How to Read the C2PA Conforming Products List: What a Listing Tells You
A product on the C2PA Conforming Products List has passed the C2PA conformance program for a specific product, role and set of file formats. It does not tell you how well that product's watermark or detector performs, and it does not cover formats or versions the entry leaves out. You can check every entry yourself in the public list.
We read the official list on November 4, 2026. It held 298 entries from 187 applicants. Google LLC alone had 50 entries, the earliest confirmed on June 27, 2025 (Pixel Camera). So when a headline says a company "is now on the list," the useful question is which entry is new and what that entry covers.
What is the C2PA Conforming Products List?
C2PA (the Coalition for Content Provenance and Authenticity) publishes the specification for Content Credentials, a cryptographically bound record of where a file came from and how it was changed. Its conformance program, opened in June 2025 and now at v0.2, checks whether products "adhere to the Content Credentials specification, and fulfill a set of security requirements." Products that pass are "placed on a publicly-accessible list."
You can browse the list in the Conformance Explorer or read the raw JSON file that C2PA publishes on GitHub. In our November 4 read, 264 entries were generator products (they write Content Credentials) and 34 were validator products (they check them). Every entry had the status "conformant."
Which fields in an entry should you read?
Each entry in the JSON uses the same fields. These five cover most buyer questions.
Field | What it tells you | What it does not tell you |
|---|---|---|
status: conformant | The product passed the conformance program | How well any watermark or detector performs |
productType (generator / validator) | Whether the product writes or checks Content Credentials | Whether it does both. A product can have separate entries for each role |
containers (image, video, audio...) | Which file formats the entry covers, listed under generate and validate | Formats that are not listed |
minVersion and specVersion | The product version and C2PA spec version the entry refers to | Whether an older build you are running is covered |
dates.conformance | When that entry was confirmed | That the whole company joined on that date |
There is also a maxAssuranceLevel value. In our read, 253 entries recorded level 1 and 11 recorded level 2, and validator entries had none. The conformance page we checked does not define these levels, so look up the definition in the program documents before you compare two products on it.
How do you check a vendor's claim against the list?
When a vendor tells you its product is "C2PA conformant," run four checks:
Find the entry under the vendor's legal name (the applicant field), not only its brand name.
Match the product name to what you are buying. A company can have many entries for different products.
Confirm the format you care about appears under generate, validate or both.
Compare minVersion with the version you would deploy.
Our reading: a listing is a good first filter for whether a product writes or reads Content Credentials correctly. It is not a substitute for testing the features you actually need, such as whether a mark can still be found after a screenshot or re-encode.
Why does a listing not settle where a file came from?
Content Credentials are metadata, and the C2PA explainer answers "Can the provenance metadata be removed?" with "Yes it can." It also notes that a crop in a tool that does not support Content Credentials may leave the record out of date. For that reason the specification describes durable Content Credentials, which pair the signed record with a soft binding such as an invisible watermark or a fingerprint lookup. Our earlier guide on watermarks, C2PA and fingerprints covers which problem each one solves.
Contents Defence is listed on the C2PA Conforming Products List in three categories: image, audio and video. Image Defence adds an invisible watermark to images and issues and verifies C2PA Content Credentials, so an image can carry both the signed record and a mark inside the pixels. The listing itself does not prove watermark performance, and MuseBlossom's soft binding (its registered watermarking method) covers images only.
What can this guide not tell you?
The counts above are a snapshot from November 4, 2026, and the list changes often: the latest conformance date in our read was November 2, 2026. We describe the JSON fields as they appear in the file, not C2PA's internal review criteria, and we did not test any listed product.
FAQ
Is being a C2PA member the same as being on the list?
No. Membership is about an organization taking part in the coalition. The Conforming Products List covers individual products that passed the conformance program.
Does a conformant product guarantee that a file is real?
No. The C2PA explainer says provenance information alone "cannot tell you whether the digital content is true, accurate or factual."
Should I distrust files without Content Credentials?
Not automatically. Adding provenance is optional, and the explainer advises that no assumption should be made about an asset's trustworthiness purely based on whether it uses Content Credentials.
Need images that carry both Content Credentials and an invisible watermark? See how Image Defence works: go.contentsdefence.com/image-guide