Anthropic: a Claude watermark proves "likely involved," not that Claude wrote it

Two things happened in the same week. Anthropic told everyone Claude will watermark its text to satisfy the EU. Google told everyone you can now switch off the watermark you can see. Both companies are technically doing provenance. Neither is giving you a guarantee your product can lean on. Let me catch you up.

The deep cut

• Watermarks are a toggle, not a lock. Google lets Gemini users hide the visible mark while it keeps SynthID underneath.
• A watermark proves involvement, not authorship. Anthropic admits it can only say Claude was "likely involved," not that Claude wrote it.
• What survives editing is what you can trust. A full rewrite of Claude text strips the mark completely, per Anthropic.

What compliance actually bought

The trigger here is regulation, not a change of heart. As of August 2, the EU requires AI providers serving its market to mark AI-generated content, and around 190 signatories signed the Code of Practice. Anthropic and Google are both moving to comply. That is the whole reason this is happening now.

But compliance and reliability are different jobs. Anthropic is applying watermarking globally at launch because it does not yet have "a durable way to scope it by region." So the mark ships to everyone, but what it certifies is narrow. It answers one question: "What is the likelihood this was partly written by Claude?" It cannot tell you a human wrote something, and it cannot flag text from a rival model.

The mark you can see is now optional

Google split the difference in a way your team should notice. Users can now toggle off the visible "sparkle" watermark in Gemini and Flow, while invisible SynthID and C2PA metadata stay embedded. Josh Woodward, VP of Google Labs, framed it as balancing "creative control and safety."

The honest reason is in the reporting: visible watermarks make content less useful for professional work, and people were editing them out anyway. So the label a normal viewer would spot is gone by default. The proof now lives in metadata that only a tool can read. If your product counts on someone glancing at an image and knowing it is AI, that signal just disappeared.

How thin the invisible mark really is

The invisible watermark is real, but it is fragile in ways worth knowing before you build on it. Anthropic says light editing probably will not remove it, but a complete rewrite where every word is replaced will. And detection fails on short samples, where there are fewer word choices to read.

It gets thinner from there. Code carries almost no watermark, since working code rarely offers equal word choices; the mark lives mostly in comments. Factual passages are sparse too, because "Newton's most famous work was called Principia Mathematica" leaves nothing to vary. So the content your team most wants to trace, short snippets, code, hard facts, is exactly where the signal is weakest.

Metadata is a promise, not a lock

Google is also open-sourcing a library called Credentio so developers can validate credentials locally, and Claude attaches C2PA content credentials to image files. That is useful. But C2PA is metadata, a signed note in the file, not something woven into the pixels. Metadata is easy to strip, and a screenshot drops it entirely.

This lands next to X's move to open-source its ranking algorithm, where transparency is the pitch but the systems that catch bad actors stay private. The pattern is the same across all of it: companies ship the honest-looking signal, then keep an exit for the people who do not want it. Provenance is becoming a setting, not a fact.

Three questions for your team

• Where in our product do we assume AI content is detectable, and what breaks if that check returns "unknown"?
• If a user can strip the visible mark in three taps, is our trust signal the watermark or something we control ourselves?
• Are we treating C2PA metadata as proof when it survives a screenshot no better than an EXIF tag?