#1299: Question: can the web platform express "protected playback unavailable" without breaking the sandbox model?

Visit on Github

Opened Oct 30, 2026

Summary

On mobile, subscription video often cannot be played in a browser: the service serves an app-download page instead of a player, or playback fails where the browser has to negotiate content protection. Ordinary video plays fine in the same browser on the same device, so this is not a decoding or bandwidth limit.

Two shapes of the same gap:

  1. The browser exposes a content-protection system the service will not accept, so the user never reaches a player. The refusal happens above the web platform, and the page has no way to detect it and degrade.
  2. The browser exposes no content-protection system the service can use, so the page fails at playback start.

In both cases the web platform has no vocabulary for "premium playback is not available here": a page cannot distinguish "this content is not licensed for this platform" from "this browser is not on the list".

The question

Is this an architectural gap that the web platform should close? Specifically:

  • Should there be a defined way for an application to learn that protected playback is unavailable (a capability signal), so it can degrade instead of failing? Media Capabilities covers decoding, not licensing.
  • Is it architecturally acceptable for a platform to provide its own secure media pipeline behind the same API surface as EME, i.e. keeping the sandbox while making tamper-resistance a platform property rather than a CDM download? If so, who defines the conformance criteria?
  • If neither is acceptable, the alternative is that some content categories are permanently outside the web platform on some platforms. Is that an explicit design position the TAG is comfortable with?

Viewpoints so far

  • Content providers: the bar is a business/licensing decision above the web platform, and it is not published.
  • Browser vendors: the API surface exists; what is missing is a way to surface the refusal.
  • A platform vendor willing to offer a secure pipeline cannot express it in the current model.

Context

<!-- Content below this is maintained by @w3c-tag-bot -->

Track conversations at https://tag-github-bot.w3.org/gh/w3ctag/design-reviews/1299

Discussions