tips

Is It Legal to Download Streaming Video? A Technical and Legal Checklist

Not 'consult a lawyer' hand-waving — actual signals you can check in the network tab, the actual laws that matter in major jurisdictions, and where FlowPick draws the line.
FlowPick Team
14 min read
# legal # drm # copyright # streaming # ethics # deep-dive

Every few weeks someone emails FlowPick support asking why we don't add Netflix/Disney+/HBO Max support. The short answer is: because it's illegal in basically every jurisdiction, and the technical signal that tells you "this is DRM-protected" is right there in the manifest.

This article is the long answer. It's not "consult a lawyer" hand-waving — it's the actual technical signals you can check, the actual laws that apply, and the practical decisions we make about what FlowPick will and won't touch.

I'm a developer, not a lawyer. This is general guidance based on how the laws actually work in 2026, not legal advice for your specific case.

The technical signals

Before any legal question, there are technical signals that tell you what kind of content you're dealing with. Check these in your browser's DevTools network tab.

Signal 1: DRM markers in the manifest

For HLS:

#EXT-X-KEY:METHOD=SAMPLE-AES,URI="skd://drm.example.com/key"

METHOD=SAMPLE-AES (not AES-128) means FairPlay DRM. The skd:// URI scheme is the giveaway — that's Apple's FairPlay key URL scheme. Real AES-128 uses https:// and returns a raw 16-byte key.

For DASH:

<ContentProtection
  schemeIdUri="urn:uuid:edef8ba9-79d6-4ace-a3c8-27dcd51d21ed"
  value="Widevine">
  <cenc:pssh>...</cenc:pssh>
</ContentProtection>

The UUIDs identify the DRM system (see the DASH deep dive for the full list). If ContentProtection is present with a recognized DRM system UUID, the content is DRM-protected.

If you see these signals, downloading is illegal in most jurisdictions — see the legal section below.

Signal 2: HTTP headers

Content-Protection: drm
Content-Protection-System: Widevine
X-Licence-Url: https://drm.example.com/licence

Some platforms add proprietary headers. Not standardized, but if you see Content-Protection or similar, treat the content as DRM-protected.

Signal 3: EME in the page

Open DevTools, search for MediaKeys or encrypted in the console:

// In the page's console:
const videos = document.querySelectorAll('video')
videos.forEach(v => {
  v.mediaKeys ? console.log('DRM-protected') : console.log('No DRM')
  v.onencrypted = () => console.log('Encrypted event fired')
})

If video.mediaKeys is non-null, the page is using Encrypted Media Extensions — i.e., DRM.

Signal 4: Terms of Service

Most platforms' ToS explicitly prohibit download. The signal isn't technical, but it matters legally. Examples:

  • YouTube ToS: "You shall not download any Content unless you see a 'download' or similar link displayed by YouTube."
  • Netflix ToS: "You may not... download, copy or otherwise capture any of the Content."
  • Vimeo ToS: Prohibits download unless explicitly enabled by the uploader.

Even without DRM, ToS violations can be breach of contract.

Signal 5: DRM absence doesn't mean "allowed"

A stream can be unencrypted and still copyrighted. The technical absence of DRM means you can download it; it doesn't mean you may. More on this in the legal section.

The legal frameworks

United States

Two relevant statutes:

DMCA §1201 (Anti-Circumvention) — Makes it illegal to circumvent technological protection measures. If content is DRM-protected, downloading it (which requires breaking the DRM) is illegal even if you have a valid subscription. Penalties: $200-$2,500 per violation for individuals, up to $1M for commercial.

This is the big one. DMCA §1201 doesn't care about fair use, doesn't care if you bought the content, doesn't care if it's for personal use. If you break DRM, you've broken the law. Courts have repeatedly upheld this.

