Microsoft Advertising has published guidance on AI-generated, AI-manipulated and other synthetic creative, and one line in it should stop any technical team cold. Advertisers are told to preserve the watermarks, metadata and other provenance information that identifies how AI content was made, and warned against interfering with machine-readable provenance attached to that material. It is a reasonable rule. It also collides with the way almost every site on the internet delivers images, because content credentials live in metadata, and stripping metadata is the first thing an image optimizer does.
The collision is not hypothetical and it is not a corner case. If your images pass through a CDN that resizes them, a build step that converts them to WebP or AVIF, or any optimizer tuned for byte savings, the provenance record is already gone. Nothing warns you. The image looks identical. The signature that proved where it came from does not survive the round trip, and the first time anyone checks, the answer comes back blank.
Read that last number twice, because it is the whole story in four words. Preserving provenance costs almost nothing today because almost nobody has any. The moment signed assets become normal, and an ad platform telling advertisers to keep them intact is how that starts, the cost stops being near zero and lands on the team that owns page speed.
What Microsoft actually changed about synthetic content
The policy covers content generated or significantly altered with AI, with the emphasis on synthetic images, video and audio where the material could change how someone reads an advertisement. Where disclosure is required, the advertiser owns it, has to make it clear, and has to place it close to the relevant material. For visual assets Microsoft recommends putting the disclosure inside the image or video itself rather than nearby.
Then comes the part with teeth. Microsoft notes that material created with its own AI tools can carry provenance data, metadata and imperceptible watermarks, and that those signals may not be visible to a consumer, so their presence does not remove the need for an explicit disclosure. Advertisers are separately told not to tamper with that machine-readable information. Two obligations, pointing in the same direction: the signal has to survive, and a human-readable disclosure has to exist on top of it.
| WHAT THE POLICY ASKS FOR | WHAT IT MEANS IN PRACTICE | WHERE A NORMAL PIPELINE BREAKS IT |
|---|---|---|
| Preserve provenance data, metadata and watermarks | The signed manifest that records capture device, edit history, authorship and synthetic origin has to reach the platform intact | Any resize, crop or format conversion drops the manifest container. The optimizer is not malicious, it is doing the job it was configured to do |
| Do not interfere with machine-readable provenance | Stripping counts, whether or not anyone intended it. Intent is not part of the sentence | Automated metadata stripping is on by default in most delivery stacks and is usually invisible to the people who own the creative |
| Disclose clearly and place it close to the content | A human-readable marker, embedded in the asset where possible, not buried in a caption or a legal footer | Burned-in disclosures survive optimization perfectly well. This is the one requirement the pipeline cannot accidentally undo |
| Verify people, products, locations, claims and events are portrayed accurately | A review step before submission, owned by whoever signs off on the creative | Not a pipeline problem, but it is the obligation most likely to be skipped when volume is high and turnaround is short |
| Do not use a likeness or voice without permission | Standard rights clearance, now explicitly extended to synthetic recreations | Not a pipeline problem either, though provenance records are what make an after-the-fact audit possible at all |
Notice which requirements the delivery stack can break on its own. Two of the five. Both of them are the machine-readable ones, and both fail silently. The three that need a human to get them wrong are the ones with an obvious owner and an obvious review step, which is exactly backwards from where the risk actually sits.
Content credentials die in the image pipeline
The mechanics are worth understanding precisely, because vague understanding produces vague fixes. A C2PA manifest is a cryptographically signed record attached to a file. In a JPEG it sits in an APP11 segment as a JUMBF box, with related entries in the XMP packet. In a PNG it lives in caBX and iTXt chunks. In every case it is container data. The pixels do not encode it, which means any operation that rebuilds the container without deliberately carrying the manifest through will end with the manifest gone.
