Do your PS5 digital games expire? What Sony's DRM is and how far the law lets it go

What happened with PS5 DRM and the 30-day licence check

In late April 2026 several players and content creators noticed that PS4 and PS5 digital games bought from March onwards showed a 30-day validity period with a countdown. The first reading was the worst possible one: DRM forcing the console online every month for games to keep working, like the one Microsoft announced for Xbox One in 2013 and had to withdraw. Some answers from PlayStation customer support fed that idea, and for days the gaming press talked about digital games that "expire".

Sony responded on 30 April through a spokesperson, in statements reported by the trade press: players can continue to access and play their purchased games as usual, and a one-time online check after purchase is required to confirm the licence, with no further check-ins needed. In other words: the licence starts as provisional and becomes permanent once the console manages to validate it with Sony's servers.

What Sony has not explained in detail is what happens if the console never connects during that initial period, or why it introduced the system. User testing suggests the licence is locked in after the refund window, but that is not official information and should be treated as such.

What DRM in games is and why you do not buy the game

DRM stands for Digital Rights Management. In the language of the law they are technological measures: techniques, devices or components which, in their normal operation, are designed to prevent or restrict uses of a work not authorised by its rightholder (Article 196(3) of the Spanish Intellectual Property Act). In games they range from encryption of the disc or download to online licence checks, binding to an account or console, and anti-tamper systems such as Denuvo on PC.

To understand why they exist you have to start from an idea that surprises many players: when you buy a digital game you do not buy the game. You buy a licence, that is, permission to use it on certain terms. The intellectual property stays with the studio or publisher, which decides how the work is exploited. We explained it in detail in buying a game online: licence or ownership?, following the Ubisoft games that stopped working when their servers were switched off.

DRM is the technical tool the rightholder uses to enforce that licence: whoever paid plays, on the agreed terms, and the game is not copied or redistributed. That is also why some stores and studios sell DRM-free games that work without any check: it is a commercial choice of the rightholder, not a legal duty.

What the law says: DRM as a technological protection measure

DRM is not merely a commercial decision by Sony. It has express legal backing.

In the European Union, Article 6 of Directive 2001/29/EC requires Member States to provide legal protection for effective technological measures against circumvention. In Spain this is done by Article 196 of the Intellectual Property Act (formerly Article 160, renumbered by Royal Decree-law 2/2018 and Law 2/2019): the rightholder can bring the Act's civil actions against anyone who, knowingly or having reasonable grounds to know, circumvents any effective technological measure, and against anyone who makes, sells, advertises or possesses for commercial purposes devices or services designed to circumvent it.

There is a nuance that matters a great deal in video games. Article 196 itself excludes measures protecting computer programs, which follow their own rule: Article 102(c) of the same Act treats as an infringer anyone who puts into circulation or possesses for commercial purposes any means whose sole purpose is to facilitate the unauthorised removal or neutralisation of devices protecting a program. And a video game is both at once. The Court of Justice of the EU settled this in 2014: video games are "complex matter" comprising a computer program and also graphic and sound elements with their own creative value, and those original parts are protected by Directive 2001/29 together with the work as a whole (judgment of 23 January 2014, Case C-355/12, Nintendo, paragraph 23). That is why DRM on a game enjoys the general protection of technological measures, not only that of software.

On the criminal side, Article 270(6) of the Spanish Criminal Code punishes with six months to three years in prison anyone who makes, imports, puts into circulation or possesses for commercial purposes any means primarily designed to remove or neutralise the technical devices protecting computer programs or other works.

The limit: proportionality in the Nintendo case

The law protecting DRM does not mean any DRM goes. The same Nintendo judgment set the limit. Nintendo protected its games with a recognition system installed both in the cartridges and in the consoles, and an Italian company sold devices that disabled it and allowed, among other things, third-party programs to run. The Court held that legal protection is only granted to measures pursuing the objective of preventing acts not authorised by the rightholder, and that those measures "must be suitable for achieving that objective and must not go beyond what is necessary for this purpose" (paragraph 31).

It also gave national judges the method: ask whether other measures would have caused less interference with third parties' legitimate activities while giving comparable protection to the rightholder, weighing their costs, their technical and practical aspects and their effectiveness, which need not be absolute (paragraphs 32 and 33).

Applied to Sony's system, as the company itself has described it, the outcome is favourable. The check:

• does not require a permanent internet connection,
• does not limit use of the game once the licence is validated, and
• does not introduce periodic controls over what the player does.