Copyright Act §106 — Gives the copyright holder exclusive rights to reproduce, distribute, etc. Downloading is reproduction. Whether it's infringement depends on:

  • Fair use (§107) — transformative, non-commercial, factual vs. creative, market effect
  • Whether you have a license (e.g., a subscription might or might not include download rights — check ToS)

Practical rule: Non-DRM content + personal use + you have legitimate access = usually fine. DRM content = illegal regardless of use.

European Union

InfoSoc Directive (2001/29/EC), Article 6 — Similar to DMCA §1201. Anti-circumvention of technological protection measures. Member states implement it differently but the substance is the same.

DSM Directive (2019/790), Article 17 — Platforms' liability for user-uploaded content. Doesn't directly address download but affects the broader ecosystem.

Country-specific quirks:

  • Germany: Personal copies of "obviously illegal" sources are themselves illegal (§53 UrhG). What counts as "obviously illegal" is contested.
  • France: Hadopi/HADOPI law — graduated response for copyright infringement. Three strikes, then fines and disconnection.
  • UK: Similar to EU but with some differences post-Brexit; CDPA 1988 + amendments.

Practical rule: Same as US. DRM = illegal. Non-DRM for personal use = usually fine but country-specific.

Japan

Copyright Act Article 30 — Personal use copies are allowed, but "in cases where the copy is made knowing that the reproduction would unjustly harm the interests of the copyright holder." Translation: downloading from a legitimate source is fine; downloading from a pirate source is not.

Article 120-2 — Makes downloading illegally distributed content a criminal offense. Japan is stricter than most — penalties can include imprisonment.

DRM circumvention is also illegal under the Unfair Competition Prevention Act.

China

Copyright Law Article 10 — Reproduction rights. Personal use exemption in Article 22 is narrow.

Regulations on the Protection of the Right of Communication through Information Networks (2006) — Implementations of WIPO Internet Treaties. Anti-circumvention provisions.

In practice: enforcement is selective. Bilibili and iQiyi streams are unencrypted and routinely downloaded by Chinese users; legal action against individual downloaders is rare. Companies occasionally target toolmakers.

Korea

Copyright Act Article 30-2 — Personal use allowed for "small" amounts of copyrighted works. Distribution of circumvention tools is illegal (Article 124).

Practical summary

In every major jurisdiction:

  • DRM-protected content: illegal to download, full stop.
  • Non-DRM content for personal use, with legitimate access: generally fine, with country-specific quirks.
  • Non-DRM content for redistribution: illegal everywhere.
  • Distributing circumvention tools: illegal everywhere.

Where FlowPick draws the line

FlowPick's policy, which I think is the right one for any download tool:

Will download:

  • HLS streams without EXT-X-KEY:METHOD=SAMPLE-AES
  • DASH streams without ContentProtection for known DRM systems
  • Direct video file URLs (MP4, WebM, etc.)
  • Audio and image resources

Refuses to download:

  • HLS with METHOD=SAMPLE-AES
  • DASH with ContentProtection referencing Widevine/PlayReady/FairPlay
  • Anything where the EME API is actively encrypting the stream

The refusal isn't a "we couldn't figure it out" — it's an explicit policy. FlowPick's detection code parses these signals and intentionally fails on them. This is why "FlowPick can't download this" is a feature, not a bug.

Original opinion: A download tool that promises to handle "any site" is either lying or breaking the law. The honest position is: "we can download anything that's not DRM-protected, and we won't even try on DRM." Tools that claim otherwise are either scams, malware, or operating in legal grey areas that will get shut down.

Specific platform guide

YouTube: Mostly non-DRM. ToS prohibits download, but the technical signal is absent. Many users download YouTube for offline viewing, archival, etc. FlowPick handles YouTube (when the page is loaded in the browser). Courts have ruled both ways on whether YouTube downloading is fair use — generally, personal/non-commercial use is tolerated.

Netflix, Disney+, HBO Max, Apple TV+: All DRM-protected (Widevine/PlayReady/FairPlay, depending on platform). Downloading is illegal under DMCA §1201 and equivalents. FlowPick refuses.