That describes nearly every useful image operation. Resizing rebuilds the file. Converting JPEG to WebP or AVIF rebuilds the file. Most recompression paths rebuild the file. The exception is narrow and specific: a JPEG carrying an APP11 manifest that is not being resized can still be recompressed for byte savings, because the JPEG codec carries that segment through. Outside that case, an optimizer that has not been taught about provenance will destroy it every single time.
| OPERATION | DOES A MANIFEST SURVIVE | WHAT TO DO ABOUT IT |
|---|---|---|
| JPEG recompression with no resize | Yes, the APP11 segment carries through the codec | Nothing. This is the one free case, and it is worth knowing so you do not over-correct and disable optimization you could safely keep |
| Resize to responsive breakpoints | No, the container is rebuilt and the manifest is dropped | Detect the manifest first and serve original bytes for that asset, which is what provenance-aware optimizers now do by default |
| Convert to WebP or AVIF | No, format conversion does not carry the manifest | Accept that signed assets opt out of modern formats, or keep a signed original available at a canonical URL alongside the optimized derivative |
| PNG recompression with no resize | Only if carry-through is explicitly enabled | Turn on the carry option (ImageProvenanceCarry, or --c2pa-carry) if you have signed PNGs. It is off by default and will not tell you it is off |
| Upload to most large social platforms | No, the upload pipeline recompresses and destroys the manifest | Treat social as a lossy channel for provenance. Several platforms publicly support content credentials and strip them in practice anyway |
| Screenshot or re-export without preservation | No, and this is the easiest way for a manifest to vanish inside a normal creative workflow | Write it into the handoff process. A designer re-exporting an approved asset can undo the entire chain without knowing it existed |
The last row is the one that gets missed. Most of the attention goes to infrastructure, because infrastructure is where the automated stripping happens at scale. But a manifest is just as dead if someone opens the approved file, exports a version that fits a slightly different aspect ratio, and hands that off. Provenance is a chain, and chains fail at whichever link nobody was watching.
The fix that has emerged is deliberately conservative, and it is worth describing accurately rather than as a slogan. A provenance-aware optimizer does a signature-only scan for a manifest, once per image. If it finds one, and if the planned optimization would drop it, the optimizer serves the original bytes instead. You get an intact, verifiable manifest and an unoptimized image, rather than a smaller image with the provenance quietly removed. That is a real trade, not a clever workaround, and pretending otherwise is how teams end up surprised by their own metrics.
The real cost of preserving content credentials
Here is where most coverage of this topic stops being useful, because it treats preservation as obviously correct and moves on. It is not obviously correct. Detect-and-skip means a signed image does not get resized to the breakpoint you wanted, does not become AVIF, and ships at whatever size it was authored at. On a page whose largest contentful paint element is a hero image, that is not a rounding error. It is the metric you have been optimizing for years, going backwards on purpose.
That last point deserves emphasis because it inverts the usual instinct. The expensive, fragile, invisible half of compliance is the machine-readable manifest. The cheap, durable, visible half is a burned-in disclosure. Teams reach for the sophisticated answer first and then discover it fights their performance budget, when the simple answer would have covered most of the actual exposure on day one.
Why this lands on technical SEO, not the ads team
An ad policy is not usually an organic search concern, and it would be easy to file this under someone else's problem. That would be a mistake, for a reason that has nothing to do with Microsoft. Provenance metadata is the only machine-readable claim a publisher can make about where content came from. Search and AI systems are currently trying to work out which content is synthetic, at scale, with no reliable detector. A signed, verifiable record of origin is the closest thing to a real answer that exists, and the standard for carrying it already shipped.
It is not hard to see where that goes. Once an ad platform requires provenance to survive, provenance becomes common. Once it is common, its absence becomes information. A site with no verifiable origin data on any asset is not neutral in that world, it is unreadable, and unreadable tends to resolve as untrusted. That is the same dynamic we have watched play out with site-level trust signals in programmatic publishing, where the problem was never any single page and always the pattern across the whole domain.
“The performance stack was built on a correct assumption: that image metadata was dead weight nobody would ever read. That assumption expired. The tooling has not noticed yet, and the default settings still encode the old world.”
There is a second reason this belongs to the technical side. The volume problem is getting worse, not better. As more published material is machine-generated, the ability to distinguish sourced, verifiable, first-hand assets from everything else becomes the scarce thing, which is the same pressure we described in what AI content saturation does to content marketing returns. Provenance is one of the few signals in that fight that is cryptographic rather than inferential. It either verifies or it does not. Signals with that property are rare, and they tend to matter more over time, not less, which is the logic behind treating structured, machine-readable source material as infrastructure rather than as markup.
How to audit your provenance chain this week
None of this requires a project. It requires about two hours and a willingness to look at what your pipeline is actually doing rather than what its documentation says it does.
See where you are cited today
A free snapshot audit of your rankings and AI citations before we ever talk.
Tyler leads work at the intersection of SEO and generative engines at Something Inc., helping B2B brands get ranked and cited across every major AI engine.