Why Digital Publishing Needs Real DRM in the AI Era

Sponsored: this article is published in partnership with Locklizard. The research, data, and opinions below are my own, and every factual claim is sourced and linked so you can check it yourself.

TL;DR: AI changed the economics of content theft. A single unprotected PDF is no longer just a copy, it’s raw material that can be summarized, translated, converted to audio, and rebuilt into competing products in minutes. Passwords, download links, and name-stamped watermarks don’t stop any of that. Real DRM won’t stop everything either, but it closes the easy paths and gives publishers enforceable control over legitimate access.

In September 2025, Anthropic agreed to pay $1.5 billion to settle a copyright class action brought by book authors. Roughly 500,000 titles qualified, which works out to about $3,000 per book before fees.

Here’s the part publishers should sit with. The judge in that case ruled that training an AI model on books was fair use if the books were legally acquired. What wasn’t fair use was downloading them from pirate libraries in the first place.

The liability wasn’t the AI. It was the pirated copy.

I have an unusual reason for finding that ruling interesting. Before I ever built a website worth protecting, I made my income on the other side of this economy. As a teenager I scaled to a four-figure monthly income as a “super affiliate” on file-hosting sites, FileServe, Filesonic, Hotfile, MegaUpload. Then the DMCA crackdowns arrived, those companies were shut down, and roughly $2,000 and my entire income stream vanished in a matter of days. One day I had everything, the next I had nothing.

So I’ve watched the piracy economy from inside it and from the receiving end since. What’s different now isn’t that people copy files. It’s what a copied file can become.

This guide covers what actually changed with AI, what the courts and the EU have now put in writing, why the common protections most publishers rely on don’t hold, what real digital rights management controls, and where DRM genuinely can’t help you. No hype about unbreakable protection, because that doesn’t exist.

What Actually Changed: One Leaked File Became a Supply Chain

Digital publishing has always faced unauthorized copying. What AI changed is the value of a single leaked file. Previously, a pirated ebook was worth roughly one lost sale to whoever downloaded it. Now it can be processed into summaries, translations, audio versions, course material, and searchable databases that compete with the original.

Think about the old model. Someone leaked a PDF, it appeared on a download site or in a Telegram group, and other people downloaded the same file. The damage scaled linearly with the number of downloads, and the pirated product was identical to the real one.

Now a single unauthorized user with common AI tools can:

Extract clean text from a PDF that looks protected but isn’t.
Summarize an entire book or a $2,000 industry report into a page.
Translate premium content into a dozen languages, at a quality level that is now close enough to human translation for most commercial purposes.
Convert written material into synthetic audio or video.
Generate blog posts, study guides, newsletters, or a whole course from the source.
Upload the document into a private AI knowledge base.
Search and interrogate an entire collection of stolen documents at once.

That last one deserves attention. A pile of 500 pirated technical books used to be a pile of files nobody had time to read. Fed into a retrieval system, it becomes an expert chatbot that answers questions using your material, without ever reproducing a single page verbatim. If the terminology here is unfamiliar, our AI glossary covers retrieval, training data, and the rest of the vocabulary.

The derivative problem

This is where the damage becomes hard to see and hard to enforce. A specialist industry report becomes thirty blog posts. A textbook becomes a question bank. A paid training manual becomes an AI tutor. A collection of ebooks becomes the reference library behind a commercial assistant.

The original may never appear publicly, word for word, anywhere. Its commercial value still gets extracted and resold.

Traditional anti-piracy thinking looks for copies. You search for your title, find the download link, file a takedown, move on. That approach finds almost none of this, because there is no copy to find.

The $1.5 Billion Lesson from Bartz v. Anthropic

The Bartz v. Anthropic settlement is the clearest financial signal publishers have received about the value of controlled distribution. It established that where AI training material came from matters legally, even where the training itself was permitted.

The case was filed by nonfiction authors Charles Graeber and Kirk Wallace Johnson, and thriller author Andrea Bartz. In June 2025, Judge William Alsup of the Northern District of California split the question in two on summary judgment.

Training AI on books was fair use, he ruled, where those books were legally acquired. Downloading them from the pirate libraries LibGen and PiLiMi was not. He certified a class only for the piracy, not for the training.

According to the Authors Guild’s summary of the settlement, about 500,000 titles met the class definition out of roughly 7 million copies Anthropic had downloaded. Rightsholders can expect at least $3,000 per title before fees, split between author and publisher under a default 50/50 arrangement for trade titles. Self-published authors and those whose rights reverted keep the full amount.

