Prebid

Provenance and Reporting: Who Made Your Content, and How Did AI Use It?

by

By Erik Svilich (Encypher) and Alex Springer (SPUR Coalition)

For the Prebid LLM Taskforce. Part four of the publisher series.

Disclosure: Encypher sells C2PA provenance software, co-chairs the C2PA text provenance task force, and contributed to the Content Telemetry consultation. Alex Springer maintains Content Telemetry for SPUR and is a director of OpenAttribution, where the standard began. Links to encypher.com go to Encypher’s own pages.

When a chatbot (or any Generative AI system) creates a response or artifact for a user it requires up-to-date content in order to give the user an accurate and up-to-date output. 

Provenance is the proof of the origin of  that incoming content – who owns it, where was it sourced, and how has it been altered? Content usage reporting allows the content owner to understand the influence their content has and the value it has delivered.

Provenance: a label that travels with the work

C2PA is an open standard for content provenance. These are signed labels that can be applied to a range of media, including graphics, video, and text. A label says who signed it, when, and with what tools and is tied to a specific artifact. 

A valid label shows who signed the content and that it has not changed since the label was created. In addition, the label can express the content usage preferences of its owner (ex. “Do not train on this”) and its content usage reporting requests – but cannot enforce these requests. An additional identity assertion can be added that associates the content with the author. 

A checker asks if the signature is real, if the signer is trusted, and if the content still matches. Since C2PA 2.3, out in January 2026, plain text can carry a label as hidden characters. It survives copy and paste and posting on most sites – including social media. From January 1, 2027, California’s AB 853 will bar big social media and search platforms from knowingly stripping provenance labels where they can avoid it, and also display that info to users under certain rules.

File labels are easier to lose. In a 2025 Washington Post test, none of eight social apps kept a video’s label. CDNs that resize photos can strip labels. Some tools that delete hidden text strip text labels too. A quote pulled from a story fails the full story’s hash, but in some cases can still stand on its own. Watermarks can help find a lost label, but C2PA warns that no one method is enough.

Content Usage Telemetry: a record of what happened next

The SPUR Coalition (Standards for Publisher Usage Rights) is a non-profit coalition of news publishers founded February 2026 – founding members include the BBC, Financial Times, Guardian Media Group, Mediahuis, Sky News, Associated Press and Telegraph Media Group. It runs an open standard called the Content Telemetry Standard (CTS), which grew out of OpenAttribution, which provides a standard vocabulary for AI content usage:

  • Retrieved: a bot fetched the content.
  • Grounded: the content contributed to the generation at time of inference.
  • Cited: the answer or created artifact named the source.
  • Presented: the original content or a link was shown or read aloud.
  • Engaged: a user interacted with the content such as with a click.

With the exception of the retrieval, these events are all reported by the AI system that uses the content. Standardised language about that reporting allows reports from multiple AI systems to be interoperable and makes it easy to build tooling to support reporting.

In the same way that defining an impression did not immediately result in every website reporting impressions, defining this shared language has served as an important starting point when working with AI systems and content repositories to ensure that we lay the groundwork for a transparent AI knowledge economy.

Attribution and Credit

CTS provides the vocabulary for systems to report back deterministic content usage events – counts of content retrieved, grounded, etc. It does not attempt to apply any kind of judgement on the contribution that a given piece of content had on the output of an AI system, however; many attribution models require an understanding of what content went into the system and how it was used in order to attribute a value to the content – often for purposes of crediting payments to the content source.

AI systems do not by default cite their sources to users (often referred to as “giving credit/attribution” – it is worth being specific about how we are using these terms!). Various regulation and license requirements have moved the main consumer answer engines in this direction, but it is not a guaranteed feature of an AI system. The intention behind CTS’s separation of grounding and citation events is to provide a view of how often a piece of content influences the inference process, regardless of whether the end user/consumer has seen a link or reference back to the source of content.

What each one proves

QuestionProvenanceContent Telemetry
Who signed or wrote this, and does it still match?Yes, if the label checks out; CAWG adds the authorNo
Did a bot fetch it?NoYour logs show some; the rest is a claim
Did the AI read it for an answer, or credit it?NoThe AI firm’s claim
Was it used to train a model?NoNo
How much did it change the answer?NoNo. It counts; it does not weigh
Was the use allowed, and what is owed?Not by default, but can be embeddedNo. That is for the contract

Neither one, alone, proves how an answer was shaped or what anyone owes.

Where the two meet

Content identifiers are inconsistent across different media and content sources. Web addresses do not deterministically point at a piece of online content the way a DOI or ISBN might in academic and publishing environments. While the CTS provides for identifiers to be passed, it does not create or mandate a system of content identification.

Say a partner site copies your story and an AI reads it there. The web address points to the partner, not you. But the provenance label on your content still names you and carries your story ID. If the AI firm reports that ID, and you have told report collectors which IDs are yours, the report comes to you.

What can a content owner do today?

  1. Add Content Provenance to your CMS. Put your own organizational identity, your license terms, and where to send reports in each label. Encypher (one author’s firm) offers this free to publisher partners, and other firms sell this. Most integrations plug in easily.
  2. Your CDN and server logs show which bots fetch your pages. That count gives you something to check AI firms’ reports against. Free, open code and how-tos are at openattribution.org (one author helps run it) or often directly through your CDN provider.
  3. Write reporting and audit rights into every AI deal. Make sure to say it in machine-readable form. Your labels can ask for reports. An RSL license can require them. IAB CoMP can tell AI systems where to send them. robots.txt and Cloudflare’s content signals can say what AI may do with your pages. SPUR can give members model contract terms and support. Some vendors set up several of these in one integration.

Why it matters

When a person reads your story, you can see it. When an AI reads it, you mostly can’t. Who Gets Paid When an AI Reads Your Page? found that payment pools give no receipt for each read. Reports fill that gap with a record of each use, and your label helps each record find its way back to you.

Credit, payment and disclosure rest on the same proof. What each use is worth is still yours to decide in a contract. But now, that contract has something to count, in terms every AI firm can share.

Start Today

Mark your content now, so your license and your terms travel with every copy. Then make usage reports part of every AI deal you sign. Before you sign, ask:

“Which events do you report? Every time? Where do they go? Will you follow the terms and report requests in my labels? Will you put it all in the contract?”

Your work already powers AI answers. Now you can start to see how.

Sources

Standards and specifications

Explainers from Encypher (a co-author’s company)

Reporting

Further reading for publishers

Prebid LLM Taskforce publisher series: “Who Gets Paid When an AI Reads Your Page?”

SPUR Coalition, Shared standards for content usage reporting, 12 June 2026 (describes the draft for comment; v1.0 renamed “displayed” to “presented”)

Press Gazette, SPUR publishes ‘common language’ for tracking AI use of publisher content, 12 June 2026 (describes the draft for comment)

Content Telemetry, standard home page

COUNTER Metrics, Updates on our Generative and Agentic AI Best Practice (phase 2), 18 September 2026 (plans to reference SPUR telemetry; COUNTER notes this is not an endorsement)

BBC, New technology to show why images and video are genuine launches on BBC News, 4 March 2024

Category: Tag:

Reader Interactions

Leave a Reply