How to Protect Against Film Piracy
A practical guide for film companies, distributors and producers.
If you have come here looking for how to stop film piracy, the honest answer is that you cannot stop it outright. Almost every film will find its way onto piracy services. The question isn’t whether it happens, but how quickly you respond and how much audience you allow those copies to reach.
What you can change is what happens next: how many copies exist, how easily audiences find them, and how long the problem persists.
This guide sets out what film piracy actually looks like across a release window, based on consumption measured across piracy platforms rather than estimated. It covers what to do if a title has already leaked, why discovery is the harder half of the problem, what enforcement cannot fix, and how to tell whether the money you spend on protection is doing anything at all.
Contents
- If your film has just leaked: the first 48 hours
- The shape of film piracy across a release window
- What actually drives piracy exposure?
- Where films leak, window by window
- Where pirated films are distributed
- Why finding the copies is harder than removing them
- What actually reduces film piracy
- When a site ignores the takedown notice
- How to measure whether anti-piracy is working
- How to evaluate an anti-piracy provider
- How MUSO Protect helps
- Frequently asked questions
- In summary
If your film has just leaked: the first 48 hours
Many rights holders contact a protection provider after a leak rather than before it. If that is where you are, this section is the priority. The rest of the guide explains how to avoid being here next time.
1. Capture the evidence before anything else. Record the URLs, the hosting domain, the date and time you found each copy, the format and quality on offer, and screenshots of the listing pages. Enforcement and any later legal action both depend on this record, and pages disappear.
2. Establish which copy you are dealing with. A camcorder recording, a screener with visible watermarking, a retail digital rip and an SVOD rip each point to a different source and a different response. If the copy carries forensic watermarking, get it analysed immediately, because that is the only route back to the leak point.
3. Identify the host and file notices. A WHOIS lookup will often provide useful identifying information, although many piracy sites obscure their hosting infrastructure behind services such as Cloudflare. Most sites publish a DMCA contact. Compliant hosts typically remove within hours to days. This step is free and you can do it yourself.
4. Submit search removal requests in parallel, not afterwards. Do not wait to see whether the host responds. Unlike the file itself, search does not require the host's cooperation, so removing the listing matters even while the copy is still live. See when a site ignores the takedown notice below.
5. Tell your distribution partners. Sales agents, territory distributors and platform partners can act on their own accounts, and several of them will have reporting mechanisms you do not.
6. Assume this is not the peak. This is the step most people get wrong. On titles we measure, the largest piracy event is frequently not the one that prompts the phone call. See the next section.
7. Decide whether this is still a manual job. One copy on one compliant host is something you can handle yourself using the steps above. That is rarely the situation for long. A leak of any significance surfaces across dozens of domains within days, copies reappear as quickly as they are removed, and search results repopulate behind them. Copies on social platforms and messaging channels follow entirely different routes again. The harder problem is not the copies you have found. It is the ones you have not, which are usually sitting on sites you would never think to search.
If you have reached that point, the useful thing is not processing the links you already have. It is finding the rest. Talk to us, and we will scan across piracy domains, search indexes, file hosts, social platforms and unlicensed streaming services for copies of the title, then enforce continuously as new ones appear.
The shape of film piracy across a release window
Film piracy is often described as a spike at release that decays. Measured at title level, that description is wrong often enough to be dangerous.
A more typical pattern across recent wide releases is two distinct peaks. The first arrives shortly after theatrical release, driven by cinema recordings and early copies. It is visible, it is the one that generates internal alarm, and it is comparatively modest. The second arrives weeks later, when a high-quality digital copy becomes available, which is usually substantially larger than the first.
Four 2026 wide releases, each indexed to its own peak so that shape is comparable across titles of very different scale. Source: MUSO Piracy by Title.
Across the titles that have completed their digital window, the later peak ran between 1.3 and 2.3 times the height of the theatrical peak. The two adult-skewing titles sat at the top of that range, at 1.9 and 2.3 times. The animated title showed the same two-peak structure but far more shallowly, at 1.3 times, which is consistent with the wider pattern that animation and family titles behave differently from the rest of the slate.
The fourth title in the chart is still in theatrical release at the time of writing. Its ramp is the steepest of the four, and on the pattern above, its largest piracy event has not happened yet.
Two consequences follow, and both are operational rather than theoretical.
A rights holder who engages after the theatrical leak believes they have caught the problem. They have not. They have responded to the smaller of two events, and are frequently no better positioned for the larger one, which arrives after the launch team has moved on to the next title.