Reuters reported the settlement received judicial approval in July 2026. It is the largest copyright settlement in United States history.

What that means for how you distribute

Strip out the legal detail and one commercial fact remains: the pirated copies were the liability. Legitimate acquisition was defensible, unauthorized acquisition cost $1.5 billion.

That reframes DRM from a defensive cost into something closer to inventory control. Every uncontrolled copy of your content is a copy that can enter a training set, a competitor’s product, or someone’s private knowledge base, with no record of how it got there and no license attached to it.

There’s also a sobering detail in the eligibility rules. To qualify, a book needed an ISBN or ASIN and a timely US Copyright Office registration. Authors whose publishers never registered the copyright were excluded from a settlement their book was otherwise part of. Control and paperwork both mattered.

The Financial Damage Runs Wider Than a Lost Sale

Not every pirated copy is a lost sale, and honest analysis has to admit that. Plenty of people who download unauthorized content were never going to buy it. That doesn’t make the damage imaginary, it makes it harder to count.

The real losses show up in places most publishers don’t attribute back to leakage:

Direct revenue. The straightforward part, and usually the smallest part.
Subscription and membership renewals. If the archive is freely circulating, renewal logic weakens for everyone in the group.
Institutional and enterprise license value. A license priced for 50 concurrent readers is worth less if it functions as unlimited access.
Territorial and format licensing. Uncontrolled distribution undercuts the exclusivity that regional and format deals are priced on.
Enforcement cost. Takedowns, monitoring, and legal time are real operating expenses.
Investment confidence. The quiet one. Publishers stop commissioning specialist work when the return can’t be defended.

For independent authors and mid-list writers, a modest drop in paid readership decides whether the next book happens. For a professional publisher, leakage in one flagship title can damage an entire product line, because the leaked title is often the one that sells the subscription.

Most publishers rely on protections that were designed to discourage casual sharing, not to control content. Password-protected PDFs, unlisted download URLs, buyer details printed on a page, and static watermarks all fail against a motivated user, and all of them fail completely against AI-assisted extraction.

Run through them honestly:

Passwords travel with the file. Whoever shares the PDF shares the password in the same message. It’s a speed bump, not a control.

Download links get forwarded. An unlisted URL is security by obscurity. One post in a group chat ends it.

PDF permission flags are advisory. The “no copying” and “no printing” settings in a standard PDF are instructions that compliant readers choose to honor. Plenty of tools ignore them entirely. This is the single most common misunderstanding I see: publishers believe those checkboxes are enforcement, when the file itself is still fully readable.

Once an ordinary PDF or EPUB lands on someone’s device, the publisher has essentially no remaining control over it.

Social DRM stamps a buyer’s name, email, or order number into the document. The theory is accountability: you’re less likely to share a file that identifies you.

As a deterrent it has genuine value, and for low-risk consumer content it may be all that’s warranted. But be clear about what it does and doesn’t do. Social DRM does not prevent copying, printing, screen capture, text extraction, format conversion, or continued access after a license expires. It identifies a probable source after a leak.

In the AI era that timing gap matters more than it used to. By the time you discover a watermarked file circulating, the contents may already have been extracted, translated, restructured, and loaded into three separate systems. You have a name. You don’t have containment.

Why static watermarks provide limited protection

A visible watermark discourages screenshots and casual redistribution. It does not survive cropping, editing, reformatting, or text extraction, and text extraction is the step that matters for AI reuse. The watermark sits in the visual layer. The text layer walks out untouched.

Dynamic watermarks are meaningfully stronger. They display user-specific information that changes per session, such as the reader’s identity, account, date, or IP address, which makes screen capture traceable and psychologically less attractive. Even then, a watermark is one layer inside a system, not the system.

What Real DRM Should Actually Control

Effective DRM is not a padlock icon or a password prompt. It’s a set of technical controls that determine who can open a document, on which devices, for how long, and what they’re able to do with it once it’s open.

Depending on your publishing model, a serious system should cover:

Encryption of the document itself, not just the delivery link. The file stays protected wherever it ends up.
User or device binding, so credentials can’t be shared without limit.
Controls on printing, copying, editing, and text extraction, enforced by the viewer rather than requested politely.
Expiring access for rentals, subscriptions, course enrollments, and temporary licenses.
Limits on authorized devices or concurrent users, matching what the license actually sold.
Dynamic watermarks tied to a specific user and session.
Remote revocation when a license ends, a subscription lapses, or misuse is detected.
Governed offline access, so readers aren’t punished by a weak connection but licenses still apply.
Access logs and admin controls for compliance, auditing, and license reporting.

