Section: Technology & AI | Justice & law Author: V Reading time: ~27 min Sources and further reading: 22 items Topics: deepfake, C2PA, Content Credentials, video detection, photography, AI Act, Criminal Code SEO / working title: Deepfake: How can you tell a fake video or photograph?
The question is: how can you tell a fake video or photograph? It sounds simple only until we notice that we are not comparing one thing. A missing Content Credentials stamp is not proof of authenticity. C2PA says who claimed provenance, not that the scene happened in the world. A “blood in the pixel” detector is not a forensic conclusion on Instagram. A label under the AI Act is not a criminal prosecution of an offender. Only when these four things are separated can one read what a signature, a laboratory and the amendment of the Criminal Code as of September 2026 actually hold — and what an eye that hit by chance does not hold.
This text does not deal with voice. A phone call, a synthetic voice and a payment belong in another article. It also does not deal with the broader question of whether a photograph by itself is enough as evidence before a court; that is a separate text on photography as evidence. Here the question is more practical: what to do with a file that sits on a display and presents itself as an image of the world.
1. A journalist, a detector and a prosecutor are not dealing with the same photograph
Imagine an editorial meeting on a day when a short video of a politician is spreading on the network. The editor wants to know whether it carries a clear label under the AI Act. The designer looks for Content Credentials. A forensic enthusiast runs a detector that promises to expose synthetic video from subtle colour changes in the face. The lawyer asks whether this is defamation, fraud, an interference with a likeness, or a new offence in the Criminal Code. A reader in the comments writes that they “see it at first glance”.
At first glance this is a dispute about whether the video is genuine. In fact each person is holding a different object. The editor is dealing with a duty to label towards the audience. The designer is dealing with a cryptographic manifest in the file. The enthusiast is dealing with a statistical signal in the image. The lawyer is dealing with the handling of a likeness, intent and consequence. The reader is dealing with an impression.
That is why everyone can be partly right and the shared verdict still wrong. A video can be unlabelled and still genuine. It can have a valid manifest and still not capture what a viewer infers from the caption. It can pass a laboratory detector and still be only badly compressed. It can be obviously synthetic and still fail to fulfil a specific criminal offence.
The first rule of practical detection is therefore not: find the best detector. It is: name the layer. For a signature we ask whether the file carries a verifiable manifest. For a detector we ask on what population it was tested. For the law we ask what someone did with the image. For the human eye we ask whether it even has a chance of distinguishing what it claims to distinguish.
A missing stamp is not proof of authenticity.
— Jiný Kontext
2. One scene on a display has at least six layers
One picture on a phone looks like one thing. It is not. It is the result of a chain in which a sensor, a container, edits, distribution, captions, algorithmic interventions and legal consequences are mixed. When those layers are mixed, a false certainty appears: metadata are missing, so it is a forgery; the detector showed a high score, so it is settled; there is no label, so the law has been broken; the image looks odd, so it is AI.
Six layers of one scene:
- Sensor and container. Camera, phone, social network, messenger, screenshot and compression. Each step can keep, change or discard metadata.
- Generator or edit. Face-swap, a GAN face, an image model, a video model, manual retouching, a cut or an ordinary filter. Not every edit is a deepfake and not every deepfake is the same.
- Detection signal. A visual artefact, a biological rhythm in the face, a watermark, machine metadata, a network trained on a specific set.
- Distribution. Editorial publication, an advertisement, a private message, campaign material, an anonymous repost. The same file in another channel means another responsibility.
- Labelling. Machine-readable marking by the provider and a clear deepfake label towards the audience under Article 50 of the AI Act are two things [6][7].
- Law after the act. The Criminal Code, the Civil Code and the protection of personal data assess conduct, consent, harm, intent and context, not only the structure of a pixel [9][10][22].
This layering is not wordplay. It changes whom to ask when something fails. If a manifest is missing, a screenshot may have dropped it. If a detector is shouting, it may be seeing bad light. If a work is unlabelled, we still do not know who published it and under what regime. If it is a false likeness, the law will not ask only about the technique of creation, but about the handling of the person shown.
