AI watermark mandates can name the whistleblower who never used AI

Nothing in the WITNESS scenario requires a model. The filmmaker's exposure comes from an identity extension her editing software fills in without being asked again, so her account details ride inside the provenance of everything she exports ^[5]. Whether she ever ran a generative tool has no bearing on what leaves her machine, which is the point Techdirt draws out: a mandate aimed at labelling AI output can reveal someone who never touched AI ^[1].

That is a different adversary from the one the standard was built for. C2PA was assembled by technology companies to answer their own problem of identifying AI-generated content ^[8], where the person you are guarding against is the one passing off a fake. As the EU AI Act and similar laws pull the standard out of voluntary tooling and into legal obligation ^[9], the covered population stops being model users and becomes anyone exporting a file from compliant software, including a filmmaker who installed it only because her international distribution partners insisted ^[4].

The consent arithmetic is what makes this durable rather than occasional. She filled in name, email and country once, during setup ^[4]; the attachment then applies to every export she makes afterwards, so a single prompt authorises an open-ended number of disclosures ^[16]. The switch that would stop it exists, in an advanced settings panel written in language that assumes you have read the C2PA specifications ^[6].

WITNESS is not arguing that provenance should be abandoned; its position is that the risks be recognised and countered ^[15]. That matters for how the objection lands. The group is broadly supportive of AI transparency rules and was involved in producing the EU Code of Practice behind the very watermarking requirement Anthropic implemented ^[3]. This is a critique from inside the standards process, not from the people who would prefer no disclosure at all.

It also sharpens an existing complaint about the label itself. Techdirt has argued that a binary "some AI was used on this" flag lumps non-native English speakers and some disabled users in with bad-faith uses ^[14]. The WITNESS report adds the harder version: the same infrastructure links identity to specific content with cryptographic precision, accumulates into behavioural profiles, and is harder to contest because regulation has blessed it ^[10]. A single bit of disclosure was already too coarse to be useful. Attached to a verified name, it becomes precise about the wrong thing.