The watermark is for the people who already know

OpenAI and Google announced today that they will jointly watermark AI-generated images. OpenAI's models will now embed SynthID, Google DeepMind's pixel-level watermark, alongside C2PA cryptographic metadata that travels with the file. OpenAI has also published a public verification tool: upload an image, find out whether it carries OpenAI-origin signals.¹ The framing across both companies is that this is a foundational safety move for the information ecosystem, the kind of cross-competitor coordination that critics of the industry have been asking for.

I want to take that framing seriously, and then I want to put it down. Because once you look at where the harm from AI-generated imagery actually lands, on whom, in which contexts, through which channels, the announcement reads less like an answer to that harm than like an answer to a different question. The question of how the largest providers comply with the EU AI Act without losing face, and how they signal to a watching policy audience that voluntary coordination still works.

That is not nothing. But it is also not what the press release says it is.

Start with where the metadata goes to die. C2PA is an open standard that embeds a cryptographic signature into an image file. The signature travels with the file. In principle, anyone downstream can read it. In practice, almost no consumer platform preserves it. Screenshotting an image strips it. Re-uploading through Instagram, X, TikTok, or Facebook strips it. Most social platforms re-encode images on upload and discard the metadata in the process.² Meta announced C2PA-based labels for AI-generated content in 2023, and the implementation has been uneven enough that ordinary users mostly do not see them.²

So the chain looks like this. OpenAI generates an image with a C2PA signature. A user downloads it. They paste it into a group chat, or screenshot it onto a campaign poster, or upload it to a social platform that strips the metadata on ingest. By the time the image reaches the eyes of the people it is meant to deceive or harm, the signature is gone. The watermark, SynthID, survives some of this, because it is in the pixels themselves. But SynthID returns a probabilistic confidence score, not a verdict, and you need access to Google's detection infrastructure to read it.³

OpenAI's verification portal is a real piece of work, and I do not want to dismiss the engineering. But think about who uses it. A journalist running down a suspicious image before publication. A fact-checker at AFP or Reuters. A platform trust-and-safety team doing post-hoc review. These are useful constituencies. They are not the people the harm lands on.

The harm lands on the voter who sees a fake image of a candidate the night before an election, in a forwarded WhatsApp chain, and forms an impression that does not get unformed by a fact-check three days later. It lands on the woman whose face has been pasted into a pornographic image circulating in a Telegram group, where the question of whether SynthID would have flagged it is academic because the image is already in front of everyone she knows. It lands on the kid whose classmates have generated something humiliating about them and shared it before any adult in the chain could think to upload it to a verification portal.

None of these people are going to a verification portal. They are not the audience. The audience is institutional.

Now look at the regulatory shape of the announcement. The EU AI Act's Article 50 requires providers of generative AI systems to ensure their outputs are "marked in a machine-readable format and detectable as artificially generated or manipulated."⁴ This is a binding obligation, phased in across 2024–2026, and it applies to OpenAI and Google as providers in the EU market. What OpenAI announced today is, almost line-by-line, a compliant response to Article 50: machine-readable marking (C2PA), detectability (SynthID plus the verification tool), redundancy in case one signal is stripped.

This is what compliance looks like when it is done well. I do not want to pretend it is cynical. But I want to be clear about what it is. The shape of what was built tracks the shape of the regulation, not the shape of the harm. Article 50 asks for machine-readable marking; OpenAI built machine-readable marking. Article 50 does not ask for consent architecture for the people depicted in synthetic images, so consent architecture is not in the announcement. Article 50 does not ask for platform-level enforcement of metadata preservation, so platform-level enforcement is not in the announcement. The ceiling of what gets built is the ceiling of what is required.

The historical analogy reaching for me is the cookie banner. The GDPR required meaningful consent for tracking; what got built was a banner that almost everyone clicks through. The regulation succeeded on paper, the practice barely changed, and the largest players, who had the legal capacity to design banners just compliant enough, absorbed the cost more easily than smaller competitors did. Provenance watermarking is not identical, and I do not want to push the analogy too hard. But the pattern is worth holding: when compliance is the ceiling, the people the regulation was nominally for are often not the people it ends up serving.

There is a deeper absence in the announcement, which is the question of consent. A watermark on an image tells you the image was AI-generated. It tells you nothing about whether the person depicted in the image agreed to their likeness being used. It tells you nothing about whether the real human whose face was scraped, fine-tuned, or referenced in the generation has any recourse. It tells you nothing about what should happen when a watermarked, dutifully-disclosed deepfake of a private individual is shared in a context that does whatever damage it was made to do.

The watermark on a non-consensual deepfake does not un-generate the deepfake.

The architecture being built is detection architecture. It answers: was this AI-made? It does not answer: should this have been made at all, of this person, in this context? Those questions sit with the courts, with platform terms of service, with the slow grind of NCII legislation that varies wildly by jurisdiction and almost always lags the technology by years. I do not think OpenAI and Google can solve the consent question by themselves, and I would be suspicious of any announcement that claimed to. But I notice that consent does not appear in the announcement at all, not even as an acknowledged limit of what provenance can do. The framing is "transparency about AI-generated content is essential to maintaining trust in the information ecosystem."¹ The framing is institutional trust, not individual recourse.

One more thing about the cross-competitor cooperation, because it is genuinely unusual and I think the lesson runs the other way from how it is being read. OpenAI and Google are direct competitors in foundation model deployment. Their joint adoption of SynthID is being framed as evidence that the industry can self-coordinate on safety when it chooses to. I think it is evidence of something narrower and more revealing: the industry coordinates on safety infrastructure that disadvantages no one competitively. Watermarking does not change the competitive position of either company. Both companies get the regulatory credit and the safety halo. Neither gives up anything the other has, because the other is doing the same thing.

Compare this to the places where cooperation has not happened. Training data transparency. Capability disclosure ahead of deployment. Shared evaluation standards for harm. Independent third-party audit access. Alignment research outputs. These are the questions where the companies' interests diverge, where being more open than your competitor is a real cost, and where coordination has been notably absent. The pattern is not "tech companies can cooperate on safety." The pattern is "tech companies can cooperate on safety when it costs them nothing relative to each other." That is a useful thing to know about where future coordination will and will not appear.

I want to end where I started, on the question of what this announcement is for. It is genuinely a step. C2PA plus SynthID plus a verification portal is more provenance infrastructure than existed yesterday, and the people who do fact-checking and trust-and-safety work for a living will use it and be better off for it. I am not arguing the announcement should not have happened. I am arguing about what should follow it, and who should be doing the following.

The thing that would actually shift the harm is platform-level enforcement: a requirement that the major consumer platforms preserve C2PA metadata on upload, surface AI-generation labels prominently to users, and route flagged content into review workflows that do not require the harmed person to find a verification portal. That is a regulatory move, not a voluntary one, and it is the move that the announcement is, perhaps deliberately, structured to make seem less urgent. Look, the framing says, we are doing it ourselves.

We are not, though. The largest providers are doing the part that is cheap for them. The part that is expensive — for platforms, for legislators, for the consent architecture that does not yet exist — is still waiting. And the people the harm lands on are still not in the room.

Footnotes

¶