Illustrative scheme: Signature, detector and law are three columns. Between them there is no arrow saying “it is fake”. In each column a different question stands: is the manifest valid, on what set was the signal verified, what conduct took place.
3. A missing stamp is not proof of authenticity
Content Credentials are sometimes described as a digital birth certificate of an image. That is a useful shorthand if we know where it ends. A C2PA manifest can carry claims about provenance, edits and signed content. But most ordinary files need not have such a manifest at all. The phone did not add it. The social network discarded it. The messenger recomputed the image. Someone took a screenshot.
The absence of a stamp is therefore not suspicion in itself. It is often the default state. If a file from an ordinary phone does not carry C2PA, it does not follow that it was generated by artificial intelligence. If an image lost metadata on its way through a chat, it does not follow that the original scene did not happen. It follows only that the specific file we now hold does not carry a verifiable manifest.
That is inconvenient for a newsroom, but more precise. A public census of how many news visuals in the Czech Republic as of September 2026 carry valid Content Credentials is not in the dossier. Without such a measurement, the absence of a signature cannot be turned into a rule about Czech media practice. One can only say that a signature helps where it is present and where the chain of trust holds.
The practical question is therefore not whether an image “has a stamp of authenticity”. It is whether, for a specific file, a verifiable provenance signature exists and what exactly it signs. Absence is a signal for caution. It is not a verdict.
4. C2PA says who claimed provenance. It does not say that the scene happened
C2PA is a technical specification for provenance. At its core it works with a manifest, assertions, a claim and a signature. If a file carries a manifest and the chain of trust holds, verification can say who signed a given claim about the content and whether the signed part has changed since then [1][2][3].
That is a lot. It is not everything. Specification 2.2 of May 2025 expressly does not confer a value judgment about “good” provenance [1]. It does not say: this scene happened. It does not say: the caption is true. It does not say: the person shown consented. It does not even say: every later viewer understands the context. C2PA can improve the provenance trail, but it does not turn an image into evidence without further work.
Imagine a photograph from a demonstration with a valid camera manifest. The manifest can confirm that the file comes from a given device and was not edited after signing in a way that the signature would survive. It will not, by itself, answer whether the caption named the place correctly, whether the frame is from another day, whether the crop conceals the surroundings, or whether the person in the foreground did what the text attributes to them.
The opposite error is equally dangerous. If a manifest is missing, that is not automatically a sign of manipulation. If a manifest exists, that is not automatically a sign of truth. The correct reading is narrower: C2PA is a layer of trust in a given claim about the provenance and integrity of a file. C2PA is not a deepfake detector.
5. SynthID is not a Content Credential
Beside manifests there are watermarks. Google DeepMind describes SynthID as a technology that embeds a digital watermark into the outputs of selected models [19]. OpenAI in May 2026 announced the layering of C2PA and SynthID for image content and, in an update of July 2026, added audio as well; this text stays with image and video [20].
The difference is substantial. Content Credentials carry structured claims and a signature in the container. A watermark is a signal embedded in the content. It can survive some transformations better than metadata, but it usually carries less context. It can say that an output probably comes from a given participating system. It cannot, by itself, describe the whole chain of edits, the source of the shot, a person’s consent or the truth of the scene.
OpenAI cites the loss of metadata through a screenshot, a re-encode or a crop of the container as a reason to layer a watermark onto C2PA [20]. That does not mean the watermark is a lock. It works for participating generators and according to the properties of the specific implementation. For content from another model, a manual edit, an older file or an ordinary photograph without that technology, there may be nothing to read.
This is not a dispute of “metadata versus watermark”. They are two different layers. A manifest gives context and a signature where it has survived. A watermark gives a signal where it was embedded and where a detector can read it. Neither by itself answers the question of what happened in the world.
