OpenAI vs Google: AI Image Watermarking

On August 14, 2026, Google announced that Gemini users can now turn off the visible watermark on AI-generated images, videos, and music. Three days earlier, Anthropic had gone the opposite direction, confirming it would watermark Claude's text output to satisfy its commitments under the EU AI Act's Transparency Code. In the same week, a scroll through GitHub and the Chrome Web Store turned up a half-dozen actively maintained tools whose entire purpose is stripping the watermark Google just made optional to keep. Read separately, these are three small product stories. Read together, they describe an industry that has not settled on what a provenance signal is for, has not agreed on how durable it needs to be, and is watching open source developers dismantle the parts that were supposed to be durable in near real time.

This matters for anyone building AI governance policy for a reason that goes beyond curiosity about how the technology works. Organizations are increasingly being told, by vendors, by regulators, and by their own compliance functions, that watermarking and content provenance metadata are a meaningful part of how AI-generated content gets tracked and disclosed. That claim is only useful if the watermark actually survives the ordinary things that happen to a file between the moment it is generated and the moment someone else encounters it: a crop, a compression pass, a screenshot, a re-export from a different tool. The events of the past two weeks are a live demonstration of exactly where that survival breaks down, and where it holds. This piece works through OpenAI's and Google's diverging strategies, what the removal tools already circulating say about the durability of both, and what an organization relying on either signal for compliance purposes actually needs to understand before it does.

Two labs, two philosophies

OpenAI and Google have taken visibly different positions on the same underlying design question: should an AI-generated image carry a mark a human can see, or only marks a machine can detect?

OpenAI's answer, largely, has been the latter. Images generated through ChatGPT, Codex, and the OpenAI API carry C2PA Content Credentials, the cryptographically signed metadata manifests maintained by the Coalition for Content Provenance and Authenticity, alongside SynthID watermarks, the imperceptible signal embedded directly in the pixel data. Neither is visible to a person looking at the image. OpenAI joined the C2PA Steering Committee in 2024 and has since described itself as a C2PA Conforming Generator Product, meaning its implementation has been checked against the standard's own conformance requirements rather than merely claiming compatibility. ChatGPT-generated images can also carry an additional manifest specifically identifying ChatGPT as the creation source, layering a product-specific attribution on top of the general C2PA provenance record. The company backs this with a public verification surface: a tool at openai.com/verify, and an API endpoint developers can call directly, both of which report whether a supplied image or audio file contains a manifest OpenAI recognizes as trusted, and separately, whether it detects OpenAI-issued AI-generation credentials at all. That is a meaningfully more auditable posture than a company simply asserting it marks its content: a third party can check the claim without taking OpenAI's word for it, at least for the specific things the tool is built to detect.

Google's history with visible marking has been closer to the opposite instinct, at least until August 2026. Gemini's image generation tools, most notably the Nano Banana and Nano Banana Pro models, have applied a visible watermark, a small sparkle-shaped logo in the corner of generated images, and for a long stretch of 2025 and into 2026, community reports and Google's own support documentation indicated there was no built-in setting to turn it off. That is a deliberate design choice with a clear rationale: a mark a viewer can see with no tooling at all is a stronger transparency signal than one that requires running a file through a detector, precisely because it needs no infrastructure on the viewer's end to work. It is also, obviously, a mark that most users of a creative tool would rather not have permanently branding their output, and the friction between those two positions is exactly what changed on August 14.

What actually changed, and what didn't

Google's announcement, delivered by Josh Woodward, the company's VP overseeing Gemini, Google Labs, and AI Studio, in a post on X, was specific about the boundary of the change. Users will be able to toggle the visible watermark off for images, video, and songs generated with the Nano Banana, Omni, and Lyria models, through a new Media Watermark setting under Settings in Gemini and in Flow, Google's AI video editing tool, with support for Search coming later. Woodward's framing of the tradeoff is worth quoting directly, because it states the company's actual position rather than leaving it to inference: "We're striking a balance here between creative control and safety: while the visible watermarks are now optional, invisible SynthID watermarks and C2PA metadata are still being used for transparency. So you can still use Gemini or Search to see if an image was AI-generated."