The high risk date is knowable in advance. It is on the release calendar. The gap between the two peaks varied across our sample from around three weeks to around eight, tracking the digital window rather than anything unpredictable. This is the strongest argument for planning protection around the release schedule rather than reacting to incidents.
The tail matters too. Titles in the sample were still generating meaningful piracy demand months after release, and older titles remain visible across the entire measurement window. Protection organised as a launch campaign leaves that period uncovered.
What actually drives piracy exposure?
The most common triage method in the industry is to protect the biggest titles first. That is usually a resource decision rather than a risk decision: budgets are finite, and the highest-value assets take priority.
Piracy exposure is more nuanced than that. Availability, genre, critical and audience reception, marketing reach, cast and the quality of the leaked copy all shape how much piracy demand a title attracts, among other factors. Commercial scale is one of them, but only one.
Across three recent 2026 wide releases we examined, the ranking by piracy demand did not match the ranking by theatrical performance. The title generating the highest piracy demand was not the highest-grossing. Larger releases do produce larger absolute volumes, but the order does not follow closely enough to plan around.
Three 2026 wide releases ranked on a matched 60-day window from theatrical release. Ranks only, no absolute values. Source: MUSO Piracy by Title.
Measured over a matched window, the ranking inverts completely. The highest-grossing title in the group generated the least piracy demand of the three, and the lowest-grossing generated the most.
Three titles is an illustration rather than a proof, and larger releases do produce larger absolute volumes. The claim is narrower: the order does not track box office closely enough to allocate protection from it.
This has a direct practical implication. If commercial scale is an unreliable guide to piracy exposure, then estimating exposure from it will be wrong often enough to matter, and the only dependable answer comes from measuring the specific title. That applies as much to an independent feature as it does to a tentpole. The sample here is wide releases, but the logic carries: if commercial scale does not determine exposure, a small budget is no reason to assume a small piracy problem.
Genre patterns compound the point, and they are routinely misread. Ranked by total piracy demand, drama comes first, which is the figure most often quoted. It is also the least useful one, because drama leads on volume mainly because there are far more drama titles in existence. Nobody owns a genre. They own a title.
Ranked by average demand per title, the order changes substantially. Anime runs at roughly four times drama. Science fiction, fantasy and adventure all sit around three times it.
The same ten genres ranked two ways. Source: MUSO. Genres are non-additive: a title carrying more than one classification contributes its full demand to each, so per-title figures should be read as relative signal rather than exact multiples.
Shape differs by genre as well as height. Animation and family titles show the same two-peak structure as the rest of the slate but far more shallowly, which is why a single protection template applied across a mixed slate will be wrong in both directions at once.
Where films leak, window by window
Piracy doesn’t respect regional release strategies. As soon as a leak occurs, it is available in every territory globally.
Pre-release. Screeners, festival and press copies, and post-production vendor access. The number of organisations touching a film during finishing, localisation, subtitling, dubbing and QA sets the size of the exposure. Pre-release leaks are the least common and among the most damaging, because they compound across every subsequent window.
Theatrical. Camcorder recordings appear within days. Quality is poor, which limits the audience, but they establish the title on piracy platforms and seed the search demand that later, better copies inherit.
Digital and premium VOD. The first high-quality copy usually originates here, and this is where the larger of the two peaks typically lands.
Subscription streaming. A further wave as platform rips circulate, often reaching different territories from the earlier windows.
Catalogue. Demand persists for years, spiking around anniversaries, franchise releases, awards attention and seasonal patterns. Seasonal titles show recurring annual peaks with no new distribution activity at all.
Where pirated films are distributed
Illegal streaming sites now account for 54% of visits to film piracy sites in MUSO's data, having overtaken torrents over the past decade. Web downloads from cyberlockers and file hosts account for a further 32%, and torrents, public and private, for around 13% — still the format of choice for high-bitrate, 4K and HDR copies. Cyberlockers host the underlying files that hundreds of streaming sites then index, which is why removing one link rarely removes one copy.
At 32% of visits, web download is the second largest channel by a wide margin, and it is routinely underweighted in protection planning. It is also the hardest to reverse: a file that has been downloaded is beyond any subsequent enforcement, which makes time from appearance to removal matter more here than anywhere else.