6. The eye on a GAN face hit chance
The human eye is good at many things. It can read expression, mood, intent, social cues. That is precisely why, with synthetic faces, we often trust it more than it deserves. The study by Nightingale and Farid in PNAS from 2022 tested the distinguishing of real and StyleGAN2 faces. In the first experiment 315 participants judged 128 faces from 800 items, of which 400 were real and 400 synthetic. Mean accuracy was 48.2 percent, with a 95% confidence interval of 47.1 to 49.2 percent [13].
That is close to chance. The figure measures a binary task “real vs. synthetic” on static faces in a specific experiment. It does not measure video, a Czech feed, current diffusion models, or the ability to assess the whole context of a shot. That is why it is useful: it does not say that people never recognise anything. It says that the certainty of a glance is a bad detector.
The authors also tried training with feedback. In the second experiment 219 new participants reached 59.0 percent, with a 95% interval of 57.7 to 60.4 percent [13]. This too is not a guide to hunting synthetic faces at work. Between the first and the second half of 64 faces, accuracy did not rise: 59.3 against 58.8 percent. The test shows that even short training has a limited effect.
It does not follow that a visual check has no value. It follows that the eye belongs at the start of the question, not at its end. When something seems odd, it is reasonable to stop sharing and look for a second channel, a source, an original and context. It is not reasonable to point at a colleague’s face and say: I recognised AI.
7. Ninety-six percent on FaceForensics is not a lock on Instagram
Intel in November 2022 presented FakeCatcher as a real-time deepfake detector and, in a product claim, stated 96% accuracy [15]. The academic paper by Ciftci, Demir and Yin describes the detection of synthetic portrait videos using biological signals, especially subtle changes related to blood flow in the face. On the FaceForensics dataset it reports 96 percent accuracy, on FaceForensics++ 94.65 percent, on Celeb-DF 91.50 percent and on the authors’ “in the wild” Deep Fakes Dataset 91.07 percent [14].
These are specific results on specific sets. They are not a door with a lock. Accuracy is not the same as a false-positive rate in operation. FaceForensics is not Instagram 2026. A portrait video in good light is not a dark clip from a concert. A signal in a frontal face is not a profile, make-up, low fps, heavy compression or a newer generator that learns to imitate or blur a similar rhythm.
A marketing sentence without a cut of the datasets and without an operational population also slides easily into the wrong use. If someone says “the detector has 96 percent”, the missing question is: on what, when, with what threshold, with what share of false alarms and at what cost of error? For an editorial decision a false alarm is expensive. Labelling a genuine video as a forgery can damage as much as sharing a forgery as genuine.
An rPPG detector is therefore not a forensic conclusion. It can be a hypothesis for a portrait video, if we know the conditions and the limits. It should not stand alone in the column “true / false”. Without an independent evaluation on current generators, with a calibrated false-positive rate and real channels of distribution, it is an auxiliary trace, not a verdict.
8. DFDC left detection open. Nobody on the black box reached seventy
The Deepfake Detection Challenge was useful precisely because it showed the difference between a known set and a hidden test. According to Meta AI the challenge had 2 114 participants and more than 35 000 models. The dataset described by Dolhansky and colleagues contained more than 100 000 clips with 3 426 paid actors [16][17]. That is a large, but still specific, construction.
On the public set Meta reports the figure 82.56 percent, while in the communication the name of the metric oscillates between accuracy and average precision [16]. On the black-box set the best participant, Selim Seferbekov, reached 65.18 percent; nobody reached 70 percent [16]. The figure measures a specific challenge from 2020, not today’s internet. Its value is in the distinction: performance on known data does not mean generalisation to unseen forgeries.
That is the core of the detection problem. Generators change. Compression changes. Publication channels change. A detector can learn a trace of the dataset instead of a general mark of forgery. In the laboratory it then looks precise, and in operation it meets a different world.
NIST GenAI Image-D publishes a plan and metrics such as AUC, EER, TPR at a given FPR and Brier score in bins; at the same time it forbids participants from making advertising claims about ranking [18]. That is a reasonable restraint. As of September 2026 the dossier contains no single primary figure of the type “NIST verified 96 percent in the wild”. If such a sentence is circulating somewhere, this text has no support for it.