That is the load-bearing sentence in the whole announcement. Google is not removing provenance signals from its images. It is removing the one signal that required no tooling to read, and keeping the two that do. The invisible SynthID watermark, embedded in the pixel data itself and, according to Google's own guidance, designed to survive routine transformations like cropping, resizing, and compression, remains in place regardless of the toggle setting. C2PA metadata, the cryptographically signed manifest format, also remains attached. Google reinforced this framing by simultaneously open-sourcing a library called Credentio, described as a C library that lets developers embed local C2PA validation directly into their own applications, which reads as an attempt to make independent, third-party verification of C2PA credentials easier to build, not harder, even as the company makes the visible signal optional.

The rollout has real-world limits worth noting for anyone assessing how much this actually protects users or platforms from confusion. The toggle applies going forward, to content generated after the setting is changed; it does not retroactively strip the visible watermark from images already downloaded before the toggle was flipped. It is rolling out gradually rather than to every account at once. And Google has said it will not make the toggle available in jurisdictions where local rules require a visible watermark on AI-generated content, which is itself a small, quiet acknowledgment that some regulators consider the visible mark to be doing real transparency work that the invisible signals alone do not replace, at least in the eyes of the law in those specific markets.

The timing of Google's announcement, three days after Anthropic's watermark news and one day after Meta had already launched its own "Content Seal" labeling standard, according to The Verge's coverage, places this squarely in a period where every major AI lab is actively repositioning its provenance strategy at once, in response to the same regulatory pressure and the same competitive dynamics. That clustering is itself informative: this is not one company's isolated product decision, it is an industry recalibrating in real time as EU AI Act enforcement becomes an operational reality rather than a future deadline.

The removal tools already exist, and that is the actual story

Here is the part of this story that should concern anyone treating a watermark as a reliable compliance mechanism rather than one input among several. The visible Gemini watermark that Google just made optional to display was never something users had to wait for an official toggle to remove. A search of GitHub turns up actively maintained projects, GargantuaX/gemini-watermark-remover among them, purpose-built to strip the visible sparkle mark from downloaded Gemini images. The Chrome Web Store hosts multiple extensions with names like "Gemini Watermark Remover," installable in a few clicks, with listing identifiers that make clear these are not obscure or hard-to-find tools; they show up in ordinary extension store search. Sites like geminiwatermark.io and gradually.ai/gemini-watermark-remover offer the same function as a web-based service, no installation required. None of this is officially sanctioned by Google. All of it has existed and been actively used for long enough that it was already a documented phenomenon well before Google's own toggle shipped.

That existing ecosystem of removal tools is the single most important piece of context for evaluating Google's announcement, and it is easy to miss if you read the announcement in isolation. Google framing the visible-watermark toggle as "striking a balance" implies the visible watermark was, until now, a meaningful piece of friction that the company was choosing to relax. The removal tools suggest the friction was already thin. A visible watermark that any user with five minutes and a Chrome Web Store account can strip was never providing strong protection against a determined bad actor; it was providing a default that discouraged casual, low-effort misuse, and a signal that showed up automatically for anyone who did not go looking for a workaround. Google's toggle formalizes what informal tooling had already made possible. That is a legitimate thing to do, arguably a more honest one than leaving a weak barrier in place and calling it protection, but it is a different claim than "we added flexibility to a robust safeguard."

The more consequential question, for a compliance function, is whether the same erosion applies to the invisible signals Google says remain in place: SynthID and C2PA metadata. Here the evidence is more mixed, and worth taking seriously in both directions rather than assuming either "SynthID is unbreakable" or "SynthID is already broken" as a starting point.

What the research actually says about SynthID's durability

Google's own public position on SynthID, both for images and for text, has been consistently more careful than a marketing claim would be. The company describes SynthID as robust against common, non-adversarial transformations: standard compression, resizing, filters, and frame-rate changes for video, and it makes no claim of being unremovable or resistant to a determined adversary specifically targeting the watermark for removal. That distinction, between "robust under ordinary use" and "cryptographically unremovable," is the correct one to hold onto, and it is also the distinction most likely to get lost when a vendor's provenance signal gets cited in a compliance conversation as though it were the latter.