Beyond the web, illegal IPTV services bundle film libraries with live channels and are frequently sold to consumers who do not realise the service is unlicensed. Messaging platforms distribute complete libraries within closed and semi-closed communities. Social platforms carry full uploads, split uploads and accounts whose function is to route audiences towards piracy sites.
Search sits across all of it. In MUSO's data, 27% of traffic to film piracy sites arrives through search. That makes it the largest single acquisition channel we can identify, and more importantly, the only significant one a rights holder can act on without the host's cooperation. Traffic that arrives directly, or by referral from another piracy site, is beyond reach. Search is not.
That last distinction matters more than the channel list. Piracy has a supply side and a discovery side, and they respond to different interventions.
Why finding the copies is harder than removing them
Anti-piracy is usually discussed as a removal problem. In practice, removal is the easier half. Once you have identified an infringing copy on a compliant host, the process is well established and largely automated.
The difficulty is knowing what to remove.
Piracy infrastructure rotates constantly. Domains are replaced as they are blocked, new sites appear weekly, operators mirror content across dozens of properties, and a title that is absent from a platform on Monday may be its most trafficked listing by Friday. A rights holder searching manually sees the sites they already know about. So does a provider working from a static list. MUSO's validated database currently holds over 750,000 piracy domains, with new ones ingested and verified daily. The size of that number matters less than the fact that it changes every day.
This is where most protection quietly fails, and it fails invisibly. Nothing in the reporting tells you about the copies nobody looked for. A narrow view produces a clean dashboard and an unchanged audience.
Three things determine whether discovery is adequate:
Breadth. How many piracy properties are monitored, across streaming, torrents, file hosts, IPTV, social and search.
Refresh rate. How quickly new domains are identified, validated and brought into scope. This matters more than the size of the list, because the list decays continuously.
Independence from enforcement. A provider that only sees the sites it already acts against cannot tell you what it is missing. Measuring the wider ecosystem is what makes it possible to know whether the picture is complete.
Discovery is also what makes measurement meaningful, which is the subject of a later section. Every metric in anti-piracy is calculated against what was found. If what was found is a fraction of what exists, every number flatters.
What actually reduces film piracy
Ranked roughly by impact, and deliberately including measures that have nothing to do with enforcement.
Close the availability gaps. Piracy concentrates where legitimate access is delayed, missing or priced beyond the local market. Staggered territory releases and long windows between formats produce measurable demand with nowhere legitimate to go. This is a distribution decision rather than an enforcement one, and it is frequently the highest-leverage change available.
Watermark and control pre-release access. Forensic watermarking does not prevent leaks. It makes them attributable, which changes behaviour among the people with access and gives you a route back to the source when a copy surfaces. Pair it with a maintained log of every screener and vendor copy distributed.
The wider exposure is the supply chain rather than the screener list. A film in finishing passes through post houses, localisation and subtitling vendors, dubbing studios and QA, each a separate organisation with its own staff and its own security posture. Content security standards exist for exactly this, and the Trusted Partner Network assessment programme is the common reference point — asking a vendor for their status costs nothing. Distribute review copies through a secure screening platform rather than file transfer, restrict downloads, and revoke access when a vendor's work finishes rather than when someone remembers.
Start monitoring before release, not after. Pre-release detection is the difference between containing a leak and discovering one. It also establishes the baseline you will need later to prove anything worked.
Widen the net before you increase the effort. Enforcing harder against a partial view of the problem produces activity rather than results. Coverage comes first.
Run enforcement continuously through every window. Protection scoped to a launch leaves the larger peak and the entire catalogue tail uncovered.
Prioritise by visibility rather than volume. Not every infringing copy carries equal risk. A copy on a high traffic site ranking on the first page of search for your title reaches an audience that an obscure forum post does not.
Measure, then decide. Because exposure cannot reliably be predicted from commercial scale, protection budget allocated on intuition is usually allocated wrongly.
Size the spend against exposure, not asset value. Protection budgets are usually set as a percentage of production or marketing spend, which assumes the relationship between commercial scale and piracy exposure that this data does not support. Measured demand for the specific title, and the length of its tail, are the inputs that should set the number.
When a site ignores the takedown notice
This is the part of anti-piracy that vendors tend not to discuss, and it is the reason experienced buyers are sceptical of removal statistics.
A substantial proportion of piracy infrastructure is deliberately non-compliant. These operators are hosted in jurisdictions chosen for exactly that reason, and no provider can compel them to remove anything. Any vendor implying otherwise is describing a service that does not exist.
