California's new law forces AI companies to watermark what they make. Here's how it works.

Something changed today

As of 2 August 2026, the biggest AI companies in the world are legally required to stamp every image, video, and audio file they generate with an invisible record of where it came from. Not a logo, not a disclaimer page buried in settings, a machine-readable mark baked into the content itself.

This is California's SB 942, the AI Transparency Act, and it came into force this morning. SB 942 requires content provenance disclosures from large generative AI providers, effective August 2, 2026. If you've been following the debate about deepfakes and AI-generated misinformation, this is the first major law in the United States that tries to solve the problem at the source, by making the tools themselves leave a trail.

So what does the law actually say? How does the technology work? And does any of this actually help?

Who has to comply

The California AI Transparency Act applies to large generative AI providers with over one million monthly users. That means the obvious names: OpenAI, Google, Adobe, Midjourney, ElevenLabs, and any other company whose AI tools reach a large audience in California. Because California has roughly 40 million residents and is the world's fifth-largest economy, practically any product with genuine global reach falls inside the definition.

While the original SB 942 primarily focused on "covered providers" of generative AI systems, AB 853 (the amendment that refined the law) extends these responsibilities to include "large online platforms," "generative AI system hosting platforms," and "capture device manufacturers." That last category is interesting: it means smartphone makers could eventually be pulled in too, if the camera uses AI to generate or substantially alter images.

The penalties are not trivial. Violations run $5,000 per day per instance. For a company generating millions of images a day, non-compliance could become expensive very quickly.

The three things the law requires

The law requires free AI detection tools, visible manifest disclosures, and embedded latent disclosures on AI-generated content. Each of these is worth unpacking, because they do very different things.

1. Latent disclosures: the invisible watermark

This is the technically interesting part. Every image, video, and audio file generated or substantially altered by a covered system must carry a latent disclosure, a machine-readable provenance record embedded in the content itself. The latent disclosure must include the provider's name, the name and version of the generative AI system that created or altered the content, the timestamp of creation or alteration, and a unique identifier linking the content back to the generating system.

The law is also specific about how durable that mark needs to be. The disclosure must be "permanent or extraordinarily difficult to remove", language that points squarely at cryptographic or steganographic embedding rather than easily-stripped metadata tags.

Why does that distinction matter? Because ordinary metadata, the kind of information stored in an image file's header, like location data from your phone's camera, is trivially easy to strip out. Open any image in a basic editor and save it again, and most of that information disappears. A steganographic watermark works differently: it encodes information inside the actual pixel values of the image, or the waveform of an audio file, in a way that survives basic editing and re-encoding. You can crop the picture, adjust the brightness, or convert it to a different file format, and the mark (in theory) remains detectable.

2. The C2PA standard: a shared language for provenance

The law doesn't invent its own technical standard from scratch. SB 942 instructs covered providers to use methods consistent with "widely accepted industry standards," which in practice means the C2PA (Coalition for Content Provenance and Authenticity) specification, the same framework underlying the EU AI Act Article 50 watermarking requirement.

The Coalition for Content Provenance and Authenticity "addresses the prevalence of misleading information online through the development of technical standards for certifying the source and history (or provenance) of media content." Members include Adobe, Microsoft, Google, Sony, and the BBC. The idea is that a piece of content carries a cryptographically signed record of its entire editing history, who created it, with what tool, when, and what changes were made.

The metadata should conform to open standards like C2PA or IPTC, remain detectable across platforms, and survive basic editing to ensure consistent downstream attribution.

Think of it a bit like the chain of custody for evidence in a court case. Each step leaves a record, and the whole chain can be verified by anyone with the right reader. Several browsers and social platforms are already building in C2PA support, so that images with valid provenance records can display a small indicator showing their origin.

3. Visible labels and free detection tools

SB 942 also gives users the option to add a manifest disclosure, a visible label indicating that content was AI-generated. The manifest disclosure is optional for users to apply, but covered providers must offer the capability.

Any image, video, or audio content output by a qualifying system must be accompanied by a visible, permanent label identifying it as AI-generated. The label must be appropriately integrated into the medium, a watermark on images, an overlay on video, an audio tag or accompanying text for audio.