Independent testing bears out the more modest claim. Reporting from outlets including Ars Technica, working through hands-on tests of SynthID's image watermark, found it held up well against the kinds of transformations an image actually goes through in ordinary circulation: reposting, moderate compression, resizing for different platforms. Cropping emerged as a more consistent weak point across independent tests, particularly when combined with repeated compression or resizing passes, which is a meaningfully different failure mode than "the watermark can be defeated" but a real one for any organization whose images get cropped for social thumbnails, aspect-ratio conversions, or platform-specific formatting before they reach a viewer, which is to say, most images that circulate at all on the modern internet.

The picture for SynthID's text watermark, the one Google, and now Anthropic, have deployed for written output, is meaningfully weaker. Google's own documentation on SynthID Text is explicit that it is robust only against some transformations and carries real limitations, and independent academic work has gone further, documenting specific attack classes that substantially degrade detection: paraphrasing, back-translation through an intermediate language, synonym substitution, and simple copy-paste style edits that preserve meaning while altering the exact token sequence the watermark relies on. This is not a fringe finding from a single paper; it is a pattern that shows up across multiple independent research groups working on watermark robustness, and it points to a structural property of text watermarking rather than a bug specific to one vendor's implementation. A text watermark works by biasing the statistical distribution of tokens a model selects during generation, in a pattern a detector with the right key can recognize. Any transformation that meaningfully rewrites the token sequence, while preserving the underlying meaning, has a real chance of disrupting that statistical fingerprint, because the fingerprint lives in the specific tokens chosen, not in the meaning those tokens carry. This is exactly the vulnerability that makes SynthID for text a fundamentally different engineering problem than SynthID for images, where the watermark is embedded in pixel-level information a viewer is not trying to preserve exactly, only approximately.

The honest summary, and the one worth carrying into a governance conversation rather than either extreme: SynthID and comparable watermarking technology is a probabilistic provenance signal, not a cryptographic proof. It meaningfully raises the cost and effort required to strip attribution from AI-generated content, especially for a casual or unmotivated user who is not specifically trying to defeat it. It does not meaningfully raise that cost for a motivated adversary willing to run content through a paraphrasing pass, a translation round trip, or, in the image case, a deliberate crop-and-recompress cycle designed to target exactly the parts of the signal that survive lighter transformations. Any compliance program that treats a watermark as equivalent to a tamper-evident seal, something that reliably indicates whether content was altered after the fact, is overstating what the current technology actually delivers.

Where C2PA metadata sits in this same picture

The other half of Google's "invisible signals remain" claim is C2PA metadata, and it is worth being precise about how differently that signal fails compared to a pixel-embedded watermark, because the two are frequently discussed as though they were interchangeable and they are not. A C2PA Content Credential is metadata attached to a file's container format: information that rides alongside the image or document data rather than being woven into it. That structural difference cuts both ways. On the one hand, when it survives intact, it can carry far richer information than a watermark ever could, model provenance, editing history, generation parameters, exactly the kind of detail the C2PA 2.3 update expanded earlier in August 2026. On the other hand, container-level metadata is trivially and often accidentally stripped by the ordinary mechanics of how content moves across the internet. Taking a screenshot of an image discards its metadata entirely, because a screenshot is a new file capturing pixels, not a copy of the original container. Uploading an image to most social platforms and content management systems strips metadata on ingestion, often silently, as a routine part of processing and re-encoding. Converting a file from one format to another frequently drops metadata that the destination format either does not support or that the conversion tool does not bother to preserve.

This is precisely the failure mode both OpenAI's and Anthropic's own documentation flag candidly when they describe their provenance approach: metadata carries more context but is easier to lose; watermarks are more durable through transformation but carry less context. Google's decision to keep both signals in place after removing the visible mark reflects a reasonable read of this tradeoff, using each to partially cover the other's weakness, but "partially cover" is the operative phrase. A screenshot of a Gemini-generated image with the visible watermark toggled off, uploaded to a platform that strips metadata on ingestion, retains only the pixel-embedded SynthID signal, which is real, and is also the one signal in this whole stack shown by independent testing to be most vulnerable to exactly the kind of cropping that commonly happens before or during that same journey.

