AI & Technology
What Is an AI Watermark? SynthID, C2PA and Claude's New Text Mark
What an AI watermark is, how SynthID and C2PA differ, and whether Claude's invisible text watermark affects your search rankings.
See your site's AI visibility grade
Free instant scan — the same checks this article talks about, run on your own site.
Quick Answer
An AI watermark is a hidden pattern that a model deliberately builds into the content it generates, so that software holding the right key can later tell that the content came from that model. In an image it is a pixel pattern too faint to see. In text it is a bias in which words the model picks when several would serve equally well. Nothing is bolted on the way a logo is stamped across a stock photo — the mark is made out of the content itself, which is why it travels when the content is copied and pasted somewhere else.
In August 2026 this stopped being a research topic. Anthropic began watermarking the text Claude writes, across every product, using a version of Google DeepMind’s SynthID-Text method.
Driven by Article 50 of the EU AI Act becoming enforceable for newly launched systems
Plus roughly 60,000 years of audio, by Google's own count at I/O 2026
Its published guidance still judges content on quality, not on how it was produced
Three Different Things People Call “AI Detection”
Almost every confused conversation about this topic comes from mixing up three technologies that answer three different questions. Separate them and the rest is easy.
A watermark is a signal placed inside the content by the model that made it. It answers “did this model produce this?” with a key and a calculable error rate. It survives copying, screenshots and compression, because it is not attached to the content — it is the content, arranged a particular way. What it cannot tell you is anything about history: who prompted it, when, or what happened afterwards.
Provenance metadata is a signed record attached to the file. C2PA Content Credentials are the standard here, described by the coalition that maintains them as “a nutrition label for digital content”. A credential says which tool created the file, when, and what edits were applied since, each step cryptographically signed. It is far richer than a watermark. It is also trivially lost: strip the metadata, screenshot the image, or upload it to a platform that re-encodes on ingest, and the label is gone.
A commercial AI detector — GPTZero, Pangram and the rest — is a different animal entirely. It has no key and no cooperation from the model. It reads the writing and guesses from stylistic tells, then reports a confidence score. That is why these tools produce false accusations against non-native English speakers and against anyone whose prose is simply tidy.
Watermarks and provenance metadata cover each other’s weaknesses, which is precisely why the major labs now ship both: the metadata carries the detail, the watermark carries the resilience.
Google SynthID: Marking the Content Itself
SynthID is Google DeepMind’s watermarking system, and it is the technical foundation under most of what is happening in this space. It covers four modalities — images, video, audio and text — with a different mechanism for each, all built on the same principle of embedding a signal that is imperceptible to a human but measurable by a detector.
For images and video it adds a pattern in the pixels designed to hold up under cropping, filters, resizing and compression. For audio it embeds an inaudible signal in the waveform. Google’s stated scale is the striking part: more than 100 billion images and videos watermarked, plus roughly 60,000 years of audio.
SynthID-Text is the one that matters for anyone who writes for a living, and its mechanism is worth understanding because it explains every limitation that follows.
When a language model generates a sentence, it produces a probability distribution over possible next words and samples from it. Often the choice is genuinely open: “the results were striking” and “the results were remarkable” are both fine. Normally the model resolves that with randomness. A watermarking model instead adjusts those probability scores using a secret key and the preceding few words, so the choice is pseudo-random rather than random — determined, but only if you hold the key.
One such choice tells you nothing. A hundred of them form a pattern that is statistically very unlikely to occur by chance, and a detector with the key can measure exactly how unlikely. That is the whole trick, and it has three consequences that follow directly:
- Short passages are weak. A sentence does not contain enough choices to measure. The signal needs length to accumulate.
- Constrained passages are weak. Where there is only one right word — a number, a name, a line of code that must compile — the model has no free choice to bias, so no signal is embedded. Anthropic says explicitly that the mark is sparse in factually constrained text and does not apply to code requiring exact outputs.
- Rewriting destroys it. Replace the model’s word choices with your own and you have replaced the signal with noise.
C2PA: Signing the File’s History
C2PA — the Coalition for Content Provenance and Authenticity — takes the opposite approach. Rather than hiding a signal in the content, it attaches a signed manifest to the file recording where it came from and what has happened to it. The consumer-facing name is Content Credentials, and the current specification is version 2.3.