Non-compliant does not mean unaddressed, and it is not a fixed property of a site. Notices should still be issued and recorded against these operators, both because the record matters for any later legal or blocking action and because sustained follow-up converts some of them. Compliance is a spectrum rather than a binary, and it moves. A provider who writes a site off as non-compliant and stops there is doing less than the job requires.
Some of them will never comply, and it is worth being precise about what is left when that is the case. The file stays up. The operator is beyond reach. What remains is the audience, and the audience still has to find the site.
That is where the position changes. Search accounts for 27% of traffic to film piracy sites in MUSO's data, and it is the only significant acquisition channel that can be acted on without the host's cooperation. Traffic arriving directly, or by referral from another piracy site, cannot be intervened on at all. So on non-compliant infrastructure, delisting is not one option among several. It is the only remaining intervention that reaches the audience rather than the operator. MUSO has processed hundreds of millions of search delistings on that basis.
Two things are worth stating plainly rather than dressing up. Delisting does not remove the copy, and a user who already knows where to look will still find it. And how much it reduces consumption for a given title is a question we would rather answer with measurement than assertion — which is what title-level demand data exists to settle. What is not in question is the alternative. On a site that will not act on a notice, the choice is not between delisting and something better. It is between delisting and nothing.
How to measure whether anti-piracy is working
If some content cannot be removed, then counting takedowns is the wrong scorecard. A provider can report a large and growing number of notices issued while the audience reaching pirated copies of your title stays exactly where it was.
Worse, takedown counts scale with how narrowly you look. A provider monitoring a limited set of sites will report high removal rates against that set and tell you nothing about the rest. Volume metrics reward incomplete discovery, which is precisely the wrong incentive.
Four metrics answer the question properly.
Piracy demand for the title. Measured consumption of unlicensed copies, tracked over time. This is the outcome. Everything else is an input.
Search visibility. How prominently infringing results appear for the searches your audience actually uses on your title. It is the exposure metric you can actually move on non-compliant sites, and the one that responds when delisting works.
Time from appearance to removal. How long a new copy remains available. Reducing this compresses the peak.
Reappearance rate. How often removed content returns, on the same domain or on a new one. This distinguishes enforcement that holds from enforcement that has to be repeated indefinitely.
All four depend on the same precondition. They are only meaningful if measured across the whole ecosystem rather than across your own provider's activity. Ask what the denominator is, and specifically whether it includes the sites that do not respond to notices. A figure calculated only across compliant hosts describes the part of the problem that was always going to improve.
Enforcement should change the shape of the curve in three ways: a lower peak, a shorter interval between appearance and removal, and a smaller tail. All three are visible in title-level data if you establish a baseline first, which is a further argument for measuring before release rather than after a leak.
How to evaluate an anti-piracy provider
Questions worth asking, whether you are appointing a provider for the first time or reviewing an incumbent.
How do you find a piracy site that did not exist last week? This is the question that separates providers, and it is rarely asked. Piracy infrastructure rotates continuously, so what matters is not the size of a site list but the process that keeps it current, and how quickly a new domain moves from discovery to validation to active enforcement.
What is measured, and is it independent of what you enforce? A provider measuring only its own removals cannot tell you whether piracy of your title went down. Measurement built on a view of the wider ecosystem can. This matters most on non-compliant sites, which are frequently where the audience is. If a provider reports only confirmed removals, those sites can disappear from the picture entirely, because a notice that goes unanswered produces no removal to count. Ask whether infringements on non-responsive sites are reported alongside the rest, and what the provider does to pursue compliance from them over time. Measurement coverage and enforcement coverage are not the same thing, and a provider whose numbers span only the sites that already cooperate will always show you a better picture than the one you are in.
What does your coverage exclude? Every provider has gaps. The useful answer names them.
How are false positives handled? Over-enforcement against legitimate uses such as reviews, press and academic citation creates reputational risk that outweighs the marginal removal.
What is the search delisting capability? Given how much piracy infrastructure is non-compliant, this determines what happens in the cases where takedowns fail.
What does the reporting show, and can you act on it? Ask to see the dashboard. Ask what it would tell you about a title six months after release.
Where does the provider tell you they are weak? The honest answer to this question is more informative than any capability list.
And one worth being candid about from our side. If your requirement is primarily legal action against operators, or blocking orders in specific jurisdictions, the specialist law firms and industry coalitions working in that area are the right first call. Detection, enforcement at scale and measurement are a different discipline from litigation, and the two work best alongside each other.
