The Invisible Tether: Microsoft's AI Watermarks are User Tracking IDs
AI-generated image · US National Wire
Under the guise of EU transparency and AI safety, Microsoft is embedding unique identifiers into images that could tie every creation back to a specific user.
Microsoft likes to talk about AI safety and transparency, but for those of us who actually look at the telemetry, the reality is far more invasive. While the company frames its watermarking efforts as a commitment to the EU's Code of Practice on Transparency of AI-generated Content, the technical implementation suggests a system designed for surveillance, not just safety, as The Register first reported.
According to reporting from The Register, Microsoft has been embedding invisible watermarks into images generated via AI in its Windows Paint and Photos applications. While the EU rules require machine-readable markers to indicate if content was AI-generated or manipulated, Microsoft has gone beyond these minimums. As a founder of the Coalition for Content Provenance and Authenticity (C2PA), Microsoft embeds a globally unique identifier (GUID) into these images.
**Opinion: This isn't about transparency; it's about ownership and traceability.**
The underlying mechanism was recently revealed by Xusheng Li, a software developer at Vector 35. In a LinkedIn post analyzed by The Register, Li explains that when a user enters a prompt, it is sent to Microsoft for moderation. Microsoft then returns a server-issued GUID—a 16-byte integer—which is encoded directly into the pixels of the locally generated image.
The danger here is the link between the prompt and the person. Li notes that if Microsoft associates each prompt with the user who sent it, the company can theoretically identify the specific user by referencing the watermark in any image. Furthermore, the system is designed for continuity: Paint sends the previous promptGenerationId as a lastPromptGenerationId with subsequent moderation requests, allowing Microsoft to explicitly link successive requests.
Microsoft previously disclosed this approach in its Paint and Photos documentation, but as Li argues, the company failed to clarify that the C2PA manifest contains a GUID linked to user prompts. This is a classic defender's nightmare: a feature marketed as a safety measure that doubles as a permanent, invisible tracking number. It mirrors the old alarm bells raised when laser printer manufacturers implemented similar tracking methods years ago.
Microsoft has not responded to requests for comment from The Register. Meanwhile, other industry giants are pursuing similar paths; Meta is developing "Content Seal," and OpenAI is utilizing C2PA metadata and Google DeepMind's SynthID. For anyone who values actual privacy over marketing veneers, the only solution is to ditch the hosted services. As Li suggests, the path to anonymity lies in running open-source tools and open weight models, such as Stable Diffusion, directly on-device.