Here's a question we get constantly: if I upload an AI-generated image with Content Credentials to Instagram, does the C2PA manifest survive? The short answer, as of mid-2026, is no — but Instagram will probably read it before throwing it away, and use it to label your post. The long answer is messier, different for every platform, and full of a distinction most coverage misses: displaying provenance and preserving provenance are two different things, and platforms routinely do one without the other.
We ran test images with known metadata — full EXIF including GPS, XMP, and valid C2PA manifests from a C2PA-signing tool — through six major platforms, then re-downloaded whatever each platform would give back and inspected it. What follows is what we found. Standard caveat applies: platform pipelines change quietly and often, so treat this as a snapshot of mid-2026 behavior, not gospel. Your mileage may vary by file type, upload path (app vs. web), and even account type.
What "keeping C2PA" actually means
Before the platform-by-platform rundown, it helps to name the three possible outcomes, because they get conflated all the time:
- Preserved in the file. You download the image from the platform and the C2PA manifest is still inside it, verifiable with standard tools. This is the rarest outcome.
- Read, displayed, then stripped. The platform parses the manifest at upload time, stores what it learned in its own database, shows a label or a credentials panel on the post — and serves you a re-encoded file with no metadata in it.
- Stripped and ignored. The pipeline re-encodes the image, the manifest evaporates, and nothing anywhere records that it ever existed.
Almost everything you'll read about "platform X supports Content Credentials" describes the middle case. The provenance lives on in the platform's database and its UI — not in the file you or anyone else can take away.
Instagram and Facebook: read it, label it, strip it
Meta has stripped EXIF from uploaded photos for well over a decade — that part is old news, and it's partly a privacy measure (your followers shouldn't get your GPS coordinates) and partly plain bandwidth engineering. What's newer is the front half of the pipeline: since 2024, Meta reads C2PA manifests and IPTC DigitalSourceType tags at upload time and uses them to trigger its "AI info" label on Facebook, Instagram and Threads.
In our tests, the behavior was consistent: upload an image carrying an OpenAI or Adobe C2PA manifest and the post gets flagged as AI-generated; download that same image back from the platform and it comes out as a bare, re-compressed JPEG — no EXIF, no XMP, no manifest. The provenance did its job for about three seconds and then ceased to exist. If someone re-shares the downloaded file elsewhere, it arrives with no machine-readable history at all.
One practical wrinkle: because the AI label is triggered by metadata, stripping a file before upload generally means no label, while an unedited screenshot of an AI image also carries no signal. Meta says it's working on classifier-based detection too, but the metadata path is the reliable trigger today.
X and WhatsApp: the strippers
X (Twitter) has long re-encoded uploaded images and dropped their metadata, and that hasn't meaningfully changed. In our tests, EXIF, GPS and C2PA manifests were all gone from re-downloaded images. X has shown little public interest in the C2PA ecosystem despite years of deepfake controversies playing out on its feed — no credentials panel, no automatic AI label driven by manifests. What labeling exists is community-driven (Community Notes), which is a very different mechanism.
WhatsApp is simpler still. Send a photo the normal way and it gets aggressively re-compressed for delivery; everything — EXIF, GPS, XMP, C2PA — is stripped in transit. The well-known exception is the "send as document/file" path, which transmits teh original bytes untouched, metadata and all. That exception cuts both ways: it's how you preserve credentials on purpose, and it's also how people accidentally share their home coordinates. Worth knowing which mode you're in before you hit send.
TikTok and LinkedIn: the early adopters
TikTok became the first major video platform to join the Content Credentials ecosystem back in 2024, and its implementation is notable because it works in both directions: TikTok reads C2PA data on uploaded content to auto-label AI-generated material, and it also attaches Content Credentials to content, recording that it passed through TikTok and whether it was AI-labeled. In our tests, AIGC-labeled uploads came back with TikTok's own credentials attached — which makes TikTok one of the few platforms where a downloaded file can carry more machine-readable provenance than it went in with. Whether your original generator's manifest survives intact inside that chain is less consistent; treat the platform's own attached record as the reliable part.
