X strips C2PA on upload

X strips C2PA on upload. ImgKey, mid-2026: aggressive metadata strip, re-encode at platform-controlled quality, no inline Content Credentials display, no public preservation commitment. Provenance does not travel with the post. Visible-disclose anyway.

This page is X as the hard case. LinkedIn’s CR icon is the contrast, not the subject. Do not read a missing manifest on a downloaded X image as proof the source was never signed.

What X does to the file

ImgKey’s X row is three facts stacked:

Strip. Metadata is removed by default. C2PA lives in that metadata. It does not ride through.
Re-encode. Even a hypothetical preserve-the-box implementation would still break a hard binding, because the image pipeline rewrites bytes at platform-controlled quality. A C2PA manifest is a hash over exact bytes. New bytes, invalid claim.
No display. There is no CR icon, no provenance panel, no “this was signed by” in the X interface as of that mid-2026 snapshot.

Lumethic’s 13 July 2026 comparison adds history, not a fix: X joined C2PA in 2021 and prototyped credentials display before the acquisition. Production display did not ship. A January 2026 tease of edited-visuals labelling had not become a user-facing credentials UI in Lumethic’s write-up. Do not invent one.

The result ImgKey names: C2PA-credentialed content arriving via X is effectively unverifiable through the platform itself. Recovery requires external tools and a durable-credentials registry lookup — the soft-binding story, not the native app.

Video is not a loophole. A social transcode that produces X’s delivery rendition is still a new bitstream. If you needed the signed master, you needed the file you uploaded, stored somewhere that is not X. The post is a copy. Treat it as a copy.

A phone screenshot of the X post is a third copy, worse than the transcode: no manifest, new crop, often extra UI in the pixels. Do not archive screenshots as the signed original. Do not send a client a screenshot as proof of credentials. The only inspect that matters for C2PA is the export before upload, plus whatever durable registry you registered at publish time.

Provenance does not travel

Producers keep a superstition that “platforms are getting better at C2PA,” then they post to X and check a download. The download is unsigned. They conclude the generator failed. The generator may have been fine. X ate the cooperative signal.

Compare the same bytes on two networks:

LinkedIn often preserves and shows Content Credentials (ImgKey mid-2026; Lumethic July 2026).
X strips, re-encodes, shows nothing.

A cross-post job that sends one resized file to both can make LinkedIn fail too, because the scheduler already broke the binding. Native X upload of a signed original still fails at X ingest. There is no “post from a better app” workaround on this network as of that snapshot.

What can still travel:

Invisible watermarks. SynthID on Google-family media sits in pixels, not in the box X strips. A detector can still hit. That is origin, not an X UI.
Your words. A sentence in the post, on a card, or burned into the frame. X cannot strip pixels you composited, short of cropping the video — and even then the viewer who saw the first frame may have seen the line.
The archive. The generator export, hashed, in your bucket. That is the copy Content Credentials still describe.

What cannot travel: the signed manifest as a platform feature. Do not put “C2PA will disclose this on X” in a SOW. Put “we will disclose this on X in copy and on-frame, and we will archive the signed original.”

Visible disclose anyway

The viewer on X has no CR panel. If the picture is a photoreal person, street, or event that would pass as real, you still owe a perceivable label.

Article 50 (in force 2 August 2026) is not an X setting. Deployers who publish authentic-looking deepfakes to an EU audience label at first exposure. Artistic works may label without spoiling a reveal. Assistive editing is a different exemption. A stripped manifest is not an exemption. The disclosure template is the copy; burn it if mute autoplay is how the clip is seen.

Platform culture on X is not a legal analysis. “Everyone posts unmarked AI here” is not a defence. Meta’s ads auto-label (Coinis, 16 July 2026) and Instagram’s 31 August 2026 AI-generated-profile rule are other surfaces. They do not make X safer. They make a cross-posted file more labelled on Meta than on X, which is how a brand looks inconsistent rather than clever.

Practical stack for an X-bound generate:

Generate on the row the job needs.
Burn captions and, when required, a disclosure line — not a footer in a tweet the crop will hide.
Inspect C2PA on the export so you know the archive is signed.
Upload to X knowing that inspect will fail on the live file.
Say it in the post body as well, because on-frame type still competes with X chrome.

Safe-area on X is not Reels chrome and not a TikTok caption zone. Recrop the type. A disclosure sitting under a username is not first exposure.

Archive the original export

If you need to prove origin later — a journalist, a regulator, a client — you will not get it from X.

Keep:

The generator export
The captioned master
A note of model row and date (for example Veo 3.1 or Seedance 2.0, credits as cataloged)
A screenshot of a C2PA inspect on the export, timestamped

Do not keep:

A hope that X will add display next quarter as your only plan
A stripped “clean” upload you made so it would “look native”
A scheduler log that says “posted” as evidence of a manifest

Durable Content Credentials are the architectural answer to strip-on-ingest: a watermark or fingerprint plus a registry. They have their own failure modes. They are still more honest than “X will carry C2PA.”

The AI video generator is the generate door. Caption in the same studio. If you want a signed master before X gets a vote, sign up and treat the post as distribution, not as the record.

FAQ

If X stripped the file, was it never AI?

No. Strip means the cooperative metadata is gone. The pixels can still be generated, and an invisible watermark can still be present. Absence of C2PA on an X download is not a camera original.

Can I restore Content Credentials after an X upload?

Not from X’s served file as of ImgKey’s mid-2026 snapshot. Re-bind from your archived export, or use a durable-credentials lookup if you registered one. The live post will not grow a CR icon because you asked.

Does stripping on X avoid AI stigma?

It avoids a credentials UI X does not ship. It does not avoid detectors, journalists, or Article 50. Visible disclose. The missing badge is X’s pipeline, not a strategy.