Vimeo: Varies by video. Some videos have a "Download" button enabled by the uploader — those are fine. Others don't — ToS prohibits download.

Twitch VODs: Mostly non-DRM. ToS prohibits download but enforcement is rare for personal use.

Bilibili: Mostly non-DRM. ToS prohibits download but the platform is permissive in practice. FlowPick handles Bilibili — see the Bilibili tutorial.

Udemy, Coursera, edX (paid courses): Mixed. DRM-protected courses are off-limits. Non-DRM courses you've paid for are technically a ToS violation but legally defensible under personal use.

Patreon: Mostly non-DRM. You paid for access; downloading for personal use is generally fine.

Corporate LMS (proprietary training videos): Often non-DRM technically, but ToS violations and employment consequences are the real risk. If it's your employer's content, check with them.

Pornhub, OnlyFans: ToS prohibits download. DRM varies. OnlyFans specifically has pursued legal action against download tool operators.

Technical checklist before you download

If you're not sure whether a stream is OK to download, here's the checklist:

  1. Open DevTools → Network tab. Filter by m3u8, mpd, or mp4.
  2. If HLS: Check for #EXT-X-KEY:METHOD=SAMPLE-AES. If present, stop — DRM-protected.
  3. If DASH: Fetch the MPD. Look for <ContentProtection> with a recognized DRM UUID. If present, stop.
  4. If neither (direct MP4): No DRM signal possible. Content is technically downloadable.
  5. Check ToS. Search "platform name terms of service download." If ToS explicitly prohibits, that's a ToS violation even without legal infringement.
  6. Consider the use case. Personal offline viewing of content you have legitimate access to is generally fine. Redistribution is not.

FlowPick automates steps 1-4. Steps 5-6 are on you.

What about fair use?

Fair use (US) and equivalents elsewhere allow copyrighted content use without permission for specific purposes: commentary, criticism, news reporting, scholarship, research.

The four factors (17 U.S.C. §107):

  1. Purpose and character of use (commercial vs. nonprofit educational)
  2. Nature of the copyrighted work
  3. Amount and substantiality used
  4. Effect on the potential market

Practical reality: Fair use is an affirmative defense — you raise it after being sued, and a judge decides. It's not a "get out of jail free" card. For personal archival of content you've paid to access, fair use probably applies. For redistribution, it doesn't.

What about content I've paid for?

This is the most common "but I bought it!" question. The answer:

  • You bought a license, not the content. Subscriptions grant access under specific terms. If the terms say "no download," downloading is a breach of contract.
  • DRM circumvention is illegal regardless of license. Even if you have a valid Netflix subscription, breaking Widevine to download is illegal under DMCA §1201.
  • Personal copies of non-DRM content are generally fine. If you bought a movie on a non-DRM platform, downloading a backup is defensible.

When to actually consult a lawyer

If you're:

  • Operating a download service or tool (like FlowPick)
  • Distributing downloaded content publicly
  • Circumventing DRM for any reason
  • Unsure whether your use case is fair use

Then talk to a lawyer who specializes in copyright. This article covers general principles, not your specific situation.

References

Summary

The legal line for streaming video download is, in most jurisdictions: DRM = illegal, non-DRM for personal use = generally fine. The technical signals that distinguish these are visible in the network tab — SAMPLE-AES in HLS, ContentProtection with a DRM UUID in DASH. If you see them, downloading requires circumvention, which is illegal.

FlowPick's policy: download anything that's not DRM-protected, refuse anything that is. This is the only honest position for a download tool. Tools that promise "any site" are either scams or breaking the law, and you shouldn't trust them with your data or your legal exposure.

For the technical side of what happens after you've confirmed content is downloadable, see the HLS, DASH, and remux deep dives.

Related articles

Recommended reading

Previous

How to Sniff and Download Audio from Any Website: Podcasts, BGM, Audiobooks

Next

WebCodecs + Web Workers + OPFS: Practical Video Processing in the Browser