9. A label under the AI Act is not a criminal prosecution
The AI Act introduces transparency duties, not a new universal police detector. Article 3 point 60 defines a deepfake cumulatively: it must be content resembling existing or plausibly existing persons, objects, places, entities or events, and it must falsely appear authentic or true [6]. Article 50 then distinguishes the duties of providers and of deployers [6][7].
From 2 August 2026 Article 50 applies; for systems placed on the market before that date, machine marking under paragraph 2 is deferred until 2 December 2026 [7]. The Commission in an FAQ of 24 July 2026 also states that content created before 2 August 2026 need not be labelled retroactively [7]. ČTÚ as of 31 July 2026 pointed to the applicability of the transparency rules and referred to the Code of Practice [8].
These dates measure the applicability of duties, not the authenticity of a file. A deepfake label towards the audience under Article 50(4) is not the same as a machine-readable mark by the provider under paragraph 2. The Commission also states that a deployer should not rely only on the provider’s machine mark [7]. When a newsroom publishes a synthetic or edited visual, it is dealing with its own duty towards the reader. When an offender uses an image for fraud, it is hard to expect that they will honestly fulfil the duty.
The Commission FAQ states, for breaches of transparency duties, a sanction ceiling of up to 15 million EUR or 3 percent of worldwide turnover, whichever is higher, with proportionality for small and medium-sized enterprises [7]. That is a ceiling, not a tariff for an unlabelled meme. And above all: the sanction regime for transparency is not a criminal qualification of a specific harm.
10. A paragraph on non-consensual pornography is not a paragraph on a political video
Czech amendment No. 270/2025 Coll. is in force from 1 January 2026 and adds to the Criminal Code, among other things, § 181(2) and the new § 191a [9]. That is a substantial change, but also a frequent source of shortcuts. The new § 191a concerns the production and dissemination of a pornographic work that exploits a person without their consent. The basic offence states a term of up to 2 years of imprisonment [9].
This figure measures the statutory term of the basic offence from 1 January 2026. It does not measure the number of convictions, it does not speak about every synthetic image, and it does not apply to a non-pornographic political video merely because it was created or edited with artificial intelligence. What matters is the handling of the work, the nature of the content and the consent of the person shown.
§ 181(2) aims at a false likeness or utterance with the intent to cause serious harm to rights [9]. That is a different construction. Satire and art are not automatically criminal. Likewise, not every bad caption is a criminal offence. The law assesses the specific circumstances.
It does not follow that the technology is a legally neutral toy. It follows that “deepfake” is not one paragraph. An image can be a tool of sexual abuse, defamation, fraud, an interference with privacy or a civil dispute over a likeness. One detection app will not distinguish that.
11. Defamation and fraud punish a lie and a consequence. Not a file
The Criminal Code knows defamation in § 184, fraud in § 209 and unauthorised handling of personal data in § 180 [10]. The Civil Code protects likeness and privacy in § 84 and following [22]. A deepfake can be a means. It is not automatically an offence.
That sounds legalistic, but for practice it is a simple brake. If someone shows a video and asks “is this a crime?”, it is not enough to answer whether the image is synthetic. One needs to know who created it, who spread it, what it claimed, whom it harmed, whether it was a pornographic work, whether there was consent, whether there was intent to cause serious harm, and whether a property or other consequence occurred.
A detector from a pixel does not assemble an offence. It can give a reason for caution, it can help a newsroom not to publish quickly, it can be one trace for expert assessment. It cannot replace a legal qualification. Just as a valid C2PA manifest does not replace a person’s consent to publication, a high detector score does not replace proof of intent.
The practical recommendation is therefore less spectacular, but firmer: if harm is suspected, stop the spread, keep the available file and context, verify by a second channel, and leave the legal qualification to reporting and to the bodies active in criminal proceedings. The article does not join a specific video to a specific paragraph. It shows why that cannot be done from one score.
