TL;DR

Images generated with AI help in Windows Paint and Photos carry an invisible 16-byte identifier issued by Microsoft’s servers and tied to the prompt that produced them, according to analysis by Vector 35 developer Xusheng Li. The prompt goes to Microsoft’s moderation layer first; what returns is the identifier, which then gets encoded into the pixels. Consecutive requests are deliberately chained together.

Transparency that also fingerprints

The EU’s transparency code for AI-generated content obliges signatories to mark such material machine-readably and indicate whether AI created or altered it. It does not prescribe how. Microsoft, a founder of the C2PA provenance coalition, went further than the floor requires and attached a globally unique identifier linked to the originating prompt.

The chaining is the detail that changes the character of the thing. Li found that Paint sends the previous generation’s identifier along with the next moderation request, so a sequence of images can be tied together explicitly rather than inferred. If Microsoft records which account sent which prompt — and moderation implies it does — then an image on its own becomes enough to point back at the person who made it.

This invisible marker is separate from the visible watermark Microsoft offers as a user-facing option in Paint and Microsoft 365. Li’s complaint is not that the safety measures went undisclosed but that the C2PA manifest containing a prompt-linked identifier was never made adequately clear. Microsoft offered no immediate comment.

The precedent nobody enjoyed the first time

Printer manufacturers spent years encoding tracking dots into colour output, and the discovery did not go well for them. The pattern is identical: a mechanism justified on abuse-prevention grounds that also, quietly, identifies the individual. Rivals are moving the same way — Meta is developing something called Content Seal, and OpenAI applies DeepMind’s SynthID alongside C2PA data.

Looking forward

For UK organisations this is a data protection question wearing a compliance badge. An identifier that links an image to an account is personal data under UK GDPR, which brings lawful basis, transparency obligations and subject access rights into play — and the ICO would recognise all three. Any business generating images through hosted tools for client or public use should establish what is embedded before publication. Running open-weight models locally remains the reliable way to avoid the marker entirely.