Digital Rights Management is the technical foundation that makes professional video streaming possible. Without DRM, anyone can download, copy, and redistribute your content freely. This is not just a technical risk - it is a business risk that can undermine your entire platform's value proposition.
At Shapp, we have implemented DRM solutions for streaming platforms across the Nordic region. This article gives you a practical understanding of how DRM works, which systems are required, and how to build comprehensive content protection.
Why DRM is not optional
If you plan to distribute licensed content - film, television, sport, music - DRM is a requirement, not a choice. Rights holders set explicit requirements for which DRM systems must be used and what security level is required before they will license their content to your platform.
But DRM is not only about satisfying licensors. It protects your business model. If users can download content without restrictions, the incentive to pay for a subscription disappears. Every leaked title that spreads freely on the internet erodes the value of your platform.
As we described in our guide to building streaming platforms, DRM is one of the components that must be included from day one - not added after the fact.
The three DRM systems
There are three dominant DRM systems, and a production-ready streaming platform must support all three.
Google Widevine
Widevine is the most widely deployed DRM system and covers Android devices, the Chrome browser, Chromecast, and most smart TV platforms (Samsung Tizen, LG webOS, Android TV). Widevine offers three security levels:
- L1: hardware-based decryption and rendering. Required for HD and 4K content. Keys and decryption are handled in the device's Trusted Execution Environment (TEE).
- L2: hardware-based decryption but software-based rendering. Uncommon in practice.
- L3: fully software-based. Provides the lowest security and typically limits resolution to SD. Used as a fallback on devices without hardware support.
Content providers typically specify that their HD content requires at least Widevine L1.
Apple FairPlay
Apple FairPlay Streaming (FPS) is Apple's proprietary DRM system and the only one that works on iOS, macOS, tvOS, and Safari. There is no alternative path - if you want to reach Apple users, you need FairPlay.
FairPlay is tightly integrated with HLS (HTTP Live Streaming), Apple's streaming protocol. Implementation requires an Apple developer account, an FPS Deployment Package with certificates, and a licence server that handles key requests. Compared to Widevine, FairPlay is more closed and its documentation more limited, but the actual implementation is well-structured.
Microsoft PlayReady
PlayReady covers the Windows platform (Edge browser), Xbox, and some older smart TV models. PlayReady also offers support for offline playback with time-limited licences - a requirement for services that offer downloads.
In practice, PlayReady's significance is gradually declining as Widevine takes over more platforms, but it remains necessary for complete device coverage.
Multi-DRM: a unified architecture
Implementing three separate DRM systems independently would be impractical. The solution is a multi-DRM architecture that abstracts DRM complexity behind a common interface.
MPEG-CENC (Common Encryption) is the standard that makes this possible. It defines a common encryption format that works with all three DRM systems. Content is encrypted once with CENC and can then be decrypted by Widevine, FairPlay, or PlayReady depending on which device is playing it back.
In practice, multi-DRM is implemented through:
- Encryption: video content is encrypted during transcoding using AES-128 in CENC format
- Key management: a key server generates and stores content keys and associates them with licences
- Licence request: the player on the client requests a licence from the DRM server, authenticates, and receives a decryption key
- Decryption: the player decrypts and renders the content locally
W3C Encrypted Media Extensions (EME) defines the web standard for how browsers handle DRM communication with the licence server. All modern browsers support EME.
Licence servers and managed services
You can build your own DRM licence server, but for most companies a managed service is the right choice. Maintaining licence servers for three DRM systems requires specialist expertise and constant updates as DRM specifications evolve.
Established multi-DRM services include:
- BuyDRM KeyOS: enterprise-focused with support for all three DRM systems and a comprehensive API
- PallyCon: cloud-based multi-DRM with transparent pricing and good documentation
- EZDRM: well-established player focused on simplicity and rapid integration
- Axinom DRM: flexible solution with support for advanced business rules
The choice depends on your volume requirements, your business rules (e.g. how complex your licensing terms are), and your integration resources.
Complementary protection mechanisms
DRM protects the video content itself from copying, but comprehensive content protection requires multiple layers.
Token-based authentication ensures every video stream is tied to an authenticated session. The player receives a time-limited, signed token at playback start that the CDN validates. Without it, users can share direct links to video streams.
Geo-blocking restricts access to content based on the user's geographic location (via IP address). This is a licensing requirement - rights are purchased per territory, and you must be able to demonstrate to the rights holder that content is only available in licensed markets.
Concurrent stream limits prevent a single account from being used on more devices simultaneously than the subscription allows. This requires a real-time service that tracks active sessions per user.
Forensic watermarking embeds an invisible identifier in the video stream that is unique per session or per user. If content leaks, you can trace the leak to the specific session and account. It is a powerful deterrent and a requirement from some premium content providers.
Server-side ad insertion (SSAI) is relevant if you combine AVOD with DRM-protected content. By inserting ads on the server side, within the encrypted stream, ads cannot be blocked by adblockers - protecting your advertising revenue.
Player configuration and device management
DRM implementation extends all the way to the video player. It must be able to:
- Detect which device and browser is being used and select the correct DRM system
- Handle licence requests and renew licences as needed during playback
- Fall back gracefully if a DRM level is not supported (e.g. downgrade to SD instead of showing an error)
- Handle offline licences for downloads (if your service supports it)
Open source players such as Shaka Player and dash.js have built-in support for EME and multi-DRM, but require configuration and testing against all target devices. Expect device testing to be a significant effort - DRM behaves differently across browser versions, Android versions, and smart TV firmware versions.
Practical advice
Based on our experience with DRM implementations:
- Build DRM in from the start. Adding DRM after the fact often requires reworking the entire player architecture and transcoding pipeline.
- Test on real devices. Emulators are insufficient for DRM testing. Invest in a device lab that represents your actual users.
- Plan for key rotation. Content keys should be rotated regularly, and you need a process for this that does not break ongoing sessions.
- Monitor DRM errors in real time. Licence server problems or client-side DRM errors lead to black screens. Build in detailed error reporting and alerting.
- Document licence terms per title. Different content may have different DRM requirements based on the rights agreement. Your platform must be able to apply the correct policy per title automatically.
Summary
DRM is not a choice for professional streaming platforms - it is a prerequisite. Multi-DRM with Widevine, FairPlay, and PlayReady covers all devices. MPEG-CENC simplifies encryption. Managed DRM services reduce operational complexity. And complementary protection mechanisms - token authentication, geo-blocking, watermarking - build comprehensive protection.
Shapp has implemented DRM solutions and streaming platforms for companies with demanding content protection requirements. We understand both the technology and the business requirements. Whether you are building a new platform or need to improve protection on an existing one - contact us for a discussion.