A manifest can record the device or model that produced the file, the time, and each subsequent edit, with a chain of cryptographic signatures linking the steps. Tamper with the file and the signature no longer validates, which is a genuinely strong property: you cannot forge a credential without the private key.
Its weakness is equally simple. Metadata is separable from content. Screenshot a credentialed image and the credential does not come with it. Upload it to a service that re-encodes on ingest and it may not survive. C2PA tells you a great deal when it is present and absolutely nothing when it has been stripped — and “no credential” is indistinguishable from “credential removed”.
The industry has converged on this stack quickly. OpenAI joined the C2PA steering committee in May 2026 and committed to embedding SynthID alongside the Content Credentials it already attaches. Kakao, ElevenLabs and Nvidia adopted SynthID in the same window. At I/O 2026 Google announced that SynthID detection and C2PA verification are coming natively to Search and Chrome, so a user will be able to ask whether an image is AI-generated through Lens, AI Mode or Circle to Search.
What Anthropic Actually Announced
On 11 August 2026 Anthropic confirmed that Claude embeds an invisible statistical watermark in the text it generates. The specifics are worth getting right, because the coverage around it has been loose.
Which models. Claude models launched on or after 2 August 2026. Models released before that date fall under an EU transition period and are being covered over the following months.
Where it applies. Everywhere. Claude Platform (the API), claude.ai, Claude Code, Claude Cowork and Claude Tag, and Claude accessed through AWS, Google Cloud and Microsoft Foundry. This is what makes the announcement significant — not the technique, which Google published in Nature, but the fact that a frontier lab turned it on across an entire product line at once.
How it works. Anthropic describes using “a version of the SynthID-Text approach published by Google DeepMind”: the key plus the preceding few words settle which word the model picks, wherever several are equally viable.
What it covers. Text Claude generates or substantially edits. Not code that requires exact outputs, and only sparsely in factually constrained passages where word choice is not free.
Files as well as text. For supported file types including SVG, PNG and JPG, Claude attaches signed C2PA provenance metadata — the other half of the stack.
Detection. Anthropic has said it will offer a watermark detection API and publish technical documentation for third parties. As of now it is not generally available.
Robustness. In Anthropic’s own words: “Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will.” The territory in between is undefined, and it is undefined for everyone.
The limitation that gets lost
The single most important sentence in Anthropic’s documentation is the one about what a detection actually means:
A watermark can only determine that Claude was likely involved with the content at some point. It cannot distinguish “Claude wrote this” from “Claude heavily edited this.”
That is a much weaker claim than most of the reaction assumes. A person who writes their own first draft and asks Claude to tighten the prose may end up with a detectable mark. A person who has Claude write the entire thing and then rewrites every line will not. The watermark is evidence of processing, not evidence of authorship — and any policy built on treating a positive detection as proof of cheating is built on a misreading of what the tool measures.
Why Now: The Regulation Behind the Date
The 2 August 2026 date is not a coincidence and not a product decision. Article 50 of the EU AI Act, together with the associated transparency code of practice, became enforceable for newly launched generative systems on that day. It requires providers to embed machine-readable marks in generated output so that downstream platforms, users and regulators can identify AI-generated content — with text explicitly in scope, which is the part the industry had been treating as too hard.
Google, Microsoft, OpenAI and Meta have all committed to the same code. Anthropic moved first on production-scale text watermarking, but the deadline applied to every provider serving the EU, and the rest of the field is on the same clock.
There is a second, quieter motive that the labs rarely put in press releases: model collapse. As the open web fills with generated text, the next generation of models risks being trained substantially on the output of the last one, degrading in a compounding loop. A reliable way to identify machine-written text at scale is how you filter a training set. Transparency and self-interest happen to point the same direction here, which is usually why standards actually ship.
Does This Affect Your Search Rankings?
This is the question that brings most people to this topic, so here is the direct answer: no ranking penalty for AI-written text has been announced by Google or by anyone else.
