OTT piracy in India: how shows leak on release day
New OTT shows usually leak from the service's own stream: within hours, a paid account copies each episode from the weakest device allowed. Here is the chain, and what OTT teams do about it.
On this page 8 sections
When a new OTT show turns up on pirate sites the day it is released, the copy has usually been made from the service's own stream. Within hours of an episode going live, someone with a paid account copies it from the weakest device the service allows. The copy is re-encoded and pushed to pirate sites, apps and Telegram channels. OTT teams can't make that impossible, but they can make it slower, lower in quality, traceable to an account and quick to take down.
Tools that claim to get past DRM are sold openly, and they have reached phones too. From late 2022 until a September 2024 update, StreamFab's Android app offered downloads from Netflix and Amazon Prime Video. Its "DRM MPD Downloader" for Windows and Mac says it saves DRM-protected streams from any site as MP4 or MKV files "without requiring technical configuration", and its home page lists downloaders for Netflix, Prime Video, Disney+, JioHotstar and online-course marketplaces. KeepStreams advertises downloads from "3,000+ sites", up to 4K.
The release-day leak chain at a glance
| Stage | What happens | What the OTT team controls |
|---|---|---|
| 1. Access | A paid account, a shared login, a free trial or a stolen password is ready when the episode goes live | Trial rules, device limits, stream limits and account checks |
| 2. Capture | The episode is copied on the device or browser with the weakest protection | Minimum security levels, quality caps and output protection |
| 3. Processing | The copy is re-encoded into several file sizes, sometimes with added subtitles or dubbed audio | Nothing directly; it happens off the platform |
| 4. First upload | Pirate sites, file lockers and Telegram channels race to post first | Monitoring that starts at release time, not the next morning |
| 5. Mirroring | Copies spread to mirror domains, torrents, unofficial apps and social platforms | Takedown notices, search delisting and blocking orders |
| 6. Earning | Sites make money from advertising, redirects and paid "premium" access | Court orders against the sites, their domains and their hosts |
The chain is fast because every stage after capture is cheap. The only stages an OTT team fully controls are the first two, which is why most of the effort goes there.
Before release: leaks from the supply chain
A show passes through many hands before its release date. Editors, dubbing and subtitling studios working in several Indian languages, music and effects vendors, trailer teams, reviewers and festival juries may all handle full episodes. A copy that appears before release points to that chain, not to subscribers.
Pre-release copies often give themselves away. Unfinished effects, temporary music, missing credits or a reviewer's on-screen label all say the file came from the production side. OTT teams reduce this risk in a few plain ways:
- send screeners as streams tied to a named person, with that person's details marked on the picture, rather than as files;
- give each vendor only the material its task needs, and log who downloads the masters;
- end vendor and freelancer access when a project closes;
- agree in contracts what happens if a copy is traced back to a vendor.
Release hour: the weakest device decides
Streaming services don't protect every device equally. Phones, TVs and streaming sticks with hardware-backed DRM keep keys and decrypted video inside protected parts of the chip. Many desktop browsers, and some older, rooted or modified devices, run DRM in software. There, keys are guarded only by hidden code on a device the user controls.
Pirates go to whichever device the service treats most generously. Two kinds of copy come out of it:
- Clean digital copies. If the keys can be recovered from a software-level device, the encrypted files can be decrypted outright, at whatever quality that device was allowed. Widevine's software level was publicly broken in 2019, as our explainer on Widevine L1 vs L3 describes.
- Captures. Where the decrypted picture isn't on a protected path, a screen recorder or a capture device on the video output can record it. HDCP protects the cable to the TV, but not every device follows its rules, as our guide to HDCP and HDMI capture explains.
Speed matters as much as quality. The first watchable copy of a popular show draws the biggest audience, so pirate groups compete to post within hours. A leak that takes a day to reach the open web loses much of its value to them.
Getting around DRM to make these copies is not just a breach of terms. Section 65A of the Copyright Act, 1957 makes it an offence to circumvent an effective technological measure with the intention of infringing copyright. The penalty is up to two years in prison and a fine.
Where copies spread, and who earns
Once a copy exists, it goes everywhere at once:
- pirate streaming and download sites, which switch domains when they are blocked;
- torrents, cloud drives and file lockers;
- unofficial streaming apps, often installed from outside the app stores;
- short clips on social platforms;
- Telegram channels, which are especially popular in India.
The scale shows in government figures. On 5 August 2026, the Ministry of Information and Broadcasting gave the Lok Sabha its latest count, recorded in a PIB release. Intermediaries had been directed to disable 7,393 URLs for film piracy, including 4,996 Telegram channels and 1,263 websites.
Most pirate sites are businesses. They earn from advertising, including ads for betting and gambling, from redirects to other sites and apps, and from charging for "premium" or early access. Some also push malware and fake apps to the viewers they attract.