No single item on that list is protection by itself. The value comes from combining encryption, identity, licensing, and usage rules into something that stays manageable for a legitimate reader.

That last clause is the hard part, and it’s where most DRM earns its bad reputation. More on that below.

DRM and AI Crawler Controls Solve Completely Different Problems

Publishers now have real tools for controlling automated access to web content, and 2025 was the year they got teeth. But crawler controls and document DRM protect different things, and confusing them leaves a gap wide enough to drive a leak through.

What changed on the crawler side

On July 1, 2025, Cloudflare began blocking AI crawlers by default for new domains, and launched Pay Per Crawl, which lets publishers charge AI companies for access instead of simply denying it. Given how much of the web sits behind Cloudflare, that single default change did more for publisher leverage than a decade of robots.txt etiquette.

The law moved in the same direction. Under Article 53(1)(c) of the EU AI Act, in force since August 2, 2025, providers of general-purpose AI models must have a policy to identify and respect rights reservations made under Article 4(3) of the DSM Directive. Article 53(1)(d) requires them to publish a sufficiently detailed summary of training content using the AI Office’s template.

The accompanying Code of Practice explicitly recognizes robots.txt as a valid way to reserve rights. In other words, a machine-readable “no” on your website now carries regulatory weight it didn’t carry two years ago.

The gap nobody talks about

Here’s the problem. Article 4(3) of the DSM Directive requires that, for content made publicly available online, the opt-out be expressed by machine-readable means.

A downloaded PDF has no robots.txt.

Once your report is sitting in someone’s Downloads folder, there’s no crawler to block, no directive to publish, and no hostname to attach a rights reservation to. Crawler controls govern automated access to content you host. They do nothing about a file after an authorized human has downloaded it and uploaded it somewhere else.

Contract terms have the same shape of limitation. A license clause prohibiting AI training creates a legal restriction. It does not technically prevent anyone from dragging your PDF into a chat window.

A complete strategy therefore needs four layers, and they are not substitutes for each other:

Website and crawler controls to govern automated discovery, indexing, and training access.
Contracts and license terms defining permitted and prohibited uses, including AI reuse.
DRM and access controls restricting what authorized users can do with delivered files.
Monitoring and enforcement to detect leaks and act on them.

DRM is the technical enforcement layer inside that strategy. It is the only one of the four that keeps working after the download.

Control Is What Makes Content Licensable

There’s a commercial argument for DRM that gets overlooked because everyone frames protection as defense. Control is also what lets you sell the same content twice.

The AI licensing market made this concrete. Taylor & Francis was reported to expect around $75 million from AI licensing deals in a single year, with an initial Microsoft agreement worth about $10 million. Wiley disclosed expectations of around $44 million from its AI partnership.

You can only license what you control. A publisher whose catalog is already circulating freely in pirate libraries is negotiating from a weak position, because the buyer can ask a reasonable question: what exactly am I paying for?

I’ll add the uncomfortable half of that story, because it’s the honest part. In several of those deals, authors could not opt out, and many found out from the news rather than their publisher. Author groups objected loudly and they were right to. Control being valuable is precisely why it matters who holds it and what the contract says. DRM strengthens whoever owns the rights, so publishers and authors both should care about how those rights are allocated before the licensing conversation starts.

Institutional Licensing Depends on Enforceable Access

Libraries, universities, training providers, professional bodies, and enterprises license content under specific conditions: reader counts, locations, subscription periods, devices, concurrent sessions. Those conditions are the product. Without technical enforcement, they’re just a sentence in a PDF.

Consider a university licensing a digital textbook for a fixed number of concurrent readers. Both sides need assurance the limit means something. A capable DRM system handles this through user authentication, device authorization, access duration, and concurrency limits, and lets an administrator revoke access when a course ends, an employee leaves, or a subscription lapses.

Worth stressing: this protects the institution too, not just the publisher. Compliance teams need to demonstrate they’re using licensed content within terms. Enforceable access turns that from a promise into a report.

Confidential and high-value publications

Institutional publishing isn’t only textbooks. It’s board papers, standards documents, technical manuals, certification materials, internal research, and paid analyst reports.

For this category, leakage isn’t primarily a copyright problem. It’s a confidentiality, compliance, and competitive problem, and sometimes a regulatory one. Ordinary file permissions and a shared drive are nowhere near sufficient. What’s needed is document-level control that survives delivery, plus a log of who opened what and when.

