Password sharing on OTT apps: how to detect and limit it
Password sharing on an OTT app shows up in usage: too many streams, devices that never share a network, impossible viewing hours. Limit it with clear rules, checks and a paid route.
On this page 9 sections
- Decide what counts as sharing first
- Signals that an account is being shared
- Why "a device" is only an estimate
- The limits you can set
- Enforcement honest subscribers can live with
- Resold and stolen accounts are a different problem
- Use viewing data carefully
- How to tell whether it worked
- Frequently asked questions
Password sharing on an OTT app shows up in how an account is used, not in the password itself. The signs are more streams than one household needs, devices that never share a network, and viewing hours no single person could manage. You limit it with clear stream and device rules and checks at risky moments, such as a new device far from home. Add a paid route for sharers to become subscribers, and honest subscribers barely notice.
Decide what counts as sharing first
Every enforcement decision depends on a rule your subscribers can understand. OTT services usually sell one of two things. A household plan lets everyone living together watch; a personal plan lets one person watch on a few devices. Course and EdTech apps are almost always personal, because one enrolment pays for one learner.
Indian households make the line harder to draw: a joint family may watch on one TV and three phones. A son in a Pune hostel may use his parents' account, and a daughter working in Bengaluru may log in from her office. Decide in advance which of these you allow, write it into your terms and plan pages, and show the limits in the app. Viewers can't keep to a rule nobody told them about.
Signals that an account is being shared
No single signal proves sharing. Each one has an innocent explanation, so useful detection combines several over weeks, not one event.
| Signal | What it can suggest | Innocent explanation |
|---|---|---|
| Streams regularly at the plan's limit | More viewers than the plan covers | A big family on a festival evening |
| Many different devices in a month | A login passed around a group | A new phone, a reinstalled app or a cleared browser |
| Devices that never appear on the same home network | Viewers in different households | A student in a hostel, or a parent travelling for work |
| Simultaneous streams from distant cities | Two households watching at once | Mobile data often appears to come from another city |
| Viewing hours far beyond one person's day | Several viewers on a personal plan | A TV left playing, or autoplay running overnight |
| A new device every few days | A login being sold or rented | A phone under repair, or a student moving between a phone and a cyber café computer |
| Bursts of logins from many places, each device seen once or twice | A resold or stolen account | Very little |
| Many accounts watching from one network address | A reseller or a cyber café | Hostel Wi-Fi, an office network or a mobile operator's shared address |
Score these signals together, give most weight to the ones hardest to explain innocently, and look at each account over a period. A household watching a cricket final on three screens is not the same as an account seen in nine cities in a week.
Why "a device" is only an estimate
Device limits sound precise, but a device's identity is fuzzier than most product teams expect. Three things blur it:
- Apps can't see permanent hardware IDs. Since Android 10, ordinary apps can't read non-resettable identifiers such as the IMEI or serial number. Android's guidance on identifiers recommends IDs that last only as long as the app is installed. On Apple devices, the identifier shared by one company's apps changes if the user deletes all of them and reinstalls.
- Browsers forget. Cleared cookies, private windows and a second browser can each look like a new device.
- Network addresses are shared. Many mobile operators put large numbers of subscribers behind shared public addresses, a practice called carrier-grade NAT, which has its own reserved address block in RFC 6598. Two strangers can share an address, and one viewer can change address several times a day.
So build slack into device limits. Count devices over a rolling window rather than forever, and let subscribers remove old entries themselves, so a reinstall doesn't permanently use up a slot. Strict counts on fuzzy data lock out the people who paid.
The limits you can set
| Limit | What it caps | Watch out for |
|---|---|---|
| Simultaneous streams | How many screens play at once | Sessions that stay "open" after an app crashes; end them quickly, or honest viewers see "too many screens" |
| Registered devices | How many devices can sign in at all | Phone upgrades and reinstalls; allow self-service removal |
| Device changes per period | How often a slot can be reused | Set it too strictly and every lost phone becomes a support ticket |
| Limits by device type | For example, one TV and several phones | Families watching together on one TV are rarely the problem |
| Downloads per device and account | How much can be taken offline | Long expiry periods let content outlive the subscription |
| A home network or primary location | Viewing outside one household | Travel, hostels and mobile data; it needs a travel option |
| Checks on new devices | Whether the account owner approves | A code forwarded by the owner passes every check |
Most services tie these limits to plans, such as one mobile stream on the cheapest plan and several screens on the premium one. That turns a limit into a reason to upgrade, not only a restriction. For downloads, the rules large streaming services use are covered in our explainer on how secure offline downloads work.
