Protecting Paid Course Videos: Why Some Creators Make Android Users Watch In-App

If you sell classes on video, the video is your product. Once a learner has paid, you want them to watch it, and you do not want it copied and shared with people who did not pay. This guide explains the main protection methods in plain language, what each can and cannot do, and how one real client of ours decided what to do.

Start with the honest answer

No method makes a video impossible to copy. If a person can see a video on a screen, a determined person can film that screen with another phone. The goal is not perfection. The goal is to make casual sharing awkward, to keep the effort of copying higher than the price of the class, and to be able to trace a leak if one happens.

For most small creators, a few layers of modest protection work better than one expensive tool. It helps to think of the problem in three parts: who may press play, where the video can be played, and what a copy would look like if it escaped.

Layer one: control who can press play

The first job is to make sure only paying, signed-in learners reach the video at all. That means logins, a record of what each person has bought, and a server check each time a lesson opens.

A common technique here is the signed URL, which is a video link that carries a built-in signature and an expiry time. After it expires, the link stops working. Google describes this in its Cloud Storage documentation, where the longest validity for a signed link is seven days. The same documentation notes that anyone holding an active link can use it, whether or not they have an account. So a signed link is a strong way to avoid permanent public links, but it does not stop a learner from passing a live link to a friend within its short life. Keep expiry short, in minutes rather than days, and generate each link only after you have checked the learner's purchase.

Layer two: control where the video plays

You can also decide which screens are allowed to show the video. Some creators allow playback only inside their own mobile app. Inside an app you control more of the experience than you can in a browser.

On Android, a window can be marked secure using a setting called FLAG_SECURE. Android's own developer guidance says it stops screenshots of that window and stops it appearing on non-secure displays such as a casting screen, and it also helps against screen-sharing apps used in fraud. The same page is candid about limits: it does not always correctly detect screen recording, it is not reliable against overlay attacks, and on Android 11 and earlier it is described as reliable on around 70 per cent of devices. In plain terms, it raises the bar without closing the door.

A website running in a browser cannot offer the same control. Browsers are built to be open, so a creator who wants tighter handling often prefers an app for the video itself.

Layer three: make leaks traceable

A visible watermark on the video, such as the learner's name or phone number appearing faintly and moving position, discourages sharing because the copy points back to the buyer. It costs little and works through human behaviour, not technology. The downside is that it can distract from the lesson if it is too strong, so test it on real screens.

Where DRM fits

DRM stands for digital rights management. It encrypts the video so that only approved players can decode it, and it is what large streaming services use. It is the strongest option, but it adds licence costs, extra setup and testing across devices. For a creator with a handful of classes, it is often more than the problem deserves. For a growing library with high-priced courses, it deserves a proper quote. We do not assume it is needed; we ask what a leaked video would actually cost you.

A real example: the Brave Mom Naturals rule

Our client Brave Mom Naturals, a maker of natural body-care and soap products who teaches classes on making them, set a clear rule for her class videos. Android users watch only inside the Android app, not on the website. Since she has no iPhone app, Apple users are sent to the website instead. We built her platform around that rule, as described in our case study. The rule is the owner's decision, and the platform makes it work. We have not measured how much it reduces sharing, and we will not claim a figure.

A checklist for choosing your approach

1. Write down what one leaked video would cost you in lost sales.
2. Require a login and check the purchase on the server every time a lesson opens.
3. Use expiring signed links, valid for minutes.
4. Decide whether paid video should play only in an app, only on the website, or in both.
5. Add a light watermark that identifies the learner.
6. Consider DRM only if the library is large or the price per course is high.
7. Say clearly in your terms that sharing paid content is not allowed.

Next steps

If you are planning a class platform, our native Android app development and Firebase app development pages show how we approach the build, and our LMS glossary entry explains the wider idea. VS Tech Builders can help you weigh the options against your budget; get in touch with a short description of your classes. More walkthroughs live in our project guides.

Sources

Checked on 3 November 2026. Technology changes quickly; always confirm details with the official source before you act on them.

• Signed URLs — Google Cloud Storage documentation
• Prevent screen capture and overlay attacks (FLAG_SECURE guidance) — Android Developers

Frequently asked questions

Can paid course videos be fully protected from piracy?

No method stops a determined person, because a video shown on a screen can be filmed with another device. Good protection raises the effort of copying, limits casual sharing and lets you trace a leak. Login checks, expiring links, in-app playback and a learner watermark together work better than any single tool.

What is a signed URL for video?

A signed URL is a video link that includes a signature and an expiry time. When the time passes, the link stops working. It lets your server hand out temporary access after checking that a learner has paid. Anyone holding a live link can use it, so keep the validity short.

Does FLAG_SECURE stop screen recording on Android?

It blocks screenshots of the protected window and keeps it off non-secure displays, but Android's own guidance says it may not always detect screen recording and is not reliable against overlay attacks. Treat it as one useful layer that makes casual capture harder, not as a complete lock.

Do I need DRM for my online classes?

Usually not at the start. DRM adds licence costs and device testing, and suits large libraries or high-priced courses. A small creator is often better served by logins, expiring links, in-app playback and a watermark. Estimate what a leaked video would cost you before paying for DRM.