12. A screenshot drops the manifest. It does not drop the event
The shortest Content Credentials test is deliberately banal. Take a file that you know has signed Content Credentials, and verify it at Content Credentials Verify [5]. Record the state: valid, invalid, missing. Then take a screenshot of it and verify the new file again. You will often see that the manifest is missing.
That is not the exposure of a fraud. It is a property of the path. A screenshot does not create cryptographic continuity with the original file. A re-encode, a crop or a change of container can drop the manifest as well; OpenAI cites this as one reason for layering SynthID onto C2PA [20]. The loss of a manifest must therefore not be read as proof that the original event did not happen.
Likewise, a valid manifest on the original does not say that a screenshot circulating two hours later carries the same value. The reader holds a different file. It can have a different crop, a different caption and a different context. Verification always concerns a specific file, not a general memory of an image.
How to test Content Credentials before and after a screenshot
The test has three steps. First verify the original file and save the result of the verification. Then create a screenshot or an ordinary copy through an application that changes the container. Finally verify the new file. If the manifest disappears, you record a difference between files, not a conclusion about the truth of the scene. If the manifest remains, you are still reading only the claims that are in it.
13. The best check is the one whose false alarm you can bear
With a deepfake image the talk is often about how to catch a forgery. It is equally important how not to damage genuine content with a false alarm. A newsroom, a firm and an individual need to know what error they can afford. Pausing internal sharing is a cheap mistake. Publicly labelling a person as the author of a forgery is an expensive mistake. Sending money on the basis of a video is a different harm from mistakenly not publishing an illustrative picture.
| Type of failure | What it looks like | How to test | What limits the harm |
|---|---|---|---|
| Absence of C2PA as fake | A phone without a stamp is labelled as AI | Verify the file, the screenshot and the path of the file | Absence is not an edit; a census of Czech visuals is missing |
| Accuracy as operation | A laboratory figure decides a dispute on the network | Ask about the dataset, the threshold, FPR, the year of the generator | The detector only as a hypothesis, not a verdict |
| The eye is enough | “I can see that the face is not real” | Recall the experiment of 48.2 percent on GAN faces | A second channel and restraint |
| A label as an offender | We expect a fraudster to label a deepfake | Separate Article 50 from the Criminal Code | Do not read a label as a punishment |
| One paragraph for everything | A political video is automatically § 191a | Separate § 191a, § 181(2), § 184, § 209 and the Civil Code | Qualification according to the conduct |
NÚKIB mentions deepfake in cyber-hygiene teaching, not as a certified detector [11]. The National Plan for Research and Development in Cyber and Information Security to 2025 treats deepfake as a risk vector [12]. ÚOOÚ in April 2026 placed deepfake videos in an overview of channels of AI fraud and the digital footprint [21]. The common line of these materials is not “install a magic app”. It is literacy, verification and process.
The best check is therefore not the strictest check. It is the check whose error you recognise in time and whose cost you can bear. For low harm, a delay and a second source may suffice. For a public accusation a stricter procedure is needed. For a suspicion of a criminal offence the matter belongs in a different regime from a comment thread.
14. A signature, a detector and a second channel do not add up to one verdict
A practical test must not teach how to manufacture a forgery. It should show the reader where a signature ends, where a detector ends, and where verification of the situation outside the file begins.
What needs to be tested before you trust the eye
The first test is about the signature. Verify a file with Content Credentials, then its screenshot. The second test is about absence. Take an ordinary photograph from your own phone without C2PA and do not attribute an artificial origin to it merely because the manifest is missing. The third test is about the eye. Compare a known synthetic face from a safe demonstration source with an ordinary photograph, and count in advance on the fact that human certainty is a weak tool. Nightingale and Farid give 48.2 percent for the first experiment, not a licence to hunt colleagues [13].