How MUSO Protect helps
MUSO's starting point is discovery. We have scanned more than 38 billion web pages and maintain a validated database of over 750,000 piracy domains, ingesting and verifying new ones daily as piracy infrastructure rotates. More than 1.2 billion infringements have been identified to date. That breadth is what makes everything downstream credible: enforcement reaches the sites that matter, and measurement is calculated against the ecosystem rather than against our own activity.
Three capabilities matter for film and television rights holders:
Protect runs continuous detection and enforcement across streaming sites, torrent networks, cyberlockers, social platforms and search. Because the site intelligence refreshes daily, enforcement follows piracy infrastructure as it moves rather than trailing behind it. Notices are issued and reported against non-responsive operators as well as compliant ones, and our compliance team pursues those sites directly to bring them into compliance. Where they refuse, search delisting reduces the audience reaching them.
Piracy by Title provides title-level measurement across more than 900,000 films and television titles, covering both streaming and torrent consumption, with regional breakdowns. This is what establishes the baseline, identifies which windows and territories carry the exposure, and demonstrates whether enforcement changed anything.
Piracy by Industry supports policy and strategy work for legal teams, trade bodies and governments, drawing on data from over 70,000 of the highest traffic piracy sites.
The reason MUSO's enforcement data is trusted across the industry is the same reason our demand data is: we measure the whole ecosystem, not only our own activity.
Two ways to start. If a title has leaked, talk to us and we will find the copies you have not, then enforce continuously as new ones appear. If you are planning protection for an upcoming slate, we can measure your existing catalogue first so you have a baseline to work from.
Frequently asked questions
Can film piracy be stopped completely?
No. As long as a digital copy exists, it can be reproduced. What can be reduced, measurably, is how many copies exist, how easily audiences find them and how long they remain available.
How do you stop film piracy?
You reduce it rather than stop it. In practice, that means finding copies early through continuous monitoring, removing what compliant hosts will remove, delisting from search what they will not, and repeating that through every release window rather than treating it as a one-off response to a leak.
How quickly do films appear online after release?
Camcorder copies typically appear within days of theatrical release. High-quality copies usually follow the first digital release. Pre-release leaks from screeners and post-production vendors can appear before theatrical release entirely.
When is a film most at risk?
Not usually opening weekend. On the titles we measure, the largest piracy event most often follows the digital release, weeks after the theatrical peak that tends to prompt the initial response.
Does piracy affect independent films?
Yes. Piracy exposure does not track budget or box office reliably, so a smaller film is not automatically a smaller target. Genre, availability, audience profile and the quality of the available copy all influence piracy demand. And an independent title recoups from a much smaller revenue base, which makes any given level of piracy more damaging to it than to a studio release.
Do DMCA takedowns work?
Against compliant hosts, yes, usually within hours to days. Deliberately non-compliant operators will not act on a notice, though notices should still be issued and pursued, both for the record and because sustained follow-up does bring some operators into compliance over time. In the meantime, search delisting reduces the audience reaching a pirate site even when the file itself cannot be removed.
Is torrenting still the biggest threat?
No. Streaming accounts for 54% of visits to film piracy sites in MUSO's data and torrents for around 13%, public and private combined — roughly a quarter of the streaming figure. Web downloads from cyberlockers and file hosts make up a further 32%. Torrents remain relevant for high-bitrate, 4K and HDR copies. This measures web traffic; IPTV services and messaging platforms sit outside it and are substantial routes in their own right.
How do rights holders detect piracy?
Through continuous automated monitoring of piracy domains, search indexes, social platforms and file hosts, with detections validated before enforcement so that legitimate uses are not actioned. The limiting factor is usually coverage rather than removal capability.
How much protection does a catalogue title need?
More than most owners assume. Piracy demand persists for years after release and spikes around franchise activity, awards attention and seasonal patterns, none of which require new distribution activity to occur.
In summary
Film piracy is not a single event at release. It is a curve with a predictable shape, a second peak most rights holders are not staffed for, and a tail that runs for years.
You cannot stop a determined leak. You can find the copies faster than the audience does, remove what is removable, cut the discoverability of what is not, and prove all of it happened by measuring the title rather than counting the notices.
The rights holders who get the most out of protection are the ones who treat the release calendar as a risk schedule rather than waiting for the call.
If you want to speak to MUSO about anti-piracy protection for a title or catalogue, click Contact Us and a member of the team will be in touch today.
