on 17 September 2026: MeitY’s consolidated rules remain “updated as on 10.02.2026”, and Rule 3(3)(a)(ii) still reads “prominent visibility in the visual display”. Check its status before you sign off label designs.

What happens if AI-generated content isn’t labelled under India’s new rules?

For a platform, the main consequence is loss of safe harbour. Rule 7 of the IT Rules says an intermediary that fails to observe the rules loses the protection of Section 79(1) of the IT Act, which shields intermediaries from liability for third-party content, and becomes liable to punishment under laws including the IT Act and the Bharatiya Nyaya Sanhita. For a user, consequences range from removal and account suspension to penalties under whichever law the content breaks.

Large platforms carry an extra exposure. Under Rule 4(1A), a significant social media intermediary that “knowingly permitted, promoted, or failed to act upon” SGI in breach of the rules is treated as having failed to exercise due diligence, and the rule’s explanation makes it responsible for ensuring no SGI is published without a declaration or label.

The amendment sets no penalty amount for a missing label. Exposure comes through losing safe harbour and through laws that already exist.

Removal, on the other hand, is protected. Rule 2(1B) states that taking content down in compliance with the rules, SGI included and automated tools included, does not breach the conditions in Section 79(2)(a) or (b). Our reading is that a platform facing a borderline case will find removal the lower-risk choice.

For users, Rule 3(1)(ca) spells out what can follow unlawful SGI: immediate removal, suspension or termination of the account “without vitiating the evidence”, disclosure of the user’s identity to a complainant who is the victim, and reporting to authorities where the offence must be reported. Penalties can arise under the IT Act, the Bharatiya Nyaya Sanhita, the POCSO Act and the Representation of the People Act, 1951, among others.

A company that only uses a platform, such as a brand posting an AI-generated advert on a large social network, meets the rules at the upload screen. A false “no” on the SGI declaration is a breach of the platform’s terms, and Rule 3(1)(c) requires platforms to tell users that breaching their terms can lead to removal of content or suspension of the account.

How should IT and product teams prepare workflows for AI content provenance?

IT and product teams should start by mapping every place their product creates, edits or accepts synthetic media, decide with counsel which role India’s IT Rules 2026 assign on each of those surfaces, and then test whether the media pipeline keeps the labels and provenance metadata they add. Expect the pipeline work to take longer than the policy decision.

A Monday-morning checklist

1. List every surface that touches synthetic media. Generation features, avatar and voice tools, AI photo edits, vendor-made marketing video, user uploads. For each, record the model or API vendor and what its output carries: a C2PA manifest, a watermark, both, or nothing.
2. Assign the role per surface. A feature that lets users generate realistic images or voices points to Rule 3(3), and so can a service that lets users publish or share such content. A platform hosting user uploads owes the Rule 3(2) timelines, and Rule 4(1A) as well above the significant-platform threshold. Using AI to make your own campaign assets makes you a user of someone else’s platform. Plenty of products sit in more than one row.
3. Run a stripping test. Generate one image and one video that carry Content Credentials. Push both through your real upload, resize, CDN and transcoding path, download the results and inspect them with c2patool or the Content Credentials Verify site. If the manifest has gone, you now know which stage removed it.
4. Put the visible label inside the content. A badge drawn by your app’s interface disappears as soon as someone downloads the file. The safer reading of Rule 3(3) is a label rendered into the image or video frame, and a spoken disclosure at the start of audio. The draft Second Amendment was still unnotified when we checked on 17 September 2026, but if it is notified as published, the label will have to stay on screen for the whole video, so a design that can do that saves a second pass.
5. Remove export paths that strip provenance. MeitY’s FAQ gives “remove watermark” and “export without metadata” as examples of functions an intermediary should not offer. Audit every download, share and “save original” button.
6. Build the declaration flow if you host uploads at scale. That means a yes/no SGI declaration at upload, a verification step that reads C2PA manifests and any watermark detectors you have access to, and a log of each decision. No detector covers every generator, so a missing signal means “unverified”, not “human-made”.
7. Rewrite the takedown runbook in hours. Three hours from a court order or authorised government intimation. Two hours from a complaint about intimate or impersonation content. Clocks that short need someone on call who can remove content without waiting for approval. Preserve logs before suspending an account, because the rules require account action “without vitiating the evidence”.
8. Update user notices. A consequences notice at least every three months, plus the SGI misuse warning at onboarding if you offer generation tools.
9. Write provenance into vendor contracts. Ask each generative AI vendor what its output carries (C2PA, SynthID or another watermark) and require that API responses are not stripped of it.
10. Record what is not technically feasible. The metadata duty applies “to the extent technically feasible”. If a format or channel cannot carry a manifest, write down why and what you did instead. That note is your evidence of a reasoned decision.

Frequently asked questions