Content Credentials, C2PA and SynthID: How to Protect Your Brand From Deepfakes

The short answer

Content Credentials (the C2PA standard) attach a signed record of where an image, video or document came from and how it was edited, while watermarks like Google's SynthID are invisible marks that identify AI-generated media. Neither one proves on its own that something is real or fake, but together they let you prove your genuine content is yours and check suspicious files. Pair them with simple verification habits, because the costliest deepfake attacks on businesses target payments, not reputations.

A fake video of your CEO announcing a recall. An ad using your logo and an AI-cloned voice to sell knock-offs. A "customer photo" of a product defect that never happened. Deepfakes aimed at businesses are no longer hypothetical, and the tools to fight back have matured quickly in 2026. Here's what Content Credentials, C2PA and SynthID actually do, where they fall short, and what a small or mid-size business should put in place, as of October 2026.

Provenance versus detection: two different jobs

People often lump these together. They work in opposite directions.

• Provenance proves where something came from. Content Credentials, built on the C2PA standard, add a cryptographically signed record to a file: which device or app created it, what edits were made, and whether AI was involved. If the file is altered without updating the record, the signature no longer checks out.
• Detection tries to tell whether something was made by AI. SynthID is Google's invisible watermark, embedded in content made by Google's AI tools. Google's Veo documentation, for example, states that "Videos created by Veo are watermarked using SynthID."

Provenance helps you protect your real content. Detection helps you check someone else's. A business needs both, plus a healthy scepticism about each.

Where Content Credentials and C2PA stand in October 2026

The standard is now mainstream infrastructure. The C2PA's February 2026 announcement of Content Credentials 2.3 added support for live video and streaming, plain text documents and more audio and video formats, plus clearer edit histories. It reports more than 6,000 members and affiliates with live applications, and a conformance program, launched in late 2025, to check that products showing the credential badge handle the data correctly.

Google has pushed hardest on the consumer side. Its May 2026 update says Pixel 10 was the first smartphone to add Content Credentials to photos in its native camera app, with video support expanding to Pixel 8, 9 and 10. C2PA verification is rolling out in the Gemini app, with Search and Chrome to follow. Google also says it has watermarked over 100 billion images and videos with SynthID, that SynthID checks in Gemini have been used 50 million times, and that it's launching an AI Content Detection API on Google Cloud covering media from Google and "other popular models."

Regulation is catching up too. In the EU, the AI Act's transparency rules have applied since August 2, 2026, requiring deployers to label deepfakes, with a grace period until December 2026 for tool makers' machine-readable marking. Our guide to AI video marketing covers what that means for your own ads.

What these tools can't do

Be clear-eyed about the limits before you rely on them.

• Detection is vendor-specific. Google's Gemini help page says plainly: "Gemini can currently only recognize content created by Google AI tools." A missing SynthID watermark doesn't mean a file isn't AI-generated.
• Credentials can be stripped. Screenshots, re-uploads and many social platforms drop metadata. Gemini also doesn't read credentials stored remotely.
• History isn't truth. Google notes that Content Credentials "don't definitively prove AI generation"; they give history to help you judge. A genuine camera can still capture a staged scene.
• Usage caps apply. Gemini's checks take one file at a time, up to 100 MB, with videos under 90 seconds and roughly ten checks of each type per day.

The deepfake risk that costs the most

Reputational fakes get headlines. Payment fraud does the damage. In 2024, engineering firm Arup confirmed that an employee in Hong Kong sent about US$25.6 million to fraudsters after a video call in which the "senior officers" were deepfakes, as Construction Briefing reported. Arup's chief information officer said attacks were rising "sharply" in number and sophistication.

No watermark would have stopped that call. Process would. The Canadian Centre for Cyber Security's AI guidance (ITSAP.00.135), written for democratic institutions but useful for any organisation, recommends a rolling passphrase known only to authorised staff to defeat real-time voice cloning, extra time to verify before acting, reporting deepfakes to the hosting platform and the Canadian Anti-Fraud Centre, and an incident management plan.

A protection plan for your brand

1. Sign what you publish. Use cameras and editing tools that support Content Credentials for official photos, executive video and press material, and keep the originals. If a fake circulates, you can show what the real one looks like and where it came from.
2. Publish a "how to reach us" page. List your official domains, social accounts and payment details. Fakes are easier to dismiss when customers know where the real you lives.
3. Verify money requests out of band. Any request to change bank details or send an urgent payment gets confirmed through a known number or in person, regardless of how convincing the voice or video is. Add a passphrase for executives.
4. Check suspicious media before reacting. Run it through a SynthID and Content Credentials check, but treat a negative result as "unknown", not "real".
5. Prepare the response. Decide in advance who confirms or denies a suspected fake, how fast, and on which channels. Report to the platform and the Canadian Anti-Fraud Centre. A reputation partner can help here; see our reputation management service.
6. Train the people most likely to be targeted. Finance, executive assistants and anyone who can change payment details. Our cybersecurity service covers this kind of training.

Labelling your own AI content properly also builds the trust you'll need on the day you say "that video isn't us." Our guide to who owns AI-generated content explains the record-keeping habits that support both.

Key takeaways

• Content Credentials (C2PA) prove where a file came from; SynthID flags content made with Google's AI. They solve different problems.
• As of October 2026, C2PA 2.3 covers live video and text, Pixel phones sign photos, and Gemini can check both credentials and SynthID.
• Detection is limited: no watermark doesn't mean no AI, and stripped credentials prove nothing.
• The biggest deepfake losses come from payment fraud, so out-of-band verification matters more than any detector.

Frequently asked questions

What are Content Credentials?

Content Credentials are a signed record, based on the open C2PA standard, attached to an image, video, audio or document. They show who or what created the file, what edits were made and whether AI was used. If the file is changed without updating the record, the signature fails.

How can I check whether an image or video was made with AI?

Upload it to the Gemini app and ask whether it's AI-generated. It checks for Google's SynthID watermark and reads Content Credentials if present. It only recognises Google AI content, so a negative result doesn't prove the file is genuine.

Can C2PA stop deepfakes of my business?

Not on its own. It helps you prove your genuine content is authentic and lets viewers inspect history, but fakers simply won't attach credentials. Pair it with verification procedures for payments, an official-channels page and a response plan.

Sources

1. The C2PA Launches Content Credentials 2.3 and Celebrates 5 Years of Impact Across the Digital Ecosystem — C2PA, February 2026
2. Making it easier to understand how content was created and edited — Google, May 19, 2026
3. Verify AI-generated images, videos, and audio — Gemini Apps Help
4. Generate videos with Veo 3.1 in Gemini API — Google AI for Developers
5. Arup employee falls victim to US$25 million deepfake video call scam — Construction Briefing, May 21, 2024
6. Cyber security guidance for democratic institutions: artificial intelligence (ITSAP.00.135) — Canadian Centre for Cyber Security, June 2024
7. Quick Facts: Transparency rules for AI systems — European Commission, updated July 29, 2026

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our Cybersecurity, reviews & reputation management, public relations & digital pr services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.