Google’s published guidance on the subject has been consistent for years and has not changed. It focuses on the quality of content rather than how it was produced. “Not all use of automation, including AI generation, is spam” — automation has long produced sports scores, weather forecasts and transcripts. What violates its spam policies is using automation to generate content whose primary purpose is manipulating search rankings. That was true before watermarking existed and it is true after.
The provenance verification arriving in Search and Chrome checks media: is this image, video or audio AI-generated or an unaltered original. That is a different question from how an article was drafted, and Google announced no signal that detects or penalises AI-written text in ranking.
Where this genuinely does change the calculation is disclosure and trust, not ranking. If you have publicly claimed that every word on your site was written by a human expert, and your pages carry a detectable mark, that is a credibility exposure you created with the claim rather than with the tool. The fix is not to hide the AI use. It is to stop making claims that specific.
What to Actually Do About It
Six things worth doing, in rough order of how much they matter for a small business site.
1. Stop treating “was AI involved” as the interesting question. It is going to be yes for almost everyone, including your competitors and, increasingly, including the journalists and agencies who ask. The interesting question is whether anything on the page could only have come from you.
2. Put the unrepeatable material in. Your actual pricing. The specific failure mode you see on jobs in your area that nobody else writes about. Photos of work you did. The answer you give on the phone that no model can predict. This is what survives every detector, every ranking update and every AI Overview, because it is not derivable from anything already on the web. It is also what gets you cited by AI assistants rather than summarised past.
3. Never present an AI image as a real photograph of your work. This one has teeth. Image provenance verification is arriving in Search and Chrome, AI images increasingly ship with C2PA credentials, and “that photo of their team is generated” is a far more damaging discovery for a local business than “their blog post was drafted with Claude”. Generated illustrations and diagrams are fine. Generated evidence is not.
4. Keep credentials intact on images you do want verified. If you are producing original photography, the C2PA chain is an asset — it is proof that the image is what you say it is. Check that your image pipeline is not stripping metadata on every upload as a byte-saving default.
5. Get your disclosure position straight, once. Decide whether you say anything about AI assistance and where. Whatever you choose, make sure your public claims match your practice, because the gap between them is the only part of this that can actually hurt you.
6. Do not buy AI-detection tooling to police your own content. The commercial detectors are guesses, the real watermark detectors are not generally available yet, and a false positive on your own writer costs you more than the information is worth.
Where This Goes Next
Three things are worth watching over the next year.
Detection becomes ordinary. Anthropic’s detection API and Google’s SynthID Detector both point at a world where checking content is a routine API call rather than a specialist favour. Expect it inside CMSs, plagiarism tools and email clients within a couple of release cycles.
Coverage becomes near-universal among the big labs, and absent everywhere else. Every provider serving the EU is on the same regulatory clock. Open-weight models running on someone’s own hardware are not, and never will be — you cannot compel a watermark from a model whose weights anyone can modify. The practical result is a detection landscape where absence of a mark proves nothing at all, permanently.
The interpretation problem gets worse before it gets better. The technology outran the norms. Schools, employers and publishers will spend the next year building policies on top of a signal that means “a model was probably involved somewhere”, and some of those policies will treat it as proof of something it cannot prove. If you are in a position to write one of those policies, the sentence to keep in front of you is the one Anthropic wrote: it cannot distinguish writing from editing.
Key Takeaways
- An AI watermark is a pattern built into the content itself, which is why it survives copy-paste while file metadata gets stripped on upload
- SynthID marks the content, C2PA Content Credentials sign the file’s history, and commercial AI detectors merely guess from writing style — three different technologies routinely confused for one
- Claude models launched from 2 August 2026 watermark the text they generate across every Anthropic product, driven by Article 50 of the EU AI Act
- A watermark shows a model was likely involved at some point; it cannot separate writing from editing, and is not proof of authorship
- Google has announced no ranking penalty for AI-written text, and its guidance still judges content on quality rather than production method
- Image provenance is further along than text and carries more risk: never present a generated image as a photograph of your real work
- The durable strategy is unchanged — put material on the page that only your business could have produced
Key takeaways
- An AI watermark is a pattern built into the content itself, so it survives copy-paste, unlike metadata that gets stripped on upload
- SynthID marks the content, C2PA signs the file's history, and commercial AI detectors just guess from style — three different things
- Claude models launched from 2 August 2026 watermark their text across every Anthropic product, driven by EU AI Act Article 50
- A watermark shows a model was probably involved at some point; it cannot tell writing from editing, and is not proof of authorship
- Google has announced no ranking penalty for AI-written text, and its guidance still judges content on quality rather than production method
- The practical risk is not detection, it is publishing content with nothing in it that only you could have written
Frequently Asked Questions
What is an AI watermark in simple terms?
