ChatGPT Watermark: Is Anything Actually Watermarked?

The first two do not fail the same way. Metadata can be lost to format conversion, re-saving, screenshotting, or a plain re-upload, gone in a single step.

Losing the metadata tells you nothing about whether SynthID is still present. SynthID is embedded in the content itself and is designed to survive common transformations better than metadata does.

That difference is the whole reason a metadata-stripping tool is not a watermark remover, and the reason OpenAI keeps repeating that "no detection method is foolproof."

OpenAI says images generated with ChatGPT, Codex, and the OpenAI API include C2PA Content Credentials metadata and a SynthID watermark, verifiable through a public tool that now sits at openai.com/research/verify/. The rollout is dated May 19, 2026, and OpenAI describes reaching "C2PA Conforming Generator Product" status as the recent part of it.

Its C2PA steering-committee seat is older than that. OpenAI's own page places the membership in 2024, alongside adding Content Credentials to DALL-E 3, so the 2026 announcement widened what gets marked rather than starting the relationship.

The detail worth pausing on is whose watermark it is. SynthID is Google DeepMind's, so two competing labs now run the same pixel-level signal on their own output.

OpenAI describes the two layers as complementary: "C2PA helps content carry detailed context, SynthID helps preserve a signal when metadata does not."

OpenAI's own caveats deserve quoting rather than glossing.

• "No detection method is foolproof."
• C2PA metadata "can be stripped, lost through uploads and downloads, or broken by transformations."
• Provenance signals are "not a guarantee that content is accurate, unedited, legally owned, or presented in the correct context."

So a result of no signal detected does not mean the image was not made by ChatGPT. It can simply mean the metadata did not survive whatever happened to the file after it left OpenAI's servers.

The Verify tool, which OpenAI introduced as a preview, accepts images and audio only. It deliberately stops short of a definitive conclusion when it finds nothing, for the same reason.

On July 31, 2026, two days before EU AI Act Article 50 transparency rules took effect, OpenAI extended SynthID watermarking to supported audio from ChatGPT and the OpenAI API. It added a Content Provenance API the same day, POST /v1/content_provenance_checks, which accepts images and audio up to 50 MiB with audio capped at 60 seconds.

Audio did not get the treatment images got, and it is worth being precise about this because the shorthand "same approach" is wrong. OpenAI marks audio with SynthID and attaches no C2PA Content Credentials to it. Two of its own surfaces agree, both listed below: the July 2026 provenance update says supported audio "now includes SynthID watermarking" and never mentions C2PA, and the help-center modality table reads "Audio | SynthID watermarks."

That has a practical upside. An audio file has no manifest to strip and no issuer to read, so the fragile-metadata caveat that dominates the image story simply does not apply to it.

GPT-Live's own system card, published three weeks earlier on July 8, 2026, makes zero mention of SynthID, C2PA, or watermarking. The audio provenance rollout was announced separately from, and after, the model's own safety documentation rather than built into it from the start.

A November 2025 investigation by Ethan Le Sage, published on LessWrong and cross-posted to the EA Forum, checked Sora 2 videos against both the Content Credentials Verify tool and the open-source c2pa-rs CLI. Some videos carrying the visible OpenAI watermark had no detectable C2PA metadata at all, while some Pro-tier videos without the visible watermark did carry it.

That is close to the reverse of OpenAI's public claim that every video generated with Sora includes both visible and invisible provenance signals. Rechecked on September 3, 2026, the post is unedited, carries no author correction, and its three comments are all from November 2025, none of them from OpenAI.

Two limits keep this at community discussion rather than a confirmed failure. It rests on a single independent tester using third-party tooling, and SynthID is a separate pixel-level mechanism that neither tool measures, so an absent C2PA manifest does not establish an absent watermark.

Leaked internal documents, reported by the Wall Street Journal and covered by Tom's Hardware on August 5, 2024, describe an internal ChatGPT text-watermarking method reportedly around 99.9% effective, built years before the 2026 provenance work. OpenAI chose not to ship it.

The reasons given, per that reporting, were specific.