Enforcement honest subscribers can live with
The aim is to convert or stop sharers without punishing the households and students doing nothing wrong. A graded approach works better than a switch:
- Measure quietly first. Run detection for a few weeks without acting, so you know how many accounts look shared and how many flags would be false alarms.
- Publish the rule. Update your terms, plan pages and help centre before anything changes in the app.
- Show subscribers their own devices. A screen listing every device and session, with a sign-out button for each, settles much casual sharing on its own.
- Nudge before you block. A message such as "Your account is in use on 6 devices; your plan includes 4" gives the owner a chance to tidy up.
- Verify at the risky moments. Ask for a code sent to the owner's registered phone or email when a new device appears far from the usual network, not at every login.
- Offer a paid route. An extra member, a bigger plan or a separate account turns some sharers into subscribers. Show the price right where the limit appears.
- Limit, then block. Cap streams first. Sign out other devices or suspend the account only for clear, repeated or commercial sharing.
- Keep an appeal route. Give support staff a view of each account's devices and sessions, and the power to reverse a decision quickly.
Timing matters too. Don't block an account during a live match, a premiere or an exam-eve revision session. That is when a false alarm does the most damage and gets talked about most. Signing an account out everywhere must also take effect at once on every device. Our comparison of session and token logins explains why some platforms can't do this.
Resold and stolen accounts are a different problem
Family sharing is a pricing question. Resale is a business. Premium OTT logins and course accounts are sold in Telegram groups, often in bulk. Some are stolen accounts whose passwords leaked from other sites and were reused. The signals look different: bursts of logins from many cities, devices seen once, and many accounts used from the same small set of networks.
Respond faster and harder here. Sign the account out of every device, force a password reset, alert the real owner on their registered phone or email, and offer two-step verification. For course and EdTech apps, resale also feeds piracy, because a bought login can be used to record lectures for leak channels. Our guide to how shared logins spread in online courses covers that side.
Use viewing data carefully
Device, network and viewing data about people who can be identified is personal data under India's Digital Personal Data Protection Act, 2023. Tell subscribers in your privacy notice what you collect to enforce sharing rules, and why. Collect only what the rule needs, and keep it no longer than necessary. Precise location is rarely needed; network and device patterns are usually enough. Our DPDP Act checklist covers the wider duties. This is general information, not legal advice.
How to tell whether it worked
- Share of accounts over their limit, before and after enforcement.
- New subscriptions and upgrades from accounts that were shown a limit message.
- Cancellations among flagged accounts, compared with similar accounts that weren't flagged.
- Support tickets and appeals, and how many appeals you upheld. A high uphold rate means your rules are catching honest viewers.
- Streams per account on your busiest evenings.
Roll changes out to one plan or region first and compare it with the rest. If sharers aren't converting, the paid route may be too expensive or too hard to find. If appeals are rising, your signals need more slack.
If you run a course or coaching app, Upclass builds branded apps in your institute's own name on Android, iOS, Windows and Mac. VidSafe adds account-sharing prevention alongside VidSafe proprietary encryption, dynamic watermarking and screen- and camera-recording detection. VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. Read more on preventing student account sharing, or book a demo.
Frequently asked questions
How do OTT apps detect password sharing?
They look at patterns rather than the password. Common signals are how many streams play at once and how many devices sign in over a month. Others are whether those devices share a home network, and how much is watched. Each signal has innocent explanations, such as travel or a new phone, so careful services combine several over time before acting.
Is sharing an OTT password illegal in India?
Sharing a login with family is usually a matter of the service's terms of use, which can let the service limit or close the account. Selling access, or recording and redistributing paid content, is different and can infringe copyright under the Copyright Act, 1957. This is general information, not legal advice.
How many devices should one OTT account allow?
Match the limit to the plan and to what you promised. A personal mobile plan might allow one stream and a couple of registered devices, and a household plan several screens. Whatever you choose, count devices over a rolling period, let subscribers remove old ones themselves, and show the limit before it blocks anyone.
Does two-step verification stop password sharing?
Not on its own. It protects accounts from strangers using stolen passwords, because they don't receive the code. But an owner who wants to share can simply forward the code to a friend. Use verification at risky moments, such as a new device far from the usual network, alongside stream and device limits.
What is a concurrent stream limit?
It caps how many devices can play video on one account at the same moment. The service tracks each active playback and refuses a new one once the limit is reached, usually with a message naming the plan's limit. It stops simultaneous sharing but not viewers who take turns, so services combine it with device limits.