The Anthropic counterpoint, and the user reaction it produced

Anthropic's move in the opposite direction, from no text watermark to a production text watermark, in the same window Google was making its visible image watermark optional, is worth reading against the Google news rather than as a separate story, because the two moves are responses to the same regulatory pressure applied to two different modalities. Anthropic's watermark, woven imperceptibly into Claude's generated text at the model level, is explicitly framed by the company as fulfillment of its commitments under the EU AI Act's Article 50(2) Code of Practice, the same regulatory instrument driving Google's, OpenAI's, and Meta's provenance work this year.

The public reaction to Anthropic's announcement is its own useful data point for anyone thinking about how provenance signals actually land with the people whose content carries them, as distinct from the regulators the signals are built to satisfy. TechCrunch's coverage of the reaction found a genuine, if noisy, backlash, concentrated specifically among users who had been using Claude to help with work or schoolwork in ways that blur the line between assistance and substitution: reorganizing a paragraph, generating text intended to be submitted as though it were fully human-authored, cleaning up phrasing to obscure AI involvement entirely. The most pointed version of the complaint, from a Reddit user quoted in that coverage, argued that ordinary users doing modest, defensible things with the tool, a student reorganizing a paragraph, a journalist summarizing a transcript, a writer asking for synonyms, would come away with what the poster called "a digital tattoo," while more sophisticated users capable of running output through additional obfuscation steps, ironically the same paraphrasing and rewriting techniques the SynthID robustness research identifies as effective against the watermark, would face no such consequence.

That specific framing deserves to be taken seriously as a substantive critique, separate from whatever one thinks of the more heated language surrounding it, because it identifies something real: a watermark that is easier to defeat for a sophisticated adversary than for an ordinary, low-effort user produces exactly the wrong distribution of consequences. It catches the person using AI assistance in ways that are arguably fine, or at least common and low-stakes, while doing comparatively little against the person deliberately trying to pass fully AI-generated content off as human work, precisely because that person has both the motivation and, per the research on text-watermark evasion, a realistic set of techniques available to strip the signal. Other commentators pushed back hard on the framing in the same threads, arguing plainly that a watermark detecting AI involvement is not "claiming credit" for the user's work, and that objecting to detectability mostly reveals an intent to misrepresent AI involvement in the first place, which is itself a fair rejoinder. Both things can be true at once: the watermark is a legitimate and defensible transparency measure, and it is also, per the same technical research examined above, meaningfully less durable against the people with the strongest incentive to defeat it than against the people with the least.

What this means for AI governance policy

Pull the threads together and a clear, actionable picture emerges for any organization building or updating AI governance policy around content provenance.

First, treat watermarking and metadata as a layer of defense, not a guarantee. The consistent theme across OpenAI's documentation, Google's own framing, Anthropic's disclosures, and the independent research on SynthID robustness is the same: these are probabilistic signals that meaningfully raise the cost of misrepresenting AI-generated content as human-authored, particularly against casual or unmotivated misuse. None of the major labs claims, in their own technical documentation, that these signals are unremovable, and the existence of actively maintained, easily accessible removal tooling for the weakest of these signals, the visible Gemini watermark, is a working demonstration of what happens once a determined party decides a signal is worth defeating. A governance policy that treats "our content carries a C2PA credential" or "our vendor watermarks its output" as equivalent to a verified, tamper-evident chain of custody is building on a foundation weaker than the vendors themselves describe it as being.

Second, understand that visible and invisible signals fail differently, and both matter for different reasons. A visible watermark requires no detection infrastructure and works for any viewer with functioning eyesight, which is precisely why some jurisdictions, per Google's own acknowledgment that it will withhold the removal toggle where local rules require visible marking, still consider it doing distinct transparency work that an invisible signal does not replace. An organization operating across jurisdictions should not assume that satisfying a machine-readable marking requirement, the kind Article 50 imposes on providers, automatically satisfies a separate, human-visible disclosure expectation that a specific market may still require by law or by its own policy.