Protecting Authors and the Wider Creator Economy

Publishing supports a chain of people, not just an author. Editors, illustrators, researchers, translators, designers, narrators, developers, and distributors all depend on the work retaining commercial value.

When a paid work can be copied and transformed without restriction, the damage travels down that chain. The revenue that would have funded editing, design, marketing, advances, translations, and the next commission simply isn’t there.

Large bestsellers absorb piracy. They have enough demand that leakage is noise. Independent authors, technical writers, academic specialists, and niche publishers operate on much thinner margins, and for them the audience is the market.

Picture a specialist publication written for perhaps 2,000 professionals worldwide, representing years of research. If one buyer redistributes it across an industry association, or turns it into an AI assistant their colleagues query instead of buying the report, the addressable market is gone. Not reduced. Gone.

Effective DRM preserves a simple principle: access should follow the license that was purchased, and creators should keep control over uses nobody authorized.

Security That Doesn’t Punish Legitimate Readers

DRM has a deservedly poor reputation, and pretending otherwise would be dishonest. Early systems created genuine misery: convoluted activation, arbitrary device limits, proprietary software that stopped working, content people paid for becoming unreadable when they changed computers.

The criticism was fair. Security that makes the paid product harder to use than the pirated one doesn’t reduce piracy, it advertises it.

The design principle that fixes this is proportional control. Match the restriction to the risk and the price:

Content type	Sensible controls	Overkill
Low-cost consumer ebook	Dynamic watermark, light device limit	Per-session reauthorization
Paid course or training material	Expiring access, device binding, copy controls	Permanent offline lockout
Corporate or analyst report	Encryption, revocation, logs, no printing	Nothing, honestly
Institutional textbook	Concurrency limits, expiry, admin revocation	Per-page authorization

A temporary course license needs an expiry date. A permanently purchased ebook needs dependable long-term access on approved devices, including after a laptop dies. Those are different products and they deserve different rules.

The goal isn’t treating every reader as a suspect. It’s making the permitted experience obvious and frictionless while closing the paths that cause real damage.

Interoperability in a Multi-Device World

Readers move between laptops, tablets, and phones and expect their purchase to follow. Institutions support mixed operating systems, remote workers, and managed devices. A DRM system that only works in a narrow environment generates support tickets and quiet non-adoption.

Before committing to any system, get straight answers on:

Which platforms are genuinely supported, including the ones your audience actually uses rather than the ones on the feature matrix.
How a license is recovered when a device is lost, replaced, or wiped.
How offline access works, and what happens when the license check can’t run.
Whether an administrator can resolve an access problem without disabling protection for everyone.
What happens to purchased content if you stop paying the DRM vendor. This one gets skipped and it shouldn’t.

Ease of use and strong protection aren’t opposites. A well-built system keeps authentication and license management simple for authorized readers while the underlying document stays encrypted and governed.

What DRM Cannot Do

Any vendor promising complete protection is overselling, and you should treat that claim as a reason to look harder at everything else they say.

DRM cannot stop someone photographing a screen with a phone. It cannot stop manual retyping. It cannot stop a determined person filming a monitor, and it cannot stop someone with legitimate access from remembering what they read and writing something similar.

What it does is change the economics. It removes the easy methods, prevents unrestricted file sharing, ties access to a license, adds accountability through traceable watermarks, and gives you the ability to revoke.

It also helps to understand how models actually consume documents. A long report does not enter a model as a document; it is broken into tokens and processed in chunks, which is why clean extractable text is so much more valuable to a scraper than a photographed page.

Against AI-assisted reuse specifically, that matters more than it sounds. The threat model isn’t one person retyping a book. It’s clean, automated text extraction at scale. A system that forces manual photography of 400 pages has not achieved perfect security, but it has destroyed the economics of the attack, which is the actual objective.

Think of it the way you’d think about locks. No lock is unpickable. You still fit one, because the point is to make the effort exceed the reward.

A Practical Layering Checklist

If you publish paid digital content and you’re deciding what to do about this, here’s a sequence that reflects the layers above.

