Always Online DRM and Video Games

Digital rights management, or DRM, allows copyright holders to utilize technology to protect their digital files from unauthorized use. The technology used “controls access to content on digital devices” and “[i]deally . . . should equally protect the content owner’s, content creator’s, and content user’s rights under copyright law.”¹ Access is controlled through a variety of methods, including permission management and encryption,² and DRM has been used by many major companies, such as Microsoft’s PlayReady and Apple’s Fairplay.

Always-on DRM, also known as persistent online authentication or constant internet connection DRM, requires a user to remain connected to the company’s server in order to access their product. In the context of video games, always-on DRM requires the user to connect to the internet to play a video game, even if the user decides they want to play their video game offline or in single-player mode. A notorious example is Blizzard’s Diablo III, an action RPG³ which offers single and multiplayer gameplay. Upon its release in 2012, Blizzard set the video game community aflame when it botched the launch of Diablo III due to its overloaded servers preventing users from connecting and accessing the game. Diablo III’s always-on DRM continues to inconvenience players today—players who frequently encounter in-game lag or end up completely disconnected from the game if their internet connection is weak or if the company’s servers are experiencing any issues.⁴

This is not just a single past occurrence done by a single company. Ubisoft recently went under fire for shutting down several online services,⁵ including the single player Might and Magic X: Legacy, on June 1^st, 2021. Might and Magic X: Legacy’s single-player and downloadable content is protected by DRM which requires users to go online to authorize their access to the game. Though this is less intrusive than requiring users to stay connected in order to play the game, the closing of the game’s servers has left players unable to proceed past Act I of the game and unable to access any downloadable content.⁶ Shortly after shutting down these services, Ubisoft also pulled the game from Steam and left thousands of players⁷—from those who owned an existing copy to those who recently purchased the game—unable to access the game, unless they applied an “unofficial workaround” to play past a certain point in the game.⁸

DRM has been strongly criticized for being “defective by design”⁹—and for good reason. Proponents of DRM argue that DRM is necessary to protect copyright holders from piracy. The internet makes it significantly easier for hackers to access, hack, and release the games to the public. This is a huge blow to companies who spent millions on game development and marketing only to find their sales not quite meeting expectations. Always-on DRM is just another technology that allows companies to protect their products. Yet even though its primary purpose is to prevent piracy, hackers are still able to circumvent video games’ DRM and distribute “cracked”¹⁰ versions of the game online.¹¹ DRMs have also been criticized for—moderately to severely—inconveniencing consumers and preventing them from “perfectly legal uses of media that do not infringe on copyright”¹² or uses of media that fall under an individuals’ “Fair Use” rights.¹³

Always-on DRM exacerbates the issues of fragmented ownership rights in the age of digital media as these “increased restrictions . . . limit the ability of users to enjoy purchased content in ways otherwise permitted under fair use.”¹⁴ It continues the trend of DRM systems allowing copyright holders to limit fair use rights even more than anticipated under Copyright Law, ¹⁵ especially under the Digital Millennium Copyright Act (DMCA) which prevents circumvention access control of software, regardless of whether there is actual copyright infringement.¹⁶ Always-on DRM is understandable and works well enough for multiplayer games, like MMORPGs or MOBAs,¹⁷ because users understand that they need to connect online to play with others. However, single player games are a “private experience” and should not require connection to an online server, or connection to the internet at all.¹⁸ There is difference in “how players perceive the product they’re buying and the agreement with the developer represented by that purchase.”¹⁹ While consumers understand the technical and conceptual need to connect online to play with other gamers for multiplayer games, not all consumers understand or want to purchase a game only to find that they cannot play due to a server connection error or because their sibling is streaming Netflix from the other room. In a worst-case scenario, the company could simply “go dark”²⁰ and leave gamers unable to access the game they paid for—just like Ubisoft and Might & Magic X: Legacy.

Always-on DRM exacerbates the issues of fragmented ownership rights in the age of digital media. Many consumers are unaware of the differences between purchasing a physical and a digital product, and often fail to notice the differences in the terms of agreement for products purchased online. Requiring an online connection may add an additional layer of security for the company, but it adds an unnecessary step in accessing one’s legally acquired purchase, and it may even block a legal user’s attempts to access their purchase under various circumstances.

Some companies have been exploring other types of DRM, which are less intrusive and more community-friendly, like endogenous DRM.²¹ However, overall, it has become “difficult to escape DRM in the gaming industry,” especially as more companies offer their video games online or on digital distribution platforms.²² The reliance on the internet in accessing products have created a near perfect environment for digital distribution platforms, like Steam—which also utilizes always-on DRM—that are designed to streamline the purchasing, downloading, and patching process for games. Consumers enjoy the ease of access to their products, even if they complain heavily about the restrictions in place to access them. Perhaps these complaints will jolt the companies into action and to change their approach, but it seems highly unlikely at this time.

Olivia Yoon is a Second Year Law Student at Benjamin N. Cardozo School of Law and a Staff Editor at the Cardozo Arts & Entertainment Law Journal. Olivia is also the current secretary of Cardozo’s Asian Pacific American Law Student Association and the current treasurer of Cardozo’s Entertainment Law Society.

