By ByteBot
California’s AI Transparency Act (SB 942) became enforceable on August 2, 2026 — and Midjourney, one of the world’s most-used AI image generators, ships no compliant watermark. Under the law, any generative AI system with over one million monthly California users must embed machine-readable provenance data in every AI-generated image, video, and audio file, or face $5,000-per-day fines, with each day of non-compliance counted as a separate, discrete violation. For a mid-sized tool running a month behind on compliance, that math reaches $150,000 before a single lawsuit is filed.
The obligation targets the creator of the AI system — not the API vendor, not the company integrating it downstream. If you built the generator, this law is for you.
Three Obligations, and the SB 942 Compliance Scoreboard
SB 942 imposes three parallel requirements on covered providers. First, every AI-generated or substantially altered image, video, or audio file must carry embedded latent provenance data — machine-readable metadata that is “permanent or extraordinarily difficult to remove.” Second, providers must maintain a free, public AI detection tool that accepts uploads or URLs, returns provenance results, and cannot retain submitted files or collect personal information. Third, providers must give users the option to add a visible “AI-generated” label to their outputs.
The compliance scoreboard as of August 2 shows a clear divide. Adobe Firefly has embedded C2PA credentials since its 2023 launch. OpenAI’s DALL-E 3 and Sora both carry signed C2PA manifests in the JUMBF container format. Google Imagen uses a dual approach — C2PA credentials plus SynthID invisible watermarking — making stripping significantly harder. Midjourney has none of this: no C2PA credentials, no pixel watermark, no detection tool. According to C2PA Viewer’s tool compliance tracker, Midjourney remains the highest-profile non-compliant generator as enforcement begins. Open-source Stable Diffusion interfaces — ComfyUI, Automatic1111, InvokeAI — also lack default credential embedding, putting any hosted deployment above the threshold at immediate risk.
What Developers Must Actually Build for C2PA Compliance
The embedded provenance data must include, at minimum: the provider’s name, the AI system’s name and version, a creation timestamp, and a unique identifier linking the output back to the generating system. The C2PA specification — now at v2.3 — is the implicit technical standard the law points to without naming it explicitly. Fortunately, open-source SDKs handle the heavy lifting. The c2pa-python library, published by the Content Authenticity Initiative, provides Python bindings for the underlying Rust library:
import c2pa
manifest = c2pa.ManifestDefinition(
claim_generator="MyAISystem/1.0.0",
assertions=[c2pa.AssertionDefinition(
label="c2pa.ai.generative",
data={"model": "my-diffusion-model-v2"}
)]
)
builder = c2pa.Builder(manifest)
builder.sign(signing_key, output_path)
The detection tool obligation is separate and frequently overlooked. It cannot require account creation, cannot charge for access, and must respond to both file uploads and URLs. Teams that have only budgeted for manifest embedding need to add the detection endpoint to the roadmap immediately. The detection tool can call your existing verification logic — it does not need to be built from scratch — but it must be publicly accessible without a login. However, that still requires engineering time, a public endpoint, and ongoing maintenance.
One practical caveat: C2PA manifests embedded as metadata can be stripped by image editing tools and social platforms. C2PA 2.1’s soft binding — imperceptible pixel watermarks that survive social media compression — addresses this, but applying it correctly requires more than an SDK call. Teams shipping images to social channels should treat soft binding as mandatory, not optional.
Related: Paperclip AI CVSS 10 Flaw Lets Attackers Run Host Commands
The Threshold Is Smaller Than You Think, the Scope Narrower Than You Fear
One million monthly California users sounds like a major-platform threshold. It is not. California has 40 million residents, and a mid-tier AI image tool with modest national traction easily clears one million state users — especially with a free tier. There is, however, real relief in the law’s scope: SB 942 covers images, video, and audio only. AI-generated text is explicitly excluded. ChatGPT responses, GitHub Copilot code suggestions, and standard LLM outputs are not in scope. Developers building LLM-only products can stand down — but anyone shipping image generation, video synthesis, or voice cloning features cannot.
The law also covers platform aggregators, though on a later timeline: large online platforms such as YouTube, Instagram, and X must detect and display compliant provenance data by January 1, 2027. That deadline creates downstream pressure — if your system is not embedding valid C2PA credentials now, those platforms will have nothing to display when their own obligation hits. Your content will look unverified to users even if the platform is doing its job. According to the AI Compliance Atlas SB 942 reference, covered-provider duties commenced immediately on August 2 with no grace period.
California and the EU Hit the Same Day — Different Enforcers
SB 942’s August 2 operative date was intentionally aligned with EU AI Act Article 50’s provenance obligations, which also went live that day. The EU law applies to synthetic media reaching EU users; California’s applies to users in California. The C2PA implementation largely satisfies both — same manifest format, same signing approach. However, the legal audits are entirely separate. Moreover, the liable parties are not always the same team: as Cooley’s August 3 legal guidance notes, EU Article 50 targets deployers; California’s SB 942 targets system creators. A team that cleared EU compliance in July and did nothing about California is exposed — and California’s enforcement comes from state AG, city attorneys, and county counsels with fee-shifting attorney fees, not a slow-moving federal agency.
Key Takeaways
- SB 942 is live as of August 2, 2026: $5,000-per-day fines are accruing now for non-compliant AI image, video, and audio systems with California users
- The obligation falls on the system’s creator, not the API user or downstream integrator — your model vendor’s compliance does not cover you
- Three requirements: embed C2PA provenance metadata, maintain a free public detection tool, offer visible AI labels — Midjourney currently meets none of them
- Text is excluded; image, video, and audio are not — LLM-only products are safe, but any media generation feature triggers SB 942
- C2PA satisfies both California and EU obligations technically, but California’s fines compound daily and are enforced locally — they do not wait for federal action
