Does DALL·E / GPT-4o Images (OpenAI) mark its images as AI-generated?
OpenAI's image tools, DALL·E 3 and GPT-4o/GPT-image's native generation inside ChatGPT and the API, are among the most widely used AI image generators for everything from marketing assets to blog illustrations. OpenAI has invested specifically in machine-readable provenance: images from ChatGPT, Codex, and the API carry both C2PA metadata and a SynthID watermark, and OpenAI now also applies C2PA to Sora-generated video. For an Article 50(2) compliance check, that means OpenAI's own output starts well-marked, the real question for a site owner is whether that marking survives everything that happens to the image between generation and publication.
Article 50(2) of the EU AI Act requires AI-generated or AI-edited audio, image, video, and text to be marked in a machine-readable format so it's detectable as artificially generated, via C2PA Content Credentials or IPTC provenance metadata, embedded in the file itself. This is a provider-side duty on the generative system, but it fails quietly in practice: content that leaves a generator marked routinely arrives on a published page unmarked, stripped somewhere in the ordinary pipeline of editing, compressing, and publishing.
Does DALL·E / GPT-4o Images (OpenAI) mark its output by default?
As of this review, OpenAI embeds both signals by default: a cryptographically signed C2PA manifest attached to the image (declaring the model used, DALL·E 3, GPT image, or Sora, generation date, a hash of the original, and OpenAI's producer signature) and a SynthID watermark, developed with Google DeepMind, embedded directly into the pixel data rather than as removable metadata. SynthID is specifically engineered to survive common transformations, moderate cropping, rotation, JPEG compression, and many filters, where a metadata-only signal would be dropped. OpenAI also publishes a public verification tool at openai.com/verify that checks an uploaded image for either signal.
What strips the marking before it reaches your published page
- Screenshotting strips the C2PA manifest entirely, a screenshot is a new file with no metadata; the SynthID watermark is designed to survive screenshots and resizing, but verify survival with openai.com/verify rather than assuming it
- Some third-party editing tools and CDN image optimizers still strip C2PA metadata on re-save, even though SynthID's in-pixel watermark is more resistant
- Converting to certain file formats or heavily downscaling/recompressing can degrade or remove the C2PA manifest specifically
- Uploading to social platforms that re-encode images (some strip C2PA metadata as part of their own processing pipeline, even where they don't yet check for SynthID)
- Compositing the AI-generated image into a larger design (e.g. a marketing graphic with added text/logos) in a non-C2PA-aware editor can drop the manifest for the final exported file
How to verify before you publish
- Use OpenAI's own verification tool at openai.com/verify to check whether a specific image still carries a recognizable C2PA manifest or SynthID watermark before you publish it
- Cross-check with the general Content Credentials Verify tool (contentcredentials.org/verify), which reads C2PA manifests from any C2PA-conformant source, not just OpenAI's
- Avoid routing the image through image optimizers or CDN pipelines known to strip metadata, test your actual publishing pipeline, not just the raw generated file
- If you must edit or composite the image, prefer C2PA-aware tools (e.g. Adobe's Content Credentials-supporting apps) that preserve or update the manifest rather than dropping it
- For high-stakes use, keep the original, unedited, freshly-generated file as your evidence record even if a processed version loses its marking, since the original still carries verifiable provenance
The realistic compliance gap
OpenAI's own output is genuinely well-marked by industry standards, the compliance gap is almost entirely downstream, in the ordinary publishing pipeline: CMS uploads, image CDNs, social re-sharing, and third-party editing tools that weren't built with C2PA in mind. A site that generates a compliant image and then runs it through a standard image-optimization step before publishing can end up with an unmarked file despite starting from a well-marked one.
Common questions
If OpenAI already marks its images, do we still need to do anything for Article 50(2)?
Check what happens to the image after generation, not just at the moment it's created. If your CMS, CDN, or editing workflow strips the C2PA manifest (common with image optimizers) before the image reaches your published page, the marking OpenAI attached never makes it to your visitors, verify the actual published file, not the original download.
Does the SynthID watermark mean we don't need to worry about C2PA getting stripped?
SynthID is more resistant to common transformations than C2PA metadata, but it's a different kind of signal, it's designed to be detectable by tools that know to look for it, not necessarily to satisfy Article 50(2)'s 'machine-readable' marking requirement on its own in every context. Treat the two as complementary: C2PA for structured, standards-based provenance data, SynthID as a more resilient backup signal, and verify both where you can.