1. Frederick W. Dingledy & Alex Berrio Matamoros, Digital Rights Management: The Librarian’s Guide 1 (Catherine A. Lemmer & Carla P. Wale, eds., 2016).
2. Id. at 4-7. See also Julie E. Cohen, DRM and Privacy, 18 Berkeley Tech. L.J. 575, 580-88 (2003) (DRM performs three general functions: constraint, monitoring, and self-help. Permission management and encryption are examples of “constraint,” whereas data collection is an example of “monitoring” and automatic disabling is an example of “self-help.”).
3. RPG stands for “role-playing game.”
4. See Erik Kain, ‘Diablo III’ Fans Should Stay Angry About Always-Online DRM, Forbes (May 17, 2012, 01:50 PM), https://www.forbes.com/sites/erikkain/2012/05/17/diablo-iii-fans-should-stay-angry-about-always-online-drm/?sh=5f6e964c1853; Kirk Hamilton, In The End: Diablo III Just Shouldn’t Have Been ‘Always Online’, Kotaku (Aug. 20, 2014, 08:00 PM), https://kotaku.com/in-the-end-diablo-iii-just-shouldnt-have-been-always-1624648696.
5. Ubi-Borealis, Comment to Online Services Update Master List, Ubisoft Forums (Apr. 1, 2021), https://forums.ubisoft.com/showthread.php/1241617-Online-Services-Update-Masterlist.
6. Mike Fahey, Ubisoft DRM Breaks Might & Magic X: Legacy Single-Player, DLC, Kotaku (Jun. 21, 2021), https://kotaku.com/ubisoft-drm-breaks-might-magic-x-legacy-single-playe-1847144111.
7. Might & Magic X: Legacy, SteamSpy, https://steamspy.com/app/238750 (last visited Sep. 15, 2021) (SteamSpy reports approximately 200,000-500,000 consumers purchased Might & Magic X: Legacy through Steam). See also Erik Kain, Ubisoft Delists ‘Might and Magic X: Legacy’ From Steam Instead of Fixing DRM Fiasco, Forbes (Jul. 6, 2021, 12:38 PM), https://www.forbes.com/sites/erikkain/2021/07/06/ubisoft-delists-might-and-magic-x-legacy-from-steam-instead-of-fixing-drm-fiasco/?sh=51a02a0b7977; Pam K. Ferdinand, Ubisoft Pulls Might and Magic 10 – Legacy from Sale Following DRM Shutdown Controversy, GameRant (Jul. 5, 2021), https://gamerant.com/ubisoft-might-and-magic-drm-controversy/.
8. Luke Plunkett, Ubisoft Screws Up DRM Servers, Then Somehow Makes Things Worse, Kotaku (Jul. 5, 2021, 08:00 PM), https://kotaku.com/ubisoft-screws-up-drm-servers-then-somehow-makes-thing-1847232712. See also Timothy Geigner, DRM Strikes Again: Ubisoft Makes Its Own Game Unplayable By Shutting Down DRM Server, TechDirt (Jul. 6, 2021, 07:44 PM), https://www.techdirt.com/articles/20210706/10382147121/drm-strikes-again-ubisoft-makes-own-game-unplayable-shutting-down-drm-server.shtml.
9. Rob Fahey, We’re not always online; games shouldn’t be either, GamesIndustry.biz (Mar. 15, 2013), https://www.gamesindustry.biz/articles/2013-03-15-were-not-always-online-games-shouldnt-be-either.
10. Cracking occurs when “an individual uses his own software to ‘crack’ the encryption and make copies without permission.” Murphy v. Millennium Radio Grp. LLC, 650 F.3d 295, 300 (3d Cir. 2011).
11. See Cecilia D’Anastasio, The Woman Bulldozing Video Games’ Toughest DRM, Wired (Feb. 22, 2021, 05:55 PM), https://www.wired.com/story/empress-drm-cracking-denuvo-video-game-piracy/; Callum Williams, Crash Bandicoot 4’s Online-Only DRM Was Cracked One Day After It Launched, GameRant (Apr. 5, 2021), https://gamerant.com/crash-bandicoot-4-pc-online-only-drm-cracked-launch/.
12. CBC News, The pros, cons, and future of DRM (Aug. 7, 2009), https://www.cbc.ca/news/science/the-pros-cons-and-future-of-drm-1.785237.
13. Madhavi Dhingra, Digital Rights Management & its Consumer Concerns, 6 Int’l J. Eng’g Rsch. Tech. 438, 438 (Mar. 2017).
14. Amber Sami Kubesch & Stephen Wicker, Digital Rights Management: The Cost to Consumers, 103 Proc. IEEE 726, 726 (May 2015).
15. Id. at 726.
16. The Digital Millennium Copyright Act of 1998, 17 U.S.C.S. § 1201.
17. MMORPG stands for “massively multiplayer online role-playing game” and it allows a player to interact with a significant number of online players at any given time. An example of a MMORPG is RuneScape, which was developed and published by Jagex in 2001. MOBA stands for “multiplayer online battle arena” and it allows a player to participate in a team and battle other teams. An example of a MOBA is League of Legends, which was developed and published by Riot Games in 2009.
18. Fahey, supra note 9.
19. Id.
20. Kubesch & Wicker, supra note 14, at 727 (Fictionwise, an ebook seller, stated in their FAQ that if their third party’s servers “go dark,” then there was no way to continue delivering files to consumers.).
21. Andrew V. Moshirnia, Giant Pink Scorpions: Fighting Piracy with Novel Digital Rights Management Technology, 23 DuPaul J. Art, Tech & Intell. Prop. L. 1, 49-66 (2012) (Endogenous DRM is a creative way to fight piracy within a game by redacting game elements, triggering deliberate game crashes, and introducing extremely difficult ways to beat mobs. The overall PC gaming community has held positive reactions to endogenous DRM, especially compared to their reactions to always-on DRM).
22. J. Conditt, We’re all kinda fine with DRM now, EnGadget (Feb. 12, 2020), https://www.engadget.com/2020-02-12-drm-geforce-now-steam-xbox-playstation-subscription-streaming.html.