C2PA Manifest vs. Watermark: What's the Difference?
"C2PA" and "watermark" get used almost interchangeably in headlines about AI image provenance, and that's causing real confusion. They're not the same thing, and the difference decides whether a tool like scrub can actually remove what you're looking at. One is a metadata record. The other can be a signal woven into the image itself. Only one of them comes off cleanly.
A C2PA manifest is metadata, not a mark on the image
As we covered in what is C2PA and Content Credentials, a C2PA Content Credential is a structured, cryptographically signed record stored alongside the file — similar in spirit to EXIF or XMP. It can list the app or model that created or edited the image, a timeline of edits, and a hash for verifying the pixels haven't changed since the manifest was attached. Crucially, it sits in the file's metadata, not in the picture itself. Nothing about the manifest is visually encoded into the image data.
That's why a C2PA manifest is removable the same way other metadata is: strip the block, and the provenance record goes with it, with the pixels untouched.
A watermark is encoded into the content itself
A true robust watermark — Google's SynthID is the best-known example for images — works completely differently. Instead of a separate metadata record, it's a signal spread across the actual pixel values, engineered to survive cropping, resizing, recompression, and screenshots. There's no field to delete, because the "mark" isn't stored next to the image — it is partly the image. The text equivalent is a statistical watermark, where a model biases its word choices in a pattern a detector can recover; there's no hidden character to strip, because the watermark is the arrangement of ordinary words. We go deeper on that split in does scrub remove AI watermarks.
Why the mix-up happens
Both get called "AI content labeling," both are meant to establish where an image came from, and both can appear on the same file at once — a picture can carry a C2PA manifest and a SynthID-style watermark simultaneously, from different parts of the same generation pipeline. Coverage of either often just says "the image is watermarked," which blurs a removable metadata record into the same bucket as an unremovable pixel-level signal. The C2PA spec itself adds to the confusion: it allows an optional "soft binding" watermark meant to help re-associate an image with its manifest if the metadata gets stripped — so a C2PA-labeled file can, in some cases, carry a faint watermark-like trace even after you remove the manifest.
What this means for a file in front of you
If a tool tells you an image has "Content Credentials" or a "provenance manifest," that's the removable kind — a metadata block scrub can read and strip, the same way it handles EXIF, XMP, and appended data. If a tool tells you an image is "watermarked" in the SynthID sense, or that text was generated with a statistical watermark, that's not something any metadata cleaner can honestly promise to remove, because there's no discrete field doing the work. scrub shows you which one you're dealing with before you click Clean, instead of treating every provenance label the same.
The short version
A C2PA manifest is metadata you can remove. A robust watermark like SynthID, or a statistical text watermark, is baked into the content and can't be reliably stripped without rewriting or destroying it. Know which one a file has before you assume a "clean" copy is truly clean. Get scrub free and check what's actually in a file.