Live sport: the same chain in real time
Sport adds one difficulty: the value is in the next few minutes. A match is restreamed live from a paid feed, and a takedown that arrives after the final over is too late. Broadcasters therefore prepare before a tournament starts, with monitoring teams and court orders ready to use during play.
Indian courts have adapted to this. In a suit over the ICC Men's Cricket World Cup 2023, the Delhi High Court allowed blocking in real time. The broadcaster could send newly found streaming sites straight to the Department of Telecommunications, MeitY and internet providers, who were to block them at once.
The court's later judgment of 29 October 2024 records that about 406 rogue websites were blocked under that order, and 396 more were added later. Broadcasters rely on the broadcast reproduction right in section 37 of the Copyright Act, which lasts 25 years from the year after the broadcast.
What OTT teams do about release-day leaks
No single control stops release-day piracy. Teams that handle it well work through a sequence like this:
- Set security levels by quality. Serve HD and 4K only to devices with hardware-backed DRM, and cap software-level browsers and devices lower. A capped device can only leak a capped copy.
- Require output protection for premium streams, so protected video isn't sent to displays and devices that fail the HDCP check.
- Limit devices and simultaneous streams per account, and watch for accounts that behave unlike viewers around a premiere.
- Mark every session. Invisible watermarks that identify the account or device let the team find the source of a leaked copy, even one that has been re-encoded. Our guide to dynamic watermarking explains why visible marks alone fall short.
- Monitor from the first minute of release: pirate sites, Telegram, apps, social platforms and search results.
- Cut off the source. Once a copy is traced, end that account's sessions and block the device before the next episode drops.
- Take down and delist. Send notices to every host and to Telegram, and ask Google to remove pirate links from search, as our guide to removing pirated links from Google describes.
- Get court orders before release. The Delhi High Court grants dynamic injunctions that let rights holders add mirror sites by affidavit. In 2023 it granted a "Dynamic+" injunction that also covered future works; see our guide to dynamic injunctions and John Doe orders.
- Use the government route for films. Since November 2023, copyright holders can complain to nodal officers in the Ministry and the CBFC. The Ministry said platforms must remove pirated links within 48 hours of a direction.
- Make the legal version easy to choose. Reliable apps, every language available at launch and fair plans for price-sensitive viewers all shrink the audience a pirate copy can reach.
The legal position in brief
Copying or sharing a show without permission infringes copyright under section 51 of the Copyright Act, 1957. Knowingly doing so is an offence under section 63, punishable with six months to three years in prison and a fine of ₹50,000 to ₹2 lakh. Section 65A separately covers circumventing DRM or similar protection to infringe.
For films, the Cinematograph (Amendment) Act, 2023 added two offences. Section 6AA prohibits recording a film in a cinema to make or transmit an infringing copy, and section 6AB prohibits exhibiting infringing copies for profit. Under section 7(1A), either offence carries three months to three years in prison. The fine starts at ₹3 lakh and can reach 5% of the audited gross production cost.
Platforms that host pirated copies can lose their safe harbour under section 79 of the IT Act if they don't act on court orders or government notices. This is general information, not legal advice.
Smaller OTT services and course platforms face the same chain on a smaller budget. The leak still starts from one paid account and the weakest device, so the most useful response is to find that account quickly. VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. It also brings VidSafe proprietary encryption, screen- and camera-recording detection, account-sharing prevention and RASP. Teams with their own platform can add it through the VidSafe SDK.
Frequently asked questions
How do OTT shows leak so quickly after release?
Pirate groups have accounts ready before the episode goes live, and they copy it from whichever device the service protects least. Where keys can be recovered from software-level DRM, they get a clean copy; elsewhere they capture the screen or the video output. Re-encoding and uploading take little time, so copies can appear within hours.
Why do OTT services limit picture quality in some browsers?
Because DRM in many desktop browsers runs in software, where keys and decrypted frames are easier to reach than in protected hardware. Capping quality on those devices limits the quality of any copy made there. Phones, TVs and streaming sticks with hardware-backed DRM usually get the highest qualities.
Can an OTT platform find out which account leaked a show?
Often, yes, if each stream carries an invisible watermark tied to the account or device. The watermark is read from the pirated copy, and the platform can then suspend that account before the next episode. Courts can also order platforms such as Telegram to disclose who uploaded infringing copies.
How do OTT platforms get pirate sites blocked in India?
Mostly through court orders: the Delhi High Court grants dynamic injunctions directing internet providers, DoT and MeitY to block pirate sites. Rights holders can add mirror sites later by affidavit. For films, they can also complain to the Ministry of Information and Broadcasting's nodal officers. This is general information, not legal advice.