LinkedIn, for its part, has displayed Content Credentials since 2024 — images that arrive with valid C2PA manifests can show the little "Cr" pin, and clicking it reveals the provenance summary. That makes LinkedIn one of the friendliest major feeds for provenance display. The usual caveat still applies though: what LinkedIn shows in its UI and what you get back from a right-click-save are not necessarily the same file, and in our tests the re-served images were re-processed like everywhere else. Display support first, file preservation maybe.
YouTube: labels for synthetic media, credentials on some uploads
YouTube sits somewhere in the middle. It requires creators to disclose realistic AI-generated or altered content, and shows an "altered or synthetic content" label on flagged videos. On the reading side, Google has been rolling C2PA support into YouTube since early 2025 — some videos display a "captured with a camera" style provenance note when the upload carried a valid manifest from a C2PA-capable device, and YouTube can use credentials it finds at upload. But video transcoding is brutal on embedded metadata: your uploaded file is re-encoded into multiple formats, and the file a viewer can access isn't your original container. Practically speaking, provenance on YouTube lives in YouTube's systems and labels, not in anything a downloader receives. Google also leans on SynthID watermarking for its own generative video tools, which survives transcoding precisely because it isn't metadata — we covered that distinction in our piece on how AI watermarking actually works.
The results table
Here's the whole picture in one place, based on our mid-2026 tests and each platform's published documentation:
| Platform | EXIF/GPS in re-downloaded file | C2PA read at upload? | C2PA in re-downloaded file | Shows provenance/AI label? |
|---|---|---|---|---|
| Stripped | Yes — triggers "AI info" | Stripped | Yes, label on post | |
| Stripped | Yes — triggers "AI info" | Stripped | Yes, label on post | |
| X (Twitter) | Stripped | Not meaningfully | Stripped | No native label |
| TikTok | Stripped | Yes — auto-labels AIGC | TikTok attaches its own Content Credentials | Yes, AIGC label |
| Stripped | Yes | Not reliably preserved | Yes, "Cr" credentials pin since 2024 | |
| YouTube | N/A (video transcoded) | On some uploads | No — full re-encode | Yes, synthetic-media labels |
| WhatsApp (normal send) | Stripped | No | Stripped | No |
(WhatsApp's "send as file" mode is the exception that preserves everything, which is why it gets its own line in every privacy guide ever written.)
A note on method, since the download path matters more than you'd think: for each platform we used the most ordinary route available — the in-app or right-click save where one exists, the share-to-download flow where it doesn't. Some platforms have multiple export paths with different behavior; Instagram's "download your data" archive, for instance, can return different files than a saved post, and web uploads sometimes get processed differently than app uploads. We tested the mainstream path because that's the file that actually circulates. If your use case depends on an edge-case export route, test that specific route yourself before relying on it — this is exactly the kind of detail that changes between app versions without an announcement.
The pattern across all six: platforms treat provenance as something to consume, not something to pass along. The manifest informs the label, and the label stays home.
Check before you upload — in both directions
Two takeaways, depending on which side of this you're on.
If you want your provenance to travel: don't count on the platforms to carry it. Host the original file somewhere you control, and remember that a public verifier like contentcredentials.org/verify can only vouch for files that still have their manifests. And keep in mind the failure mode nobody can engineer around: a screenshot produces a brand-new image with no metadata whatsoever, so even a platform that preserved manifests perfectly would be defeated by the oldest trick on the internet. That's the honest ceiling on all metadata-based provenance, C2PA included — the C2PA deep dive gets into why the spec's "durable credentials" work is trying to fix exactly this.
If you'd rather your files didn't announce which AI tool you used, or when, or on what account: don't count on the platforms either, for the opposite reason. Yes, most of them strip metadata — but several read it first and turn it into a permanent label on your post, and platform behavior is a moving target that has changed more than once since 2024. The only upload pipeline you control is the one that happens before the upload. Take ten seconds to check what your file is actually carrying, and if there's anything in there you wouldn't put in the caption, strip it locally before the file ever leaves your machine. What a platform never receives, it can never label, log, or leak.