AI image generators increasingly label what they make. Adobe, OpenAI, Google and Microsoft attach C2PA Content Credentials or set the IPTC field DigitalSourceType = trainedAlgorithmicMedia in the file. In the EU, Article 50 of the AI Act builds on exactly this idea: AI-generated content should be marked in a machine-readable way.
So I wanted to know: when these images reach a real web page, is the label still there?
Disclosure: I built the tool used here, the AI Image Metadata & Content Credentials Checker on Apify. It reads embedded metadata only; method and limits are below.
What I scanned
On 6 November 2026 I pointed the checker at twelve pages about AI and AI imagery: product pages of image generators, AI news sections and AI company sites. It collects up to 15 images per page (<img>, srcset, og:image), downloads each file exactly as the site serves it and reads EXIF, XMP, IPTC, C2PA manifests and PNG text chunks.
- 6 of 12 pages refused an automated client (HTTP 401/403/404), including several image-generator product pages.
- From the other six pages I got 75 images: the Bing Image Creator landing page, Microsoft's news site, stability.ai, The Verge's AI section, TechCrunch and Google's AI blog.
Result 1: no Content Credentials anywhere
| Signal | Images (of 75) |
|---|---|
| C2PA / Content Credentials manifest | 0 |
IPTC DigitalSourceType set to an AI value | 0 |
| AI generator parameters (Stable Diffusion, ComfyUI) | 0 |
| No metadata at all (no EXIF, XMP, IPTC, C2PA) | 40 (53%) |
Not a single image carried a C2PA manifest or an IPTC AI source type, not even on the pages most likely to show AI-generated pictures. That does not mean none of these images were AI-generated. It means that if they were labelled at creation, the label did not survive the trip to the browser.
Result 2: the pipeline strips almost everything
How much metadata survives depends heavily on the site:
| Page | Images | Metadata stripped completely |
|---|---|---|
| The Verge (AI section) | 15 | 15 |
| Bing Image Creator landing page | 15 | 14 |
| TechCrunch (AI section) | 14 | 4 |
| Microsoft news | 15 | 4 |
| stability.ai | 15 | 2 |
The pattern matches the file formats: 42 of the 75 images were served as WebP, usually generated on the fly by a CDN or image optimizer. Re-encoding into WebP typically drops XMP, IPTC and C2PA blocks unless the pipeline is explicitly configured to keep them.
Where metadata did survive, it mostly told a production story, not an AI one: Adobe Photoshop and Lightroom versions in the Software tag, Figma as the creator tool, a few camera models. No GPS data appeared in any of the 75 files.
Result 3: keyword matches are not labels
The checker flagged two images as weak. Both were the same TechCrunch picture in two sizes, and the signal was an XMP text field mentioning OpenAI, most likely a caption or credit for an article about the company, not a statement that the image was AI-generated. A metadata scan can only report what the file says, and free-text fields say all kinds of things. Only structured fields (C2PA actions, IPTC DigitalSourceType) are reliable labels. That is why the tool only rates those as strong.
What this means if you publish images
If you need to label AI-generated images, or want your own AI labels to remain visible to other systems:
- Check your image pipeline, not just your source files. Upload a C2PA-signed test image through your CMS and CDN, then scan the URL your visitors actually get. In this sample, more than half of all images arrived with no metadata at all.
- Configure your optimizer to keep metadata where it matters. Many image CDNs and WordPress optimizers have a "strip metadata" default that saves a few kilobytes and removes the label too.
- Don't rely on metadata alone for disclosure. A visible caption or label next to the image survives every CDN. Metadata is the machine-readable layer on top, not a replacement.
- Treat absence carefully. "No AI marker found" does not mean "not AI". It usually means "no metadata".
Method and limits
- 12 pages, up to 15 images each, fetched once from a cloud server without a browser, 6 November 2026. Six pages blocked the request, so the sample covers six sites and 75 images.
- The checker reads embedded metadata only. It does no pixel-level AI detection and cannot see invisible watermarks such as Google's SynthID.
- GPS coordinates and generation prompts are never output, only presence flags.
- This is not legal advice. Whether an image must be labelled under the AI Act depends on its context.
To run the same check on your own pages:
curl -X POST "https://api.apify.com/v2/acts/fast_data_asap~ai-image-metadata-detector/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \ -H "Content-Type: application/json" \ -d '{"pageUrls": ["https://your-site.com/blog/post"], "maxImagesPerPage": 20}' Each row has aiLikelihood (none, weak or strong), the signals behind it, C2PA claim generator and validation, digital source type, software, and whether metadata was stripped. It costs $0.0015 per image analysed; failed downloads are free. The scan above took ten seconds.