An AI watermark is a hidden pattern that a model deliberately builds into the content it generates, so that software holding the right key can later tell the content came from that model.
An AI watermark is a hidden pattern that a model deliberately builds into the content it generates, so that software holding the right key can later tell the content came from that model. In an image it is a faint pixel pattern you cannot see. In text it is a bias in which words the model picks when several would do equally well. Nothing is added to the content the way a visible logo is added to a photo. The mark is made out of the content itself, which is why it survives being copied and pasted somewhere else.
How does a text watermark work if nothing is added to the text?
The model biases its own word choices. At each step it picks between several equally good options, and a secret key decides which one, leaving a statistical pattern across the whole passage.
The model biases its own word choices. When a language model writes, it constantly faces moments where several words would serve equally well, and normally it picks between them using randomness. A watermarking model replaces that randomness with a function of a secret key and the words that came just before. Any single choice looks ordinary. Across a few hundred words the pattern of choices is statistically unlikely enough that a detector holding the key can measure it. That is why the mark is invisible to a reader, does not degrade the writing, and cannot be spotted by eye.
Is Claude really watermarking everything it writes?
Close to it. Anthropic announced in August 2026 that Claude models launched on or after 2 August 2026 embed a watermark in generated text across every product, with narrow technical exceptions.
Close to it. Anthropic announced on 11 August 2026 that Claude models launched on or after 2 August 2026 embed a watermark in the text they generate, across Claude Platform (the API), claude.ai, Claude Code, Claude Cowork and Claude Tag, including Claude accessed through AWS, Google Cloud and Microsoft Foundry. Older models are being covered over the following months under an EU transition period. There are real exceptions: the watermark is sparse or absent where the model has no free choice to make, such as code that must produce an exact output, or a factually constrained passage where only one wording is correct.
What is the difference between SynthID and C2PA?
SynthID is a watermark inside the content. C2PA is signed metadata attached to the file. The watermark survives copying but says little; the metadata says a lot but is easy to strip.
They solve the same problem from opposite ends. SynthID is a watermark embedded in the content itself, so it survives screenshots, compression and copy-paste, but all it can tell you is that a particular model was probably involved. C2PA Content Credentials are a cryptographically signed record attached to a file, listing what tool created it, when, and what edits were applied since. That is far more informative, but metadata is easily removed, deliberately or by accident, every time a platform re-encodes an upload. Used together they cover each other's weakness, which is exactly how Anthropic and Google now deploy them.
Does a watermark prove that AI wrote something?
No. It shows the model was likely involved at some point. It cannot separate 'Claude wrote this' from 'Claude proofread this'.
No, and this is the most important limitation to understand. Anthropic states plainly that a watermark 'can only determine that Claude was likely involved with the content at some point' and 'cannot distinguish Claude wrote this from Claude heavily edited this'. A person who writes a first draft themselves and asks Claude to tighten it may end up with watermarked text. A person who has Claude produce the whole thing and then rewrites every sentence will not. The mark is evidence of processing, not evidence of authorship, and anyone treating a positive detection as proof of cheating is over-reading it.
Can you remove an AI watermark by editing the text?
Light editing probably will not remove it. A complete rewrite that replaces every word will. Everything in between is uncertain.
Light editing probably will not remove it, because the mark is spread across hundreds of word choices rather than sitting in one place. A complete rewrite in which every word is replaced does remove it, since none of the original choices survive. The band in between is genuinely undefined, and neither Anthropic nor Google publishes a threshold, partly because publishing one would be a removal recipe. Translation, heavy paraphrasing and passing text through a second model all degrade the signal. Treat the watermark as reliable for unedited output and progressively less reliable the more a human has been through it.