Third, know which modality you are actually relying on, because the technology's maturity differs sharply by modality and treating them as a single, uniform capability will produce a false sense of security. Image and video watermarking, per the independent testing referenced above, holds up reasonably well against ordinary, non-adversarial handling, with cropping as the notable and specific weak point worth flagging in any internal risk assessment. Text watermarking is substantially more fragile, with published, peer-reviewed and independently replicated research demonstrating that common, low-effort transformations, paraphrasing chief among them, meaningfully degrade detection. An organization relying on a vendor's text watermark as part of a compliance story should understand it is relying on the least durable of the technologies currently deployed, not the most.

Fourth, build your actual disclosure practice independent of whichever signal your AI vendor happens to embed. This is the same conclusion that follows from a close reading of the EU AI Act's Article 50 more broadly: a provider's marking obligation and a deployer's disclosure obligation are separate legal requirements attaching to different parties, and a vendor's watermark, however well engineered, satisfies only the provider's half. If your organization is the one publishing AI-assisted content to an audience, the disclosure your own readers are entitled to is not delegated to, or discharged by, whatever technical signal happens to survive in the file by the time it reaches them. Build the disclosure practice on your own editorial judgment and your own documented process, and treat the underlying vendor watermark as a helpful, imperfect backstop rather than the mechanism doing the actual compliance work.

Fifth, keep an internal record of what your vendors have actually shipped, not what they have announced or committed to, and revisit it regularly, because this is a fast-moving space in which the state of the art changed materially three times in the same two-week window covered in this piece alone. A vendor's provenance posture from six months ago is not a reliable description of its posture today, and the correct response to that pace of change is not to pick one moment's technical state and treat it as settled, but to build a review cadence into your governance program that checks vendor documentation on a schedule rather than assuming last year's assessment still holds.

The cat-and-mouse game is not going to end

The pattern visible across these two weeks, a lab strengthens a signal, an open source community demonstrates how to defeat the weakest version of it, the lab adjusts its posture in response, is not an anomaly in the history of digital provenance technology. It is the normal shape the problem takes, and it will keep taking that shape as long as the underlying incentive gap exists: labs need provenance signals robust enough to satisfy regulators and platforms, while a meaningful share of end users want the ability to produce content that does not carry an obvious mark of its origin, whether for legitimate creative reasons, competitive reasons, or reasons that shade toward deception. Google's decision to make the visible watermark optional while keeping the invisible signals in place is a reasonable response to that gap given the tools already in circulation, but it does not close the gap, and neither does Anthropic's new text watermark, given the same paraphrasing and rewriting techniques already documented as effective against comparable systems.

For an organization building governance policy in this environment, the discipline that actually holds up is not betting on any single vendor's signal staying ahead of the removal tooling built against it. It is building a compliance and disclosure practice that would remain sound even if every watermark in current use were defeated tomorrow, because the legal obligation to disclose AI involvement to your own audience was never actually discharged by the watermark in the first place. That was true before the August announcements, and it will still be true whenever the next round of this cycle plays out.

A closer look at the incentive structure driving both directions

It is worth spending a moment on why two labs building comparable technology, under the same regulatory pressure, arrived at opposite starting points on visible marking, because the answer says something about how provenance decisions actually get made inside these organizations, and it is rarely a purely technical decision.

OpenAI's choice to skip a visible mark from early on and lean entirely on machine-detectable signals reflects a product philosophy that treats a generated image as, first and foremost, a creative or professional output the user owns and intends to use as-is, with provenance metadata riding along quietly for anyone who specifically wants to check it. That is consistent with how ChatGPT's image generation has been positioned from the start, oriented toward business and creative use cases where a permanent, visible brand mark on every output would be a real point of friction, the kind that shows up in customer complaints and lost enterprise deals rather than as an abstract design principle. OpenAI's bet, in other words, is that the machine-readable layer, backed by a public verification tool anyone can use to check a specific file, does the transparency work that matters, while a visible mark would mostly just be a tax on legitimate use.