On top of that, companies must publish a free, public detection tool, something anyone can use to check whether a piece of content came from their system. This is genuinely useful, at least in principle. Right now, if you want to know whether an image was AI-generated, you are largely relying on your own eyes and third-party tools of varying quality. A detection tool published by the company that generated the content should, in theory, be far more reliable.

Why text is left out

You may have noticed something missing. The law covers images, video, and audio, but not AI-generated text. That is a deliberate choice, not an oversight. The latent disclosure obligation applies to images, video, and audio, not to AI-generated text. This is a deliberate policy choice that reflects the higher deception risk of realistic synthetic media relative to plain text outputs.

There is also a practical reason. Watermarking text is a genuinely hard problem. Pixels and audio waveforms give you room to hide information without the human eye or ear noticing. Text has much less redundancy to work with, and robust text watermarks remain an active area of research rather than a settled technology.

If this one was useful, there's plenty more on the site. Pieces on how AI works, plus coverage of AI news, the downsides included. All free to read, no account needed.

How this connects to the EU and the bigger picture

The timing of SB 942's operative date was not accidental. The decision to delay the operative date of some of the California Act's provisions until August 2, 2026, was explicitly made to align with the EU AI Act's implementation timeline. California's lawmakers wanted American and European rules to use compatible technical standards, so that a single piece of content created in San Francisco could carry provenance information readable by tools built to EU specifications in Brussels.

That kind of harmonisation matters. One reason deepfakes spread so freely at the moment is that there is no shared infrastructure for provenance. Different platforms, different tools, different standards, and when a piece of content crosses from one system to another, any metadata it carries often gets stripped in transit. If C2PA becomes the common language across both California and Europe, the infrastructure for verifying content origin could eventually become as routine as checking whether a website has a valid security certificate.

This phased implementation approach, with different provisions becoming effective in 2026, 2027, and 2028, underscores California's proactive stance in establishing a comprehensive regulatory framework for emerging AI technologies. The next phase, arriving in January 2027, extends obligations to hosting platforms, meaning social networks and file-sharing sites will eventually be required to preserve provenance data rather than strip it when users upload content.

What the law can't do

It is worth being honest about the limits here, because no single law fixes a problem this large on its own.

The most obvious gap is open-source models. A company running a locally installed image generator does not have a million monthly users in California, and it has no servers to regulate. Someone determined to create misleading content can simply download an open-weight model and run it on their own machine, with no watermark and no detection tool in sight. SB 942 can shape the behaviour of large commercial platforms; it cannot reach the garage.

There is also the question of watermark robustness. Researchers have repeatedly shown that even strong steganographic watermarks can be removed or corrupted by adversarial techniques, specific image transformations designed to destroy the hidden signal while leaving the visible content intact. The law's requirement that marks be "extraordinarily difficult to remove" sets an aspiration, but the arms race between watermarkers and watermark-removers is a real one.

And detection tools built by the same companies that create the content raise an obvious question about independence. An AI company's detection tool will reliably identify content from that company's own system, but it tells you nothing about content generated by a competitor, a foreign model, or an open-source tool.

What it means for you today

For most people reading this, the immediate change is subtle but real. The large AI tools you use to generate images or audio should, from today, be embedding provenance information in their outputs. You probably won't see it, because it's hidden by design. But tools that can read C2PA data will increasingly be able to surface it, browser extensions, platform integrations, and the detection tools that companies are now legally required to publish.

The practical upshot is that authentic provenance will start to become a signal you can trust, while the absence of provenance data will become more meaningful. A photo with a verified C2PA record tracing it to a human photographer's camera is worth more than a photo with no provenance information at all. It won't be a perfect signal, sophisticated fakes will still circulate, but it starts to create an ecosystem where origin can be checked rather than merely guessed at.

For a law that came into force on a Sunday morning with very little public fanfare, SB 942 is quietly one of the most consequential AI regulations enacted anywhere in the world. The question now is whether the technical standards hold up, whether the platforms actually comply, and whether the rest of the world follows California's lead, as it so often does.