How to Find Out Which Student Leaked Your Online Course

Every course creator finds out the same way: someone sends a screenshot of a Telegram group with your lessons inside it. Then comes the question with no easy answer — which student did it come from?

In most cases, nobody ever finds out. Not because it's impossible, but because the material went out identical to everyone. If all 400 copies are the same, there's nothing in the file that points to a person.

The fix isn't better protection. It's different delivery.

Why blocking downloads doesn't work

The first instinct is to prevent copying: disable downloads, use a DRM-enabled platform, host in a closed members area, serve video through expiring signed URLs.

All of that is worth having as a first layer, and it cuts down lazy leaking. But none of it solves the actual problem, because anyone determined to copy will just record their screen. No DRM stops someone pointing a phone at a monitor.

Accepting that is what unlocks the real solution. You aren't going to prevent copying. You can make every copy point back to whoever made it.

Per-student watermarking

The idea is simple: instead of one watermark for everyone, each student gets a copy carrying a different identifier.

Same video, same PDF, same material — but student A's copy carries one mark and student B's carries another. When the file surfaces where it shouldn't, you read the identifier and know which account it came from.

That completely changes what you're attempting. You stop trying to build an unbreakable wall (impossible) and start making leaks traceable to a person (very doable).

There are two ways to do it.

Personalized visible watermark

The cheap option. Burn the student's email or account ID somewhere in the frame at low opacity, shifting position periodically. Easy to automate with ffmpeg at delivery time.

It works against casual leaking, which is most leaking. The problem is that it comes off easily: crop the edge, or run it through an inpainting tool, which today removes visible marks in seconds even when they cover large areas of the frame.

Invisible (forensic) watermark

Here the identifier isn't drawn on top of the content. It's encoded into the image data itself, spread across the entire frame.

There's no overlay to detect and nothing to paint over. A removal tool doesn't know it's there, because there's nothing visually anomalous to look for.

In practice, a well-built invisible mark survives screenshots, WhatsApp re-sharing (which recompresses heavily), resizing, and moderate cropping. It degrades under aggressive cropping, AI upscaling, and full regeneration of the image.

Which means: it isn't unremovable. None of them are. Any vendor promising an unremovable watermark is lying, and the lie falls apart on the first serious test. That's exactly why an honest implementation returns a confidence score rather than a yes or no.

The prevention effect matters more

Here's the part almost everyone misses.

The value of per-student marking isn't suing anyone. Litigation is slow and expensive, and virtually no course creator is going to pursue it over one leaked copy.

The value is that when your members area states that every copy is individually tagged, casual sharing collapses. And casual sharing is where nearly all leaks come from — not the professional pirate, but the student who forwards it to the class group chat, or to a friend who "wanted to take the course too."

That person doesn't leak once they know the copy has their name inside it.

Traceability is the backup. Deterrence is the product.

Where to start

If you sell a course today and deliver identical files to everyone, the first step costs nothing: put a notice in your members area stating that material is individualized and traceable. That alone changes behavior.

Then decide on the technical layer. Personalized visible marking handles the basics and can be built with free tools. Invisible marking is what survives when someone actively tries to strip it.

The underlying technology isn't new or secret — DWT-DCT methods, Adobe's TrustMark, and the C2PA standard are all public and documented. What was missing was anyone packaging it so a course creator could use it without hiring an engineer.