DRM explained: how Widevine, PlayReady and FairPlay protect streams

If you've wondered why a streaming service plays in 4K on your TV but only in HD in a desktop browser, or why a screen recording of a film shows a black rectangle, the answer is usually DRM: digital rights management. DRM is the system of encryption and licensing that commercial streaming services use to make sure only authorized devices and apps can play their content.

The basic flow

Most streaming DRM systems work the same way:

1. The video is encrypted once, during packaging, using content keys. Packaging formats are covered in HLS vs MPEG-DASH.
2. The player requests a license. When you press play, the app asks the service's license server for permission, sending information about the device and your account.
3. The license server checks entitlement: are you subscribed, is the title available in your region, is this device allowed to play this quality?
4. A license is returned with the decryption key and rules, such as maximum resolution, whether external displays are allowed and how long the license lasts.
5. The content decryption module (CDM) on the device decrypts and decodes the video, ideally inside protected hardware so the decrypted frames never reach ordinary software.

What a license actually contains

A DRM license is more than a key. It typically includes rules such as:

• Output restrictions: for example, whether video may be sent over HDMI without HDCP, or which HDCP version is required for 4K
• Duration: how long the license is valid, which matters for rentals and offline downloads
• Resolution limits: tied to the device's security level
• Persistence: whether the license can be stored for offline viewing

That's how a rental can expire 48 hours after you start watching, or how downloads can stop playing if you don't reconnect for a while.

The three major systems

Google Widevine

Widevine is built into Android, Chrome, Chromium-based browsers, Android TV and Google TV, and many smart TVs and set-top boxes. It defines security levels:

• L1: decryption and decoding happen inside a hardware trusted execution environment. Services generally require L1 for HD and 4K.
• L3: software-only protection. Often limited to SD or lower HD by service policy.

Microsoft PlayReady

PlayReady is used on Windows, Xbox and many smart TVs and operator set-top boxes. Its hardware-backed security level (SL3000) is typically required for premium 4K content.

Apple FairPlay Streaming

FairPlay Streaming protects HLS content on iPhone, iPad, Mac, Apple TV and Safari.

Hardware security and trusted execution

The strongest protection comes from trusted execution environments (TEEs), isolated parts of a device's processor where keys and decrypted video are handled away from the main operating system. With this approach, even if the main system were compromised, the decrypted frames wouldn't be exposed to it. Services require this level of protection for their highest-quality streams because it's much harder to defeat than software-only protection.

One file, many DRMs: CENC

Encrypting a separate copy of every title for each DRM would be wasteful. Common Encryption (CENC) standardizes how content is encrypted so the same files can carry license information for several DRM systems. Using the cbcs encryption mode with CMAF segments, a service can increasingly serve one set of encrypted files to Widevine, PlayReady and FairPlay devices alike.

DRM in the browser: EME

Web browsers expose DRM to streaming websites through the W3C's Encrypted Media Extensions (EME). The website's player handles the interface and requests, while a CDM supplied by the browser or operating system does the decryption. Browser CDMs often use software protection, which is why many services cap browser playback resolution.

DRM and IPTV operators

Pay-TV and IPTV operators use the same building blocks as streaming services, often with additional systems. Traditional cable and satellite TV used conditional access (CA) systems, with smart cards or embedded keys in set-top boxes. As operators move to IP delivery and apps, many now combine conditional access on their boxes with standard DRM in their apps, so the same channel can be protected on a set-top box and a phone.

Channel owners usually require licensed distributors to protect content in specific ways as a condition of carriage. That's one reason legitimate live TV services generally require their own apps rather than letting you play channels in any player.

Why DRM affects what you see

• Resolution caps. A device with lower security certification may be limited to SD or HD.
• HDCP requirements. Licenses can require HDCP, copy protection on the HDMI link. A non-compliant HDMI splitter, capture device or old receiver in the chain can cause a black screen or an error.
• Black screenshots and screen recordings. Protected video is often blanked on purpose.
• Rooted or modified devices. Devices that fail integrity checks may lose L1 status and drop to lower quality.

DRM vs HDCP: two different protections

People often confuse the two:

A black screen with working sound almost always points to HDCP or display output, not the streaming service's DRM.

Troubleshooting DRM errors

If a legitimate app shows a license or playback error:

1. Update the app and device firmware. DRM components are updated regularly.
2. Connect the streaming device directly to the TV to rule out HDCP problems with soundbars, receivers or splitters.
3. Check the device's certification if you're using an uncertified Android box. Many have only software DRM. See our streaming device buying guide.
4. Clear the app's data or reinstall it to reset stored licenses.

See also our guide to fixing streaming apps that crash on smart TVs.

The debate around DRM

DRM is controversial. Supporters say it enables services to license premium content in the first place, because rights holders won't release films and live sport without protection. Critics argue that it complicates life for paying customers, can lock purchases to particular platforms, and does little against determined pirates who capture and redistribute streams anyway. Both points have merit. For viewers, the practical lesson is to understand the limits DRM places on devices and purchases, and to choose devices with good certification for the services you use.

Downloads and offline viewing

Downloads for offline viewing rely on persistent licenses: licenses stored on the device that allow playback without an internet connection for a limited time. Services set rules such as:

• A maximum number of downloaded titles at once
• A maximum number of devices that can hold downloads
• An expiry period, after which you need to reconnect
• A shorter playback window once you start watching a downloaded rental

If downloads stop playing unexpectedly, reconnecting to the internet and opening the app usually renews the licenses. Deleting and re-downloading the title is the next step.

Questions people ask

Why can't I take a screenshot of a streaming app?

Protected video is usually blocked from screenshots and screen recordings by the operating system's DRM features. The screenshot shows a black area where the video was. This is intended behaviour.

Why does a service play only in HD on my computer?

Browsers and computers may not meet the hardware security level a service requires for 4K. Using the service's own app on a supported device, or a supported browser on a supported computer, often unlocks higher resolutions. Check the service's help pages for requirements.

Does DRM affect picture quality directly?

No. DRM encrypts the video. It doesn't reduce its quality. The quality limits come from the license rules the service applies to devices with lower security levels.

Can I play DRM-protected streams in VLC or other players?

Generally not. Commercial DRM requires certified players. See our VLC guide for what general-purpose players can play.

What happens to my purchases if a service shuts down?

That depends on the service's terms. Because DRM ties purchases to a service's licensing system, access may end if the service closes, unless purchases are transferred to another platform. Check terms before buying expensive digital libraries.

Glossary

Key takeaways

• DRM encrypts video and issues licenses that control playback on authorized devices.
• Widevine, PlayReady and FairPlay cover almost all devices; CENC lets one encrypted file serve them all.
• Hardware-backed security levels unlock HD and 4K on many services.
• Black screens with sound usually mean HDCP problems, not DRM.
• Downloads use time-limited licenses that renew when you reconnect.

DRM and broadcast TV

DRM is also arriving in broadcasting. In the US, some ATSC 3.0 broadcasts are encrypted, which has been controversial for owners of network tuners and DVR software. See our coverage of the FCC's NextGen TV proposal.

Sources and further reading

• Google Widevine
• Microsoft PlayReady documentation
• Apple FairPlay Streaming
• W3C Encrypted Media Extensions