Microsoft AI Images can Carry Your Personal ID Tag

Every image you make with Microsoft’s AI tools can carry a hidden code that can point straight back to you personally. Not a visible logo you can crop off, but a unique ID stitched into the pixels themselves and repeated in the file’s Content Credentials. It happens in Paint, in Photos and almost certainly in Copilot across Microsoft 365. It happens even when Microsoft tells you the image was generated locally on your own PC. If you share AI images anonymously, hand them to clients or post them anywhere you would rather not be identified, here is what is in the file and what you can do about it before you hit send.

An AI ‘watermark’ is an invisible identifier baked into the image file which allows others to tell an AI ‘fake’ from a real photo.  That’s happening now because of the European Union AI Act which companies are complying with globally.

However, what Microsoft is doing goes beyond a legally compliant ‘watermark’ by adding a way for an image to be traced back to an individual user.

A developer at Vector 35 pulled apart the Paint app and published his analysis last week. His report applied to the AI features in Microsoft Paint or Microsoft Photos. The same or similar presumably applies to Microsoft 365 apps and other services.

That identifier is issued by a Microsoft server after your prompt has been sent to Microsoft for checking.  That even applies to images supposedly made locally on the AI enabled computer.

It’s a per image and per user tracking tag. Not a logo you can see and crop off, but a 16 byte GUID (Globally Unique Identifier, the long string of hex characters Windows uses to label things) woven into the image data itself.

Inside Paint’s hidden watermark file

Inside Paint’s install folder sits a file called Watermarker.dll. It handles the visible Copilot logo that Paint can stamp in the corner, which is documented and optional. It also contains a second function, WmkWriteWatermark, that is neither.

Here is the sequence when you generate an image:

• Your prompt and chosen style are sent to a Microsoft moderation server before any image exists.
• The server sends back a cleaned up prompt plus two GUIDs: a promptGenerationId and a watermarkId.
• The image is generated, then the watermarkId is encoded into the pixels.
• The same watermarkId is also written into the C2PA Content Credentials attached to the saved file.

The pixel changes are not subtle. On a test 512 by 512 image, over 70% of the pixels changed when the watermark was applied (193,376 of 262,144 pixels). You will not see the difference, but it is there.

Content Credentials aka C2PA

Also in the Copilot made image is C2PA information (Coalition for Content Provenance and Authenticity). You’ve probably seen this called “Content Credentials”.

C2PA is in many images (not just AI) with details of when and how the image was made plus any later edits.  The info is digitally signed so any unauthorized changes to the image can be detected.

This metadata doesn’t have user traceable info and is separate from any unique identifier added by Microsoft.

“Generated locally” does not mean offline

If you have a Copilot+ PC, Microsoft markets Paint’s Cocreator as running on your device’s NPU. That is true for the image generation itself but not for the whole operation.

The prompt still goes to Microsoft. The user traceable ID comes back from Microsoft. The finished image still gets sent up for provenance signing. That’s why Cocreator requires a Microsoft account and an internet connection even for supposedly ‘local AI’ jobs.

Paint also sends the previous promptGenerationId along with your next request, which means consecutive prompts in a session are explicitly linked to each other on Microsoft’s side.

What this means for you

Assume every AI made image has at least some hidden indicators that it was made with Artificial Intelligence.  Quite possibly also a unique ID that traces the image back to you.

The analysis applies to Windows Paint and Photos apps but likely does (or will) apply to all of Microsoft’s AI services including Copilot within Microsoft 365 apps.

A Microsoft AI made image can, in principle, be matched to your account.

For most people making a birthday card illustration, this is a shrug. But it can matter in some specific situations:

• Sharing AI images anonymously. Posting an AI generated image to a forum, a news tip line, or a pseudonymous social account is not anonymous in the way you might assume.
• Client and commercial work. If you generate a background or texture and hand it over, the identifier travels with the file.
• Anything sensitive or political. Agencies could trace the AI made image or poster back to a specific person.

Microsoft’s own support page says it collects user and device identifiers along with prompts for abuse prevention. But it does not fully disclose that those identifiers do more than mark AI made work.

How to remove Microsoft’s tracking code (and what survives)

The easiest way to remove the C2PA and Microsoft’s identifier is to take a screenshot then save that instead of the original. This doesn’t remove the pixel level watermarking but might mess it up a little.

Other options are:

• Convert to BMP and the file level data goes.
• Use a different tool if you want AI images without a Microsoft issued identifier. Local Stable Diffusion installs have no moderation call and no watermark step.

Do not rely on cropping or resizing to defeat the pixel mark. It was built to survive ordinary editing.

The EU rules do not require this

Article 50 of the EU AI Act took effect on August 2, 2026. It requires AI generated content to carry a detectable, machine-readable mark. It does not require a prompt and user specific GUID tied to your account.

Microsoft has gone further than the rules demand. It appears the company has taken advantage of the EU law to add more user tracking into their AI services.

What it has not done is explain that decision clearly. Their Image Creator support page mentions content filtering and says images will contain a C2PA manifest. Nowhere does it say that the manifest carries a unique identifier which is also encoded into the pixels, or that this identifier is handed out by the same server that moderates your prompt.

“Content Credentials” is a technically accurate name that hides what is actually happening. Microsoft should document this properly and give users a clear statement about how long prompt to GUID mappings are retained and who can query them. Until it does, treat every AI image out of Paint and Photos as signed with your name in invisible ink.

More on What Microsoft’s AI Knows About You

If you are going to keep generating pictures, it is worth knowing which engine you are actually feeding your prompt to. We ran the same prompts through each option in PowerPoint AI Images Tested: Which Copilot Model Actually Works, and the differences are larger than Microsoft’s marketing suggests. The companion guide PowerPoint AI Image Models in Copilot: Which One to Choose explains what each model is good at, and Copilot Model Choices Explained: Which One to Pick and Why covers the same decision for text.

The Same Tracking Question in Other Places

Hidden identifiers in image files are not new, they are just newly deliberate. Office documents have been leaking GPS coordinates and camera details from inserted photos for over a decade, as we showed in Image privacy breach still in Microsoft Office, and Microsoft’s own cleanup tool misses plenty of it, which we tested in Secrets left in docs after Document Inspector in Office. Read either one before you email a file you assumed was clean.

Where Your AI Images End Up

The watermark is only half the story. Your Copilot creations are also being moved somewhere new, and it costs you space, as we explain in Microsoft’s Copilot Merge Eats Your OneDrive Space and Cuts Features.

Prompts are only one of the ways an AI tool can embarrass you later. 9 AI Mistakes to Avoid in Copilot, ChatGPT and Gemini covers the habits worth breaking now, and if you keep anything genuinely private on your PC, Don’t be a Fauci: how to keep a private diary, private is a practical starting point. For the screenshot trick mentioned above, How to take screenshots on Windows, Mac, iPhone and Android has the shortcuts for every device.