Home › Articles

Watermarks and AI training: what they actually do, and what they don't

Photographers ask us some version of this constantly, so here's the straight answer.

No. A visible watermark does not stop AI training.

Not partially, not mostly. If your image is reachable, a scraper takes it, watermark and all.

Three reasons, all of them well established:

Scrapers don't check. A crawler collecting images doesn't examine each one for a copyright mark and skip it. It fetches URLs. Your watermark is just some pixels in the file it downloaded.

Watermarks come off. Modern inpainting removes a corner logo in seconds and does a convincing job. Anyone with a phone can do it. This has been true for years and it gets easier every year.

Watermarks in training data are a known nuisance, not a defence. Early image models occasionally produced watermark-like smears because so much training data was watermarked stock photography. The industry response was better filtering and better cleanup, not respecting the mark. If anything, it made models better at recognising and ignoring watermarks.

Anyone selling you watermarking software as AI protection is either confused or lying. We sell watermarking software, and we're telling you it isn't that.

So what are watermarks for?

They still do three real jobs, and they do them well.

Attribution. Someone sees your photograph on a reposted feed and can tell whose it is. Most image reuse isn't malicious, it's someone who found a nice picture. A visible mark turns a lot of that into credit, and some of it into paid licensing.

Friction. A tiled or embossed watermark makes casual lifting more trouble than it's worth. It won't stop someone determined. It doesn't need to — it stops the person who was only going to bother if it was easy, and that's most of them.

Evidence. In a dispute, an image that was published watermarked and reappeared with the watermark removed is a much stronger position than one that was never marked. Removal is a deliberate act, and it looks like one.

What watermarks don't do is control what a machine does with the file. For that you need something a machine reads.

The part machines actually read: metadata

There's a real, standardised mechanism for declaring that your images may not be used for AI training. It just isn't visible.

The IPTC Photo Metadata Standard added a Data Mining property in version 2023.1 (October 2023), stored in XMP as plus:DataMining, developed jointly with PLUS. It lets a rightsholder state, inside the file, whether the image may be used as training data — with values covering prohibited use, permission required, and various allowances.

Alongside it, the rest of your rights metadata does real work:

IPTC:CopyrightNotice        © 2026 Your Name. All rights reserved.
IPTC:By-line Your Name
IPTC:Credit Your Studio
IPTC:Contact you@example.com
XMP-dc:Rights               © 2026 Your Name
XMP-dc:Creator Your Name
XMP-xmpRights:UsageTerms No AI/ML training use. Licensing: example.com/licensing
XMP-xmpRights:Marked True
XMP-plus:DataMining Prohibited
EXIF:Copyright              © 2026 Your Name
EXIF:Artist Your Name

Two properties make this worth doing.

It travels with the file. IPTC's own argument for embedded opt-out is precisely this: the preference moves with the image when it's syndicated, republished or passed to a customer. A site-level rule doesn't.

It's per-image. robots.txt blocks a crawler at the site or directory level and can't express a reservation attached to an individual work. Standards work in that area has been slow — a finalised RFC wasn't expected before late 2026. Embedded metadata already exists and already ships inside your file.

Being honest about the limits

Embedded metadata is a declaration, not a lock.

• A scraper can ignore it. Some will.
• A scraper can strip it. Many pipelines do, incidentally, by re-encoding.
• Enforcement depends on jurisdiction. The EU's text-and-data-mining exception in the DSM Directive gives rightsholders a reservation mechanism with actual legal weight; elsewhere the position is murkier and still being litigated.

So it isn't protection in the sense of prevention. It's protection in the sense a "no trespassing" sign is: it doesn't stop anyone physically, but it removes "we didn't know" from their available defences, and in some jurisdictions that's the whole game.

Layered, it looks like this:

That last row is not a joke. It's the only entry in the column that reads yes.

The thing that undermines all of it

Here's the practical failure, and it's why we wrote this.

You fill in your IPTC copyright and your data-mining reservation carefully in Lightroom. Then you run the images through a watermarking tool before publishing — and the tool re-encodes them and drops the metadata.

You've now published images with the visible half of your claim and none of the machine-readable half. The watermark comes off in seconds. Underneath it is a file that says nothing about who made it or what may be done with it.

That's a worse position than doing nothing, because it feels protected.

Test whatever tool you use. Take a file with your rights fields populated, watermark it, and check the output:

exiftool -a -G1 -s watermarked.jpg | findstr /i "copyright creator rights datamining by-line"

If those lines are missing, your tool is deleting your copyright claim. Many do.

Where we come in, precisely

TSR Watermark Image preserves EXIF, XMP and IPTC through the batch on every paid edition. Because plus:DataMining lives in XMP, your data-mining reservation survives watermarking along with your copyright notice, creator field and usage terms. Share editions and above additionally carry GPS, ID3 and several hundred further tag groups — the full list is published rather than summarised.

To be exact about what that is and isn't:

• We do not set the Data Mining property for you. Set it in your cataloguing software (Lightroom, Photo Mechanic, exiftool) or at ingest.
• We do not protect your images from AI training. Nothing does.
• We do make sure that watermarking your images isn't the step that quietly destroys the rights information you took the trouble to add.

That's a narrow claim. It's also a real one, and it's the one we can stand behind.

What we'd actually recommend

1. Populate your rights metadata at ingest, as a preset, so it's on every file automatically. Include plus:DataMining if you want to reserve training rights.
2. Watermark visibly for attribution and friction — tiled or embossed resists casual removal better than a corner logo.
3. Verify your pipeline with exiftool on a real output file. Once. Then you know.
4. Set site-level rules too — robots.txt, AI crawler blocks. Belt and braces.
5. Publish at sensible resolution. A 1,600px web export is worth much less to a scraper than a 45-megapixel original, and it's the single most effective thing on this list after not publishing at all.
6. Keep your originals. In any dispute, the unmarked full-resolution file with intact capture metadata is the strongest evidence you own.

Download the free version → · See the full list of metadata we preserve →

Sources: IPTC guidance on generative AI opt-out and the IPTC/PLUS Data Mining property. Standards and case law in this area are moving; checked August 2026. Nothing here is legal advice.

← Back to all articles