Content protection
Content protection is the set of controls that decide who can watch a video and what can be done with it once delivered. It runs from access control, such as signed URLs and expiring tokens, through encryption and DRM, which lock the stream to licensed players, to output protection such as HDCP on external displays, watermarks that mark the picture, and monitoring for leaked copies. No single control covers everything. A protection setup is chosen layer by layer, matched to what a leak would cost and to what rights holders require.
What are the layers of content protection?
Content protection works in layers, and each layer answers a different question. Access control asks who may request the video. Signed URLs and tokens issued by your backend answer it, so a link stops working for anyone it was not issued to.
Encryption asks whether a copied file is useful. Segments encrypted with AES are unreadable without a key. DRM, such as Widevine, FairPlay and PlayReady, goes further: the key travels inside a license that only the device's protected DRM module can open, with rules such as expiry or offline limits.
Output protection asks whether the picture can be captured on the way to a screen. HDCP encrypts the link between a device and an external display. Watermarking asks where a copy came from: visible marks deter and brand, while hidden forensic marks can trace a copy to one account. Monitoring and takedown deal with copies already out.
Content protection vs. DRM
DRM is one part of content protection, not a synonym for it. DRM handles one job: getting a decryption key to an approved player without exposing it, and enforcing playback rules on the device. It is the strongest layer against saving a stream, and premium rights holders often require it.
Content protection is the wider set. It includes the access control that decides who gets a DRM license in the first place, the tokens that keep links from being shared, the watermarks that mark recordings, output rules such as HDCP, and the processes that find and remove leaked copies.
A service can have strong content protection without DRM. A course platform with signed, expiring playback and visible watermarks is well protected for its risk. The reverse is weaker than it looks. If anyone can request the stream and the license server grants a license to any request, DRM protects very little, so the access layer usually comes first.
How much content protection does a video need?
Protection should rise with the cost of a leak. A product demo or property teaser that spreads is free marketing, so a public link is fine. A paid course or internal training video loses value when shared, so signed, expiring access and a visible watermark are the usual baseline. Premium films, series and live sports carry licensing terms, and rights holders typically require multi-DRM, meaning Widevine, FairPlay and PlayReady to cover every device family, plus output protection.
Those requirements can be specific. The MovieLabs Enhanced Content Protection specification, which studios use as a reference for Ultra HD, requires support for HDCP 2.2 or better for UHD content. Some contracts also ask for hidden forensic watermarks, territory limits or concurrent-stream limits.
Read the contract before choosing the stack. Adding every layer everywhere slows startup and raises cost without protecting anything that needed it.
How does content protection affect playback?
Every layer adds work between pressing play and the first frame. Token checks are cheap and run at the edge. DRM is heavier: the player must request a license from a license server before it can decrypt the first segment, which adds a round trip to startup and a new way for playback to fail.
Device support also narrows. FairPlay serves Apple devices, Widevine serves Chrome, Android and many TVs, and PlayReady serves Windows and many smart TVs, so DRM content is packaged and tested across all three. Older TVs and some browsers handle protected streams poorly, and HDCP rules can block playback on an older external monitor.
Protection can affect caching too. Per-viewer manifests and very short token lifetimes reduce what a CDN can reuse. The answer is to measure: track startup time and playback errors by DRM type and device, and adjust the layers where the data shows a real cost.
How does FastPix handle content protection?
FastPix protects video at three layers on one API. Access control sits on the playback ID. Each asset and live stream has one or more playback IDs, public or signed, and a signed ID plays only with a JWT your backend creates with a FastPix signing key, each token with its own expiry. Previews that should play openly are published as separate clips with public IDs. Images sit behind the same rule: thumbnails, posters and storyboards inherit the playback ID's access policy, so private media needs a JWT for its images too, which closes the leak where a poster exposes protected content.
Encryption and DRM come through the DRM API: Widevine, FairPlay and PlayReady, played by the open-source FastPix Player across web, iOS, Android and TV. On live streams DRM covers the replay too, and the playback policy set on the stream carries to the archived video. Visible watermarks and logo overlays are applied through the API, and the player has a configurable watermark. Video Data records each view against your viewer ID and breaks down startup and errors by DRM type and device.
FastPix has no geo-blocking, no IP restriction and no forensic watermarking. Where a contract requires territory limits, your backend can check them before it signs a token; hidden per-viewer marks are a layer FastPix does not provide. FastPix can set the storage region on request where a contract or regulation fixes where media is kept; ask which regions are available.
On the bill, the media follows usage: Standard encoding free up to 4K and billed per source minute, storage per rendition-minute, streaming per minute watched. DRM is a monthly platform fee plus a small per-license fee. The free plan covers 10 videos and 100,000 streaming minutes a month, with no card.
By the numbers
- MovieLabs' Enhanced Content Protection specification requires support for HDCP 2.2 or better for Ultra HD content. (MovieLabs Specification for Enhanced Content Protection v1.2)
