Open the developer tools on a surprising number of paid course sites, click the Network tab, and press play. You'll see a request for an .mp4 file at a storage URL. Paste that URL into a private browser window with no login, and the full video downloads.
The site's player has no download button. That's the entire protection.
The short answer: hiding the download control is cosmetic. If the file's URL works for anyone, your videos are public. Real access control (signed, expiring URLs at a minimum) is better security, and it's also what gives you a claim under the anti-circumvention law.
What "no download" actually does
The HTML attribute controlsList="nodownload" removes a menu item from the browser's built-in player. Disabling right-click hides another menu. Neither changes what the server will send.
If the video is at a fixed, unauthenticated address, such as a public object in a cloud storage bucket, then:
- anyone who has the link can fetch the file without logging in
- the link can be shared, posted, or indexed
- a short script can walk the library and download all of it
- canceling a subscription doesn't end access
The server decides who gets the file. The page that embeds it doesn't.
What § 1201 prohibits
The Digital Millennium Copyright Act added 17 U.S.C. § 1201, which does two things relevant here:
- It bars circumvention of access controls. "No person shall circumvent a technological measure that effectively controls access to a work protected under this title." § 1201(a)(1)(A).
- It bars trafficking in circumvention tools, for both access controls and copy controls. § 1201(a)(2), (b).
A violation carries its own remedies, separate from infringement: actual damages or statutory damages of $200 to $2,500 per act of circumvention, plus possible attorney's fees. 17 U.S.C. § 1203.
The claim has a threshold. There has to be a technological measure, and it has to "effectively control access." The statute defines that: a measure qualifies if, "in the ordinary course of its operation," it "requires the application of information, or a process or a treatment, with the authority of the copyright owner, to gain access to the work." § 1201(a)(3)(B).
Weak measures can qualify
"Effectively" doesn't mean "unbreakably." In Universal City Studios, Inc. v. Reimerdes, 111 F. Supp. 2d 294 (S.D.N.Y. 2000), the defendants argued that the encryption on DVDs was too weak to count. The court rejected that. A measure that requires a key or a process in its ordinary operation is covered, even if a determined programmer can defeat it. Otherwise the statute would protect only measures that never need protecting.
Missing measures don't
In Lexmark International, Inc. v. Static Control Components, Inc., 387 F.3d 522 (6th Cir. 2004), a printer maker argued that an authentication sequence controlled access to the software on its printers. The Sixth Circuit disagreed, because the program code could be read directly from the printer's memory without going through the authentication at all. The court's analogy: nobody would say a lock on the back door "controls access" to a house whose front door has no lock.
A video at an open URL is that house. The login page is the locked back door, and the storage link is the open front door. A person who downloads the file through the open link hasn't applied any information or process to get it. A § 1201 claim on those facts is weak.
The person may still infringe your copyright by copying or redistributing the video, and may breach your terms of service. But you've given up the claim built for this situation, along with its per-act statutory damages.
The circuit split to know about
Courts disagree on whether a § 1201 access-control claim requires a link to copyright infringement.
- The Federal Circuit requires one. Circumvention has to bear a reasonable relationship to the protections the Copyright Act gives owners. Chamberlain Group, Inc. v. Skylink Technologies, Inc., 381 F.3d 1178 (Fed. Cir. 2004).
- The Ninth Circuit doesn't. It reads § 1201(a) as creating a distinct right against circumvention, whether or not infringement follows. MDY Industries, LLC v. Blizzard Entertainment, Inc., 629 F.3d 928 (9th Cir. 2010).
For a video library the split rarely matters, because a person who defeats an access control to take a paid video is usually infringing as well.
Building a measure that counts
In rough order of cost and strength:
- Make the storage private. Turn off public access on the bucket or container. Nothing should be reachable by a bare URL.
- Serve through signed, expiring URLs or signed cookies. The application checks the user's session and entitlement, then issues a link valid for minutes. The signature is "information" applied "with the authority of the copyright owner," which is the statute's language.
- Stream in segments. HLS or DASH delivers short chunks from a playlist. It also lets you serve several bitrates, so users aren't pulling a multi-gigabyte master.
- Encrypt the segments. AES-128 HLS with keys served only to authenticated sessions is a modest step up.
- Use real DRM for high-value content. Widevine, FairPlay, and PlayReady tie decryption to a license server and the device. Most commercial video platforms offer this as a setting.
- Watermark per user. A visible or forensic watermark carrying the account ID doesn't prevent copying. It tells you who leaked, and removing it can violate a different statute. See Watermarks, credits, and metadata.
- Log and rate-limit. One account requesting every video in an hour is a scraper.
No measure stops screen recording. The goal is to prevent casual and bulk copying, to identify leaks, and to preserve your legal claims.
Match the paper to the system
- Terms of service: prohibit downloading, recording, sharing credentials, scraping, and circumventing access controls. Make sure users actually agree to them. See Website terms of service and online contract formation.
- Registration: register the videos so infringement claims carry statutory damages. See Copyright registration of videos and online courses.
- Publication status: a library that can't be downloaded, on a site whose terms forbid copying, is easier to treat as unpublished for registration purposes. See Is streaming "publication"?
A five-minute self-test
- Log in and play a video with the browser's Network tab open.
- Copy the media request URL.
- Open a private window, don't log in, and paste the URL.
- If the video plays or downloads, your library is public.
- Wait an hour and try the URL again while logged out. If it still works, your links don't expire.
Practical takeaways
- A hidden download button protects nothing. Access control happens at the server.
- Section 1201 protects measures that require a key, token, or process. An open URL has none.
- Signed, expiring URLs are the minimum. Add segmented streaming, encryption, and watermarks as the content's value justifies.
- Back the system with terms of service and registrations.
I read network traces as comfortably as case law. If you'd like a legal and technical review of how your content is delivered, I can help.
Primary authority
- 17 U.S.C. § 1201; § 1203.
- Universal City Studios, Inc. v. Reimerdes, 111 F. Supp. 2d 294 (S.D.N.Y. 2000).
- Lexmark International, Inc. v. Static Control Components, Inc., 387 F.3d 522 (6th Cir. 2004).
- Chamberlain Group, Inc. v. Skylink Technologies, Inc., 381 F.3d 1178 (Fed. Cir. 2004).
- MDY Industries, LLC v. Blizzard Entertainment, Inc., 629 F.3d 928 (9th Cir. 2010).
Related resources
- The DMCA anti-circumvention provisions
- Data scraping after hiQ v. LinkedIn
- The Computer Fraud and Abuse Act after Van Buren
- How to protect an online course or membership site from copying
This article provides general information and is not legal advice. Copyright Office practices and fees change, and the law varies by circuit; confirm current requirements at copyright.gov and consult qualified counsel about your situation.