Why did this all happen in August 2026?
Article 50 of the EU AI Act became enforceable for newly launched systems on 2 August 2026, requiring providers to mark AI-generated output in a machine-readable way.
Regulation set the date. Article 50 of the EU AI Act, and the associated transparency code of practice, became enforceable for newly launched generative systems on 2 August 2026. It requires providers to embed machine-readable marks in output so downstream platforms and regulators can identify AI-generated content, and text is explicitly in scope. Google, Microsoft, OpenAI and Meta have all committed to the same code. Anthropic's announcement is the first production-scale deployment of text watermarking across an entire product line, but the deadline applied to everyone.
Will Google penalise my rankings if my content is watermarked?
No. Google has announced no ranking signal that detects or penalises AI-written text, and its published guidance judges content on quality rather than how it was produced.
No. Google's published guidance is that it focuses on the quality of content rather than how it was produced, and that 'not all use of automation, including AI generation, is spam'. What does violate its spam policies is using automation to generate content whose primary purpose is manipulating rankings. The provenance verification Google announced for Search and Chrome in 2026 reads SynthID and C2PA on images, video and audio to answer 'is this media real', which is a different question from how an article was drafted. No ranking signal for AI-written text has been announced by anyone at Google.
Should I stop using AI to write my website content?
No. Change what you use it for. AI drafting plus real human expertise still performs; unedited AI output published at volume was already failing before watermarking existed.
No, but change what you use it for. The strategy that fails under watermarking is the one that was already failing: publishing large volumes of unedited model output that contains nothing a reader could not get elsewhere. That content lost on quality long before anyone could detect it. The strategy that holds up is using AI to draft, structure and speed up work while the specific expertise, the real prices, the local knowledge, the photographs of jobs you actually did, comes from you. That content wins on its merits, and a watermark on part of it changes nothing about how it performs.
How can I check whether content carries a watermark?
Not easily yet. Anthropic says a detection API is coming, and Google's SynthID Detector is in limited release. Public tools are still ahead of general availability.
Not easily yet, which is the honest answer as of August 2026. Anthropic has said it will offer a watermark detection API and publish technical documentation, but it is not generally available. Google's SynthID Detector portal is in early release with journalists and media professionals, and Gemini can be asked whether an uploaded file is AI-generated. For images, C2PA Content Credentials can be inspected today with public viewers where the metadata has survived. Detection of a specific model's text watermark by an arbitrary third party is not yet a thing you can do on demand.
Are commercial AI detectors the same thing as a watermark?
No. Detectors like GPTZero and Pangram guess from writing style with no key and no ground truth, which is why they produce false accusations. A watermark is a designed signal.
No, and confusing the two causes real harm. Commercial AI detectors analyse style, looking for the phrasing tells that models tend to produce, then output a probability. They have no key, no cooperation from the model, and no ground truth, which is why they misfire on non-native English writers and on anyone whose prose is simply clean. A watermark is the opposite: a signal deliberately placed by the model's own maker, verified with a key, with a calculable false-positive rate. If someone accuses your content of being AI-written on the strength of a detector score, they are quoting a guess, not a measurement.
Does any of this apply to images on my website?
Yes, and sooner than the text side. AI images increasingly carry C2PA Content Credentials and SynthID marks, and Google is bringing verification of both into Search and Chrome.
Yes, and the image side is further along than the text side. AI image generators increasingly attach C2PA Content Credentials, and Claude now attaches signed C2PA provenance metadata to supported files including SVG, PNG and JPG. Google announced at I/O 2026 that SynthID detection and C2PA verification are coming natively to Search and Chrome, so a visitor will be able to ask whether an image is AI-generated without leaving the page. For a business site the practical consequence is straightforward: do not present an AI-generated image as a photograph of your actual work, your actual premises or your actual team.
About the author
vaza.ai
Marketing Team
The vaza.ai team helps small businesses modernize their websites and eliminate the cost, maintenance, and security headaches of legacy platforms.
Related reading
Want this running on your own site?
Run the free scan and see what Google and the AI answer engines actually find — then watch the platform monitor, fix and publish on autopilot.
Free instant grade · No signup · See what Google & AI see on your site