A small badge with the letters CR has started appearing in the corner of images on LinkedIn. Click it and a panel opens listing a tool, a date and a signer. Many people read that panel as a verdict: this picture is fake, or this picture is real.
It is neither. The badge shows that a file carries a signed record of its history. That is a narrower claim than most people assume, and it changes what you should expect from your own professional photo.
What is a Content Credential?
A Content Credential is a signed record attached to an image that lists where it came from and what was done to it. The standard behind it is C2PA, from the Coalition for Content Provenance and Authenticity, and the record is called a manifest.
According to the C2PA explainer, a manifest holds assertions, which are statements about the asset: its origin, the edits made with which tools, and any use of AI. The manifest is signed with the private key of the software or hardware that did the work. A cryptographic hash ties the record to the image, so changing either one breaks the match.
The Content Authenticity Initiative describes the result as a nutrition label for digital content. Adobe founded the initiative in 2019, and its members include the BBC, Microsoft, Leica, Nikon and Canon.
One detail matters for everything below. What goes into the label depends on what each tool chooses to write. A camera might record its model and the capture time. A generative AI tool might record that it made the image. A tool that writes nothing leaves nothing to read.
What does the CR badge on LinkedIn actually show?
It shows that LinkedIn found a signed manifest in your file and is displaying it. It does not show that LinkedIn judged your picture. LinkedIn's help page says the icon appears on image and video content that is cryptographically signed with C2PA Content Credentials.
Click it and you see fields such as:
- An assertion about whether AI was used to generate or edit any part of the content
- The app or device used, such as a camera model or an AI tool
- Who created the content, and who issued the credential
- The date and time the credential was signed
The assertion comes from whoever created and signed the credential, not from LinkedIn. The same page admits the system is incomplete. LinkedIn says it is not yet possible to identify and label all AI-generated and modified content.
So a CR badge on a photo can mean three very different things. The image was generated by AI. A real photo was edited with an AI feature. Or a real camera captured it, with no AI involved at all. The badge marks the presence of a record. You have to read the record.
Why do the credentials disappear so easily?
Because the record is metadata, and metadata is fragile. A screenshot, a format conversion or an upload to a site that re-encodes images can leave the pixels intact and the manifest behind.
The C2PA explainer builds in a fallback for this. "Soft bindings" let a verifier find a manifest that is no longer embedded in the file, using an invisible watermark or a fingerprint lookup. That helps. It also means the strongest protection depends on extra machinery that not every platform runs.
The creators of the tools say as much. OpenAI has cautioned that C2PA metadata is no silver bullet and can be removed accidentally or deliberately. Most social platforms strip metadata from uploads, and a screenshot does the same.
The best public check of what happens in practice came from The Washington Post. In October 2025 it uploaded an AI-generated video to eight major social platforms. Its tests found that only one, YouTube, added any warning, and that warning sat hidden in the description. No platform in the test kept the Content Credentials data or let users reach it. That was video rather than still images, so treat it as a signal about platform behaviour, not a measurement of portraits.
LinkedIn is the exception worth knowing about. It reads the manifest on upload and shows it to viewers. That makes it the one place where your headshot's credentials, if it has any, are likely to surface.
Does a missing record mean a photo is fake?
No. A missing record proves nothing, and that is the weakest point of the whole system.
Think about who attaches credentials. Honest tools do. A person who wants to pass off a generated face as a candid shot has every reason to strip them, and stripping leaves no mark. So a photo with credentials tells you something about the tool that made it. A photo without them tells you almost nothing.
The reverse holds too. A signed record shows who signed the file and what they claimed. The C2PA explainer is blunt about it: provenance information alone cannot tell you whether the content is true, accurate or factual. A camera-signed photo of a staged scene is still a staged scene.
This is also why detection tools that guess from pixels remain a separate, shakier business. Our piece on AI detectors flagging real photos as fake covers what happens when a guess goes wrong and a real person pays for it.
Which real cameras sign their photos?
A small but growing set. Leica released the M11-P as the first camera with Content Credentials built in, and Nikon announced support starting with the Z6III, according to the Content Authenticity Initiative. Those are tools for photojournalists and professionals.
The bigger shift is phones. Google's security blog said in September 2025 that the Pixel 10 lineup is the first to have Content Credentials built in across every photo from Pixel Camera. Google also said the Pixel Camera app reached Assurance Level 2, the highest security rating the C2PA Conformance Program defines, using hardware-backed security on the device. Google Photos can attach credentials to edited images and show them in its About panel.
Google adds a caveat of its own. The security of any claim depends on the integrity of the app and the operating system, which in turn depends on staying current with security patches.
For you, this means a selfie from one of these phones may arrive with a signed capture record, and that record can survive on a platform that keeps it. If you then run that selfie through an AI generator, the output is a new file. Whether it carries a record of its own is up to the generator.
What does this mean for your headshot?
Mostly, it means you should know what your file says about itself, and decide how you want to describe it.
Here is the practical picture:
- Your headshot may carry credentials without your doing anything. If it was made or edited in a tool that signs its output, LinkedIn can show the badge to every viewer.
- A badge is not an accusation. Read in context, it says a tool signed the file. A real photo retouched with an AI feature shows the same kind of label as a fully generated image, with a different assertion inside.
- A clean file proves nothing either way. People will not read your lack of a badge as proof of authenticity, and they should not.
- Disclosure is your call, and sometimes your obligation. Some employers, publishers and dating platforms have rules about AI imagery. The credentials do not replace reading them.
The question that decides whether your headshot works is simpler than any badge. Would someone who has met you recognise you? An AI headshot built from your own selfies, such as those from Starkie AI, succeeds or fails on that test. We cover the trust side of this in why AI headshots can still build professional trust, and the legal side in who owns your AI likeness.
If you use any generator, check the output file instead of assuming. Open it in a Content Credentials viewer, or upload it to LinkedIn on a test post, and see whether a record appears. If you need to state in a bio or a form that a photo is AI-assisted, say so in plain words. That statement will outlast any metadata.
Where is provenance headed?
Toward more signing and more places that keep it, though not quickly. The C2PA described its CR icon in 2023 as a mark meant to become "as ubiquitous and recognizable as the copyright symbol," and the announcement of the icon lists Adobe, Microsoft, Leica and Nikon among its adopters. Phones with built-in signing are the clearest sign of progress.
Still, the Washington Post test shows the gap between a standard and what people see on screen. Until platforms keep and display the data, the badge will appear on a minority of images, and most photos, real or generated, will carry nothing.
Watermarks that live in the pixels are the other route. Google announced a SynthID Detector portal in May 2025 to help people identify content made with Google's AI tools. A watermark sits in the pixels rather than the metadata, but each one only covers the tools that embed it.
Both routes share a limit. They tell you about a file's origin when someone chose to record it. They cannot tell you whether a face deserves your trust.
The short version
A Content Credential is a signed label, not a lie detector. On LinkedIn the CR badge tells you a record exists and lets you read it. It does not tell you whether the image is AI, and its absence does not tell you the image is real.
For your own headshot, the useful habits are small. Know what your file says. Disclose when a rule asks you to. And choose a photo that looks like you, because that is the proof people check first.