For a news or company visual, look for a clear label where the deployer is to handle it under Article 50(4) [6][7]. Do not expect it on an anonymous repost as proof of an offender’s honesty. If harm is suspected, verify by a second channel: a known number, a known account, a personal contact or an institution whose communication has its own verification procedure. That is a process, not a detector.
A blood-in-the-pixel detector is not a lock.
— Jiný Kontext
The result of the test does not read “genuine” or “fake” in one word. It reads: signature valid, invalid or missing; the detector is usable only for a given type of file and under given limits; an independent channel confirms or does not confirm the event. Only these sentences together reduce the risk that one impression becomes a public conclusion.
15. Personal use is outside the AI Act. It is not outside the Criminal Code
The Commission FAQ states that personal non-professional use is outside the AI Act [7]. That is an important boundary. It does not mean, however, that personal conduct cannot hit other law. If someone creates or spreads a non-consensual pornographic work that exploits a person without consent, § 191a does not ask whether this was an enterprise deployment of an AI system [9]. If someone uses a false likeness or utterance with the intent to cause serious harm to rights, another question arises under § 181(2) [9].
Mixing these layers is convenient, but wrong. The AI Act regulates certain roles on the market and transparency. The Criminal Code assesses certain conduct. The Civil Code protects likeness and privacy. The protection of personal data asks about the processing of data. One file can fall into several layers, or into none of those spoken of in a comment.
The practical consequence is simple. When we ask whether the content should have been labelled, we read the AI Act. When we ask whether a likeness was abused, we read Czech law and the specific circumstances. When we ask whether the file is technically signed, we read C2PA. When we ask whether it is safe to act on the content, we call a second channel.
16. A public series of prosecutions under the new paragraphs is still missing
As of September 2026 the dossier does not contain public police statistics of the number of prosecutions under § 181(2) and § 191a for 2026. That is not proof that the offences are not happening. It is a gap in the public series. A more precise sentence is therefore not “nobody is being prosecuted for a deepfake”. It is: for the new paragraphs we do not, as of the date of the research, have a public annual overview that could be cited honestly.
Likewise we do not have a verified primary figure that FakeCatcher or a similar rPPG detector would hold operational accuracy on the generators of 2025 and 2026 in open social channels. We also do not have an official Czech census of valid C2PA manifests on news visuals. And we do not have one aggregated NIST figure that would allow us to say “detectors are solved in operation” [18].
That does not weaken the main thesis. It rather keeps it on the ground. If C2PA became the default, unstrippable layer of majority sharing, the absence of a stamp would change meaning. If an independent evaluation of rPPG on current generators with a calibrated FPR showed stable operational performance, the detector would have a stronger role. If a challenge like DFDC held well above 70 percent on a hidden set and in operation, the caution would be recalculated. Until that is so, a missing stamp is not authenticity and 96 percent is not a lock.
17. The hidden cost is an eye that hit chance
The most comfortable answer would read: learn a few signs, install a detector and look for a stamp. It would be short. And it would be dangerously self-confident. Image and video today do not require one trick, but a change in the order of the check.
First we ask what we have in hand. An original, a screenshot, a repost, a compressed video, or only a preview? Then we ask whether a verifiable manifest exists and what it claims. Then we ask whether some detector makes sense for this type of file, this quality and this population. Only then do we ask what follows legally and practically. And if it is about harm, money, reputation or an intimate likeness, we return from the pixel to the person and the institution.
That slows the check, but it slows it in the right place. Not on every picture. On every picture on which we are to act.
The question is not how to tell a fake video or photograph at a glance. It is: what of the signature, the detector and the law may you trust for this file — and which false alarm, missing stamp or missed strike of the eye can you bear for this scene?
Related texts in this series
- On the site: A photograph is no longer enough by itself. Its provenance becomes evidence too — the value of a genuine image after generative AI. This text is practical detection of video and photo.
- Is a photograph evidence? When an image can deceive even without edits — deception without pixel edits.
- What to do when someone misuses your photograph or identity? — the civil, criminal and platform channel.