Google's decision to ship a visible watermark by default, and to keep it mandatory for as long as it did before the August 14 change, reflects a different starting position, one closer to erring toward conspicuous labeling first and relaxing it only once the company judged the invisible layer mature and trusted enough to carry the transparency burden alone. That is a defensible sequencing choice on its own terms: ship the more intrusive but more legible signal first, while the technology and the surrounding detection infrastructure, tools like openai.com/verify's Google equivalent, are still maturing, and loosen it once you can point to a track record. Woodward's own language, "striking a balance between creative control and safety," is explicit that the change is a considered relaxation, not an abandonment, and the retained invisible signals plus the newly open-sourced Credentio verification library are the evidence the company is pointing to in support of that claim.

Neither approach is straightforwardly right or wrong, and the useful takeaway for a governance program is not to pick a favorite lab's philosophy but to recognize that vendor provenance posture is a product and business decision as much as a technical one, and it will keep shifting as competitive and regulatory pressure shifts. A policy that assumes a vendor's current marking behavior is a fixed technical property of the tool, rather than a business decision that can and does change on a multi-week cycle, will be out of date faster than most governance documents get reviewed.

Practical steps for a compliance function right now

Translate the preceding analysis into a short, concrete checklist, and the actionable version looks like this.

Confirm, for every AI image, video, or audio generation tool your organization uses, whether it applies a visible mark by default, whether that default can be changed, and whether your organization or your end users control that setting. If the tool is Gemini and your organization has not made a deliberate decision about the Media Watermark setting, someone in your organization is currently making that decision by default, and it is worth knowing which way the default currently points and whether that is the choice you would make on purpose.

Separately confirm which invisible signals, if any, remain regardless of the visible-mark setting, and get that confirmation from the vendor's own technical documentation rather than from a product announcement, because announcements tend to describe intent while documentation describes implementation. Google's own framing, that SynthID and C2PA metadata persist even with the visible mark off, is the kind of claim worth verifying independently where the tooling exists to do so, using something like openai.com/verify's equivalent detection surface for the vendor in question, rather than accepting the announcement at face value.

Build cropping, screenshotting, and format conversion into any internal test of a vendor's provenance claims, rather than testing only the unmodified, freshly generated file. The independent research reviewed above consistently identifies exactly these operations as the weak points across both image watermarking and metadata-based provenance, and a compliance check that only validates the pristine, unmodified output will systematically overstate how much protection the signal actually provides once that content starts moving through your organization's own publishing and distribution pipeline, which almost always involves at least one of these transformations before content reaches an external audience.

Treat text watermarking, wherever your organization relies on it, as materially weaker than image or video watermarking, and do not extend confidence earned by one modality to the other. This is the single most common category error available in this space right now, because the underlying mechanism, an imperceptible signal woven into machine output, sounds like the same kind of thing whether it is protecting a pixel grid or a token sequence, and the independent research is clear that it is not: text watermarks degrade under transformations, principally paraphrasing, that leave image watermarks largely untouched, because the two are defending fundamentally different kinds of content against fundamentally different kinds of attack.

Finally, put a review date on this specific area of your governance policy, shorter than your normal review cycle for other sections, and treat that shorter cycle as a permanent feature of how this part of the policy gets maintained rather than a temporary response to a busy news week. Three major labs materially changed their provenance posture within a ten-day span in August 2026 alone. A governance document that describes vendor watermarking behavior as of a snapshot taken even two or three months prior is likely already describing a state of the world that no longer holds, and the cost of catching that lag is far lower than the cost of a compliance representation built on a vendor posture that quietly changed underneath it.

None of this argues against using provenance tooling, or against giving vendors credit for genuinely improving it, both OpenAI's conformance work and Google's decision to open-source a verification library are real, useful contributions to an ecosystem that badly needs more independently checkable infrastructure rather than more vendor-asserted claims. It argues for holding the technology to the standard its own creators describe it as meeting, a meaningful but imperfect signal, rather than the standard a compliance program under pressure to check a box might wish it met. The gap between those two standards is exactly where the August news sits, and it is exactly where an organization's own judgment, not any vendor's watermark, has to do the remaining work.