Classify your catalog by damage, not by price. Which titles would hurt most if they leaked tomorrow? That’s usually the flagship report or the certification material, not the highest-priced item.
Fix the crawler layer first, because it’s free. Set robots.txt directives for AI crawlers, check your CDN’s AI bot settings, and confirm gated content isn’t reachable without authentication. Our guide to how AI search engines work explains what those crawlers are actually doing with what they collect.
Write the AI clause into your license terms. Explicitly address AI training, ingestion into knowledge bases, and derivative generation. It won’t prevent anything technically, but it’s what enforcement rests on.
Apply document-level DRM to the high-damage tier. Encryption, device binding, expiry, revocation, dynamic watermarks. Match controls to risk rather than applying maximum restriction everywhere.
Register your copyrights properly and on time. The Anthropic class showed exactly what happens to authors whose registrations were missing or late: exclusion.
Log and monitor. Access logs make patterns visible. Periodic searches for your title and distinctive phrases catch redistribution.
Review the reader experience yourself. Buy your own product, on your own worst device, and see whether the protection is tolerable. If it annoys you, it will drive customers to the pirated copy.

Steps 2, 3, 5, and 7 cost nothing but attention. Start there before you buy anything.

Frequently Asked Questions

Does DRM stop AI companies from training on my book?

Not directly, and no honest vendor claims otherwise. DRM reduces the chance that a clean, extractable copy of your book ends up circulating where a scraper or a user can feed it into a model. Crawler controls, machine-readable rights reservations, and license terms handle the legal and web-access side. DRM handles the file after download, which is the layer the others can’t reach.

Is a password-protected PDF enough protection?

No. The password travels with the file whenever it’s shared, and PDF permission settings for copying and printing are advisory instructions that many tools ignore. Once the document is open, the text layer can be extracted in seconds. Password protection deters casual sharing and nothing beyond that.

Social DRM stamps buyer information into the document to create accountability, so a leak can be traced back to a source. Real DRM applies technical controls: encryption, device binding, expiry, printing and copying restrictions, and remote revocation. Social DRM identifies who leaked a file after the fact. Real DRM limits what can be done with it in the first place.

Do robots.txt rules protect my ebooks and PDFs?

They protect content on your website from compliant crawlers, and under the EU AI Act’s Code of Practice, robots.txt is now recognized as a valid way to reserve rights against text and data mining. But a downloaded file has no robots.txt attached. Crawler rules govern access to what you host, not what a user has already saved.

Will DRM hurt my sales by annoying readers?

It can, if you apply the wrong level of control. Restriction that makes the paid product harder to use than the pirated one damages trust and pushes people toward workarounds. The workable approach is proportional control: heavier restrictions on high-value confidential material, lighter ones on low-cost consumer titles, and a reader experience you’ve tested yourself.

What did the Anthropic settlement actually decide about AI and books?

The court ruled that training on legally acquired books was fair use, but downloading books from pirate libraries was not, and certified a class for the piracy only. Anthropic settled for $1.5 billion covering roughly 500,000 titles, about $3,000 per title. The decision penalized how the material was obtained rather than the training itself.

The Exchange That Has to Keep Working

Digital publishing runs on a straightforward trade. Readers get convenient access to valuable content. Creators and publishers keep enough control to be paid for producing it.

AI doesn’t remove that trade. It puts far more pressure on the boundaries around access, reuse, transformation, and licensing, because the value that can be extracted from one uncontrolled copy is now much larger than the price of that copy.

The single most useful shift in thinking is this: stop asking “how do I stop people copying this?” and start asking “what can someone do with this file after they legitimately receive it?” That question leads you to controls that still function after download, which is exactly where crawler rules, contracts, and takedown notices all stop working.

Real DRM supports those boundaries through encryption, controlled viewing, device and user binding, expiry, revocation, usage restrictions, and dynamic watermarking. Combined with clear AI licensing terms, crawler controls, monitoring, and a reader experience that doesn’t punish paying customers, it gives publishers a defensible position in an AI-driven market.

If you publish ebooks, reports, training materials, or other PDF-based content and want to control how it’s accessed after delivery, Locklizard builds document security tools designed for exactly this kind of controlled distribution.

Disclosure: this is a sponsored placement in partnership with Locklizard. I have not tested their product, and nothing in this article is a performance claim about it. Verification note: the Bartz v. Anthropic figures come from the Authors Guild’s settlement summary and Reuters, checked on August 1, 2026. EU AI Act obligations under Article 53 took effect August 2, 2025. Cloudflare’s default AI crawler blocking began July 1, 2025. Publisher AI licensing figures are as reported in the trade press for 2024. I have not tested any DRM product hands-on for this article, so treat the feature discussion as a framework for evaluating vendors rather than a product recommendation. Money never buys a positive claim here; it buys the placement, not the findings.