• The method could be circumvented, which invites a false sense of certainty.
• False positives: 99.9% accurate still means a meaningful volume of wrongly flagged writing at ChatGPT's scale.
• Those errors would land disproportionately on non-native English writers, whose phrasing patterns look more machine-like to some watermark detectors.
• Internal survey data suggested close to 30% of users would use ChatGPT less often if the feature launched.

This is not only a leak. OpenAI has separately and publicly discussed text-watermarking research and its risks, naming false positives, circumvention, and disproportionate impact on non-native English speakers, in its own content-provenance posts. The leaked rationale and the published one make the same arguments.

That is a genuinely more detailed public rationale than Anthropic, Google, or Meta have offered about their own text-watermarking decisions. It reframes the missing ChatGPT text watermark as a considered tradeoff rather than a technical gap.

Nothing found more recently changes that. OpenAI's 2026 writing on provenance continues to describe text as a future goal, not a status change, and a corroboration pass on August 17, 2026 against OpenAI's developer content-provenance guide found it documents images and audio and does not mention text anywhere.

Secondary reporting states that OpenAI's own Responsible AI Provenance Guide says the company does not embed watermarks in text model outputs at all, relying on C2PA metadata for images instead. That specific claim could not be verified against OpenAI's own site, so it stays a secondary-source data point rather than an official confirmation, but it points the same direction as everything else here.

Start with the text case, because it is the query people type and the one with the cleanest answer. A tool that claims to remove ChatGPT's text watermark is making a claim about a mechanism OpenAI built and shelved. There is no known public detector to test that claim against in either direction.

Cleaning hidden Unicode characters out of copied ChatGPT text is ordinary formatting hygiene, worth doing on its own terms. It is not defeating a watermark, because OpenAI names no such mechanism for text.

For images the two layers come apart completely. The metadata is the part that breaks first, usually by accident: the June 2026 developer thread above shows an ordinary re-upload doing it, and format conversion, re-saving, or a screenshot do the same.

SynthID is the harder half, and public discussion shows a real asymmetry. The Hacker News thread about a CLI watermark-removal tool, posted May 19, 2026, pulled 387 points and 258 comments, making it the highest-engagement watermark discussion found there. It reported a hard technical limit: the tool cleanly strips the visible watermark, and defeating SynthID reportedly required regenerating the image entirely through Stable Diffusion XL, degrading quality in the process.

Commenters split on whether that is good news or bad news.

• The privacy and resistance framing: removal tools push back on tracking built into generated media.
• The abuse framing: the same techniques enable deepfake scams, with one commenter raising a Kentucky political deepfake ad reported to have cost $1.7 million and reached 49 million views.
• The sidestep: newer watermark-free local models make the whole removal question moot for anyone who just does not use a watermarking provider.

A separate discussion on the same site, from the day of OpenAI's SynthID announcement, drew 332 points and 180 comments. One commenter claimed Stable Diffusion at 10 to 15 percent denoising strength was enough to defeat SynthID, saying they tested it the day Nano Banana Pro shipped. Nobody published a reproducible test alongside that claim, so it stays community discussion, not a documented result.

For text, a July 2026 thread titled "Text AI watermarks will always be trivial to remove" asked whether foundation-model labs already use watermark removal internally to keep synthetic text out of their own training data. It proposed low-denoising image-to-image regeneration as a practical bypass, which is an image technique, not a text one. Nobody in that thread demonstrated a removal method against ChatGPT text, because there is no live ChatGPT text watermark to demonstrate one against.

• Hidden Unicode characters such as zero-width spaces.
• Non-breaking spaces and other invisible whitespace.
• Repeated phrases and stock openers.
• Writing-style habits, punctuation tics, and sentence rhythm.

None of these appear in OpenAI's help-center article on images and audio, or anywhere else in its documentation, as an actual watermarking mechanism.

Given how candid OpenAI has been about why it has not shipped a text watermark, treat any claim that ordinary ChatGPT text already carries one as unconfirmed at best. Cleaning invisible characters out of pasted text is still worth doing for formatting reasons, it just is not defeating a watermark.