Labeling AI images in WordPress: C2PA, thumbnails and the EU AI Act
WordPress strips C2PA metadata when generating thumbnails. This is how the machine-readable AI marking under Art. 50 EU AI Act stays intact in every image size.
WordPress strips C2PA metadata – so-called Content Credentials – as soon as it generates the preview images (thumbnails) on upload. The machine-readable marking that identifies an image as AI-generated is then lost in nearly every image size served on the front end. IMG Performer checks every upload for C2PA data and writes a machine-readable marking (XMP/IPTC) back into the original and into every image size WordPress creates – including the WebP and AVIF variants. It also adds a visible label on the front end that can be adjusted or removed per image for edge cases.
What Article 50 of the EU AI Act requires
Article 50 splits the obligations between two roles. Paragraph 2 requires the providers of the AI systems (Midjourney, OpenAI, Adobe Firefly and others) to mark their image outputs as AI-generated in a machine-readable way – technically through metadata such as C2PA or a watermark. Paragraph 4 requires deployers who publish a deepfake – a realistic depiction of persons or events – to add a visible disclosure as well. For content that is evidently artistic or satirical, a discreet disclosure is enough.
For website operators this means: the machine-readable marking already comes from the AI tool. What matters is that WordPress does not remove it again when generating image sizes. The visible labeling of deepfakes is the operator’s own responsibility. For a full overview of the labeling obligation itself – who has to label what, when, and which exemptions apply – see our guide Labeling AI images in a legally sound way (EU AI Act Art. 50).
Why WordPress loses the C2PA marking
On upload, WordPress creates several sizes from every image – thumbnail, medium, large, plus theme-specific crops and WebP or AVIF variants. The image libraries GD and Imagick that WordPress uses for this do not carry C2PA manifests by default. On the front end, srcset usually serves not the original but one of these derived sizes – exactly the file without the marking. The behaviour is documented as an open issue in the WordPress project and is still unresolved.
How IMG Performer writes the marking into every image size
IMG Performer hooks into the upload process and into thumbnail generation. When it detects a C2PA / Content Credentials manifest, EXIF hints or typical signatures of known AI tools on upload, it writes a machine-readable marking into the XMP/IPTC container of every generated size – host-independent, even if only GD and not Imagick is available on the server. This way the variant served on the front end also carries the marking.
Manual re-categorization for edge cases
Not every AI image needs a visible label. An obviously artificial icon or a recognizable illustration does not fall under the visible disclosure obligation. In the media library the status of each image can be adjusted: automatic detection proposes a classification, the editorial team decides. The visible label can be removed without losing the machine-readable metadata.
C2PA and AI-labeling plugins for WordPress compared
| Plugin | AI image detection | Marking in all image sizes | Visible label | Image optimization | Local | Cost |
|---|---|---|---|---|---|---|
| IMG Performer | automatic (C2PA, EXIF, AI-tool signatures) | yes – machine-readable marker in every size incl. WebP/AVIF | yes, customizable design (Pro) | WebP (Free), AVIF (Pro) | yes | Free · Pro €69/year or €9/month |
| Klarvo AI Transparency | manual; the plugin scan detects AI tools, not images | preserves existing C2PA during resizing (optional) | yes | no | yes | free, no account |
| SEO’n’AI – AI Image check&mark | semi-automatic (detects existing C2PA/IPTC metadata on upload) + manual marking | Free covers the original only; all generated sizes require the Pro add-on | yes | no | yes | Free (original only) · Pro add-on for all sizes + bulk |
IPTC is working on its own WordPress signing tool for C2PA, but as of now it isn’t installable via the WordPress.org directory – it has to be requested directly from IPTC – so it isn’t listed here.
Disclaimer
Note: This article is general guidance and not legal advice. We accept no liability for the accuracy, completeness or timeliness of the information and recommend checking the sources yourself – the original text of Article 50 of the EU AI Act (Regulation (EU) 2024/1689) and the European Commission’s guidelines. Information on IMG Performer: img-performer.enfants.de. Regulation text: eur-lex.europa.eu/eli/reg/2024/1689/oj · Explanation: artificialintelligenceact.eu/article/50.
Frequently asked questions
Does WordPress write C2PA metadata into thumbnails?
No. When generating image sizes, WordPress does not carry over C2PA manifests. The marking is preserved only in the uploaded original, not in the variants served on the front end.
Do I need C2PA, or is a visible label enough?
The machine-readable marking under paragraph 2 is set by the AI providers; modern tools already include it. A visible label does not replace it technically. The visible labeling of deepfakes under paragraph 4 is the operator's own responsibility.
Does this also work without Imagick?
Yes. IMG Performer writes the marking host-independent, even if only GD is available on the server.