In other words, it interferes little and protects what it needs to protect. What would be hard to defend is a system forcing players online every month to keep playing a single-player game with no online component, which is exactly what was feared for a week. That kind of control goes well beyond what is needed to prevent illegal copies.

Why a single check: refund fraud

Sony has not officially explained the reason, but the most widespread theory in the industry makes sense. PlayStation refunds digital purchases within 14 days if the game has not been downloaded or played. With hacked consoles it was possible to buy a game, extract its licence before downloading it to use it indefinitely, and then ask for a refund. A provisional licence that only becomes permanent after a post-purchase check closes that route.

If so, the system protects more than the work: it protects the refund policy itself, which benefits consumers and is only sustainable if it does not become a door to piracy. It is a good example of proportionate DRM: it targets a specific abuse without punishing the paying player.

First requirement: tell buyers before they pay

Proportionality looks at DRM from the intellectual property side. Consumer law looks at it from the buyer's side, and requires players to know before paying what technical measures the game carries.

The Spanish consumer protection law requires traders to disclose, before the contract, the functionality of goods with digital elements, digital content and digital services, including applicable technical protection measures such as digital rights management or regional coding (Article 60(2)(i)). For distance sales, such as an online store, the duty is repeated in Article 97(1)(s), together with the duty to disclose relevant compatibility and interoperability (Article 97(1)(t)). Both transpose the EU Consumer Rights Directive, so the same rule applies across the Union.

Put practically: if a game needs a connection to validate the licence, that must be on the store page, clearly and before the buy button. What sparked the April controversy was exactly the opposite: a countdown that appeared with no explanation and that players had to interpret on their own. The information came afterwards, from a spokesperson, when the legal duty is to give it beforehand.

Second requirement: it must work (and what if servers go down)

The second limit lies in the conformity of digital content. Since 2022, Spanish consumer law (transposing the EU Digital Content Directive) requires digital content or services to have the accessibility and continuity and functionality normal for the same type and that the consumer can reasonably expect (Article 115 ter(1)(d)).

If a server outage, a system error or the shutdown of the verification service prevents a player from validating or launching a game they bought, DRM stops being a protective measure and becomes the reason the product does not work. In that case the game is not in conformity with the contract, and the consumer can demand that it be brought into conformity and, failing that, a price reduction or termination of the contract with a refund.

This is the point that should worry anyone designing DRM with online checks: the day the servers shut down, the protection becomes a legal problem if the game can no longer be used without them.

Is it legal to remove DRM or jailbreak a PS5?

It is one of the most searched questions, and the answer has nuances.

• Removing or circumventing a game's DRM to use it in a way the rightholder has not authorised (copying it, playing without a licence, unlocking paid content) is an act of circumvention of an effective technological measure, and gives the rightholder civil actions against whoever does it (Article 196(1) of the Spanish Intellectual Property Act).
• Making, selling or distributing tools designed to break those protections is more serious: civil actions and, on top, the offence in Article 270(6) of the Spanish Criminal Code.
• Modifying the console you bought is not illegal in itself, but a jailbreak usually serves precisely to neutralise the system's protections and run unauthorised copies, and that is where all the above comes in. It also breaches PlayStation Network's terms, with the risk of Sony closing the account.

The Nintendo case adds a final nuance: legal protection does not reach devices whose main use is something other than circumventing protection, and the judge must look at what they are actually used for. We also saw it when discussing who owns a video game mod: modding is not the same as pirating, even if the same tools are sometimes used.

What your studio should do if it protects its game with DRM

The Sony controversy is a guide to what to get right from the start:

• Choose proportionate protection. A check at purchase or first launch, yes. A permanent connection for a single-player game, only if justified, documenting why there was no less intrusive alternative.
• Explain it on the store page. What the game requires (account, connection, verification), when, and what happens without internet. It is a legal duty, not a marketing detail.
• Review your contract with the platform and the publisher. Who decides the DRM, who is liable if it fails and who pays the licence for tools such as Denuvo. If the publisher wants to impose a platform on you, see also publisher platform exclusivity. We covered it when discussing the PlayStation Store and Sony's power over studios.
• Plan the shutdown. If the game depends on servers, have a patch ready that removes the check when the service closes. It is the cheapest way to avoid non-conformity claims.
• Go after circumvention, not the player. The actions under Article 196 of the Intellectual Property Act and Article 270(6) of the Criminal Code are designed for those who distribute tools or copies, which is where the harm lies.

Frequently asked questions

Sources