Cloud gaming piracy: how it works and how game publishers can stop it

Cloud gaming piracy is streaming someone else's game to players from your own servers without the rights holder's permission, or selling access to accounts and cloud machines so that many people play on one paid copy. Courts in China have held such services liable: in 2020 and 2021, the internet courts in Hangzhou and Guangzhou ordered operators that had put publishers' games on their own cloud servers without authorisation to stop and to pay damages.^1,2,3 To act against it, report the service to whoever hosts it, to the app stores that distribute its apps and to the payment providers that take its money, as with other piracy. Enforce your terms against account sharing and resale, check ownership on your own servers rather than in the game client, and license cloud streaming deliberately: the major cloud platforms ask publishers to opt in.^4,5,6,7,8,9 Court steps go through independent counsel.

What cloud gaming piracy looks like

Unlicensed cloud gaming services

Cloud gaming runs the game on a remote server and streams the picture to the player. As the Guangzhou Internet Court described it, the rendering, data synchronisation and game logic all run on cloud servers, with nothing for the player to download or configure.³ An unlicensed service does the same with games it has no right to stream. The documented cases come from China.

• Hangzhou, 2020. In August 2020 the Hangzhou Internet Court decided what local press called China's first 5G cloud gaming infringement case. A platform had put a publisher's online PC games on its cloud servers without authorisation, offered them through a website and Windows, Android and iOS apps, and sold paid queue-skipping and extra-time cards. The court ordered it to stop, to delete the related user data and to pay RMB 2.58 million in total.¹
• Guangzhou, 2020 and 2021. In April 2020 the Guangzhou Internet Court issued what was reported as its first injunction in a cloud gaming lawsuit: after the applicant lodged security, it ordered a cloud PC service to delete a game it had pre-installed without authorisation and used commercially, and to stop using the game in its promotion.² In a judgment of June 2021, which it published as a featured case in March 2024, the same court held that an operator that downloaded five online games from the rights holder's own website and uploaded them to its cloud gaming platform had infringed the right of communication through information networks, though not the right of reproduction. It rejected a fair-use defence, noting the operator's planned paid features, and awarded RMB 800,000 plus RMB 80,000 in costs. The claims against the app store that distributed the platform's app were dismissed; the store said it had taken the app down promptly.³

The right these courts applied is making a work available by wire or wireless means so that the public can access it at a time and place of their own choosing.¹² Whether streaming a game engages an equivalent right in your markets is a question for independent counsel (see the law below).

Cloud PCs with games pre-installed

Some services rent out remote Windows machines with games already installed. In the Guangzhou injunction, the operator argued that its platform was a cloud PC, not cloud gaming; the court still found the game had been pre-installed without authorisation and used commercially.² Legitimate providers put the rights burden on the user: GeForce NOW's terms say that NVIDIA or a partner is renting the member a virtual PC for gaming, and that it is the member's responsibility to have sufficient rights to use the content.²²

One paid copy, many players

Cloud services and cloud PCs run games from players' store accounts, so a single purchase can be put in front of many people. Store and platform terms forbid that:

• Steam's Subscriber Agreement says users may not sell or charge others for the right to use their account, or use it to enable others' commercial use of Steam content and services.⁷
• The Microsoft Services Agreement, which covers Xbox, says users cannot transfer their account credentials, and bars renting, leasing, selling or lending the services.¹³
• PlayStation's Community Code of Conduct says not to share, buy, sell, rent, sublicense, trade or transfer accounts, account details or other credentials.¹⁴
• GeForce NOW's licence is non-transferable and for one session at a time; its terms bar selling or renting any part of the service, and NVIDIA may inform the publisher if it suspects a game's terms are being broken.²²

Courts have backed operators against the rental trade: a Shenzhen district court ordered an account-rental platform to stop renting out a game operator's accounts and to pay RMB 300,000.¹⁵

Stolen accounts feed the trade

Not every resold account was shared willingly. Kaspersky counted about 11 million gaming-account logins leaked by infostealer malware in 2024, traded or shared on darknet platforms, according to a report in the New Straits Times.²³ OWASP describes credential stuffing, testing username and password pairs taken from another site's breach, and calls multi-factor authentication by far the best defence against it.²⁴

Licensing disputes are not piracy

Not every unexpected cloud listing is piracy. In May 2020 NVIDIA moved GeForce NOW to an opt-in model: from the end of that month, only games that developers and publishers had opted in would stay available.¹⁰ Its FAQ says members need to own or buy a game from a supported store, apart from free-to-play games, and that Install-to-Play titles are Steam games whose publishers have opted in to Steam Cloud Gaming.²⁵ Valve's documentation says developers must opt in manually the games they want on GeForce NOW, after signing the Steam Cloud Gaming Addendum, and lists an NVIDIA address for publisher feedback.⁹ Xbox Cloud Gaming lets members stream select games they own, a library Microsoft says will grow as it works with its partners.²⁶ If your game appears on a mainstream platform you didn't license, start with your agreements and the platform's partner contacts.

Is cloud gaming itself an anti-piracy measure?

Partly. The game runs on the host's servers, so players never get the program code; the description of a 2021 US patent on streaming games from a hosting service says that, for that reason, "there is nothing to pirate".²⁷ The protection stops at the official service. The Guangzhou case began with game clients downloaded from the rights holder's own website,³ store accounts can be shared, and mainstream cloud services stream the copies players own on PC stores, so a downloadable build still exists.²⁵

Before you report: what to collect

• Where the service lives: its domains, its apps and their store listings, and the hosting provider behind it. If a site uses Cloudflare, Cloudflare gives copyright holders the host's contact details.²⁸
• Captures that hold up. The Berkeley Protocol on digital open-source investigations treats a page's URL, its HTML source and a full-page capture with the date and time as a minimum standard for evidence in court, with a hash value added at the point of collection and a record of who held the material and when (the chain of custody).²⁹
• Proof of your rights, and that the service has no licence: your ownership, the cloud streaming licences you have granted, and a statement that the service isn't among your licensees. Mastercard, for one, asks for an attestation that the site is not licensed.³⁰
• How it takes money: checkout pages that show the payment brands. Visa asks for evidence of Visa acceptance, such as its logo at checkout, and Mastercard for evidence that the product can be bought with a Mastercard.^19,30
• Test purchases only through counsel. Stripe encourages test purchases but doesn't require them, and Visa highly encourages them.^19,31 Never buy an account to test a service: PlayStation's code of conduct bars buying accounts, and the Berkeley Protocol warns against gaining access with leaked passwords or by deception.^14,29
• Your own records: the account IDs, licence checks and session patterns your servers saw, such as many sessions on one account or sign-ins from hosting networks.

Where to report

Where to report cloud gaming piracy (checked 22 October 2026):

Details that matter:

• Cloud and hosting providers. AWS sends an automated acknowledgement, says it will act expeditiously on a complete and valid notice, including contacting its customer, and gives the customer a copy of the complaint with your contact details; it asks you not to report the same issue again and again.^4,32 Microsoft takes notices for its other online services through its Notices of Infringement portal, or by email or post, which it says takes substantially longer.¹⁶
• App stores. Apple's guideline 4.7 allows apps that offer streaming games but makes the developer responsible for all such software, including its compliance with applicable laws.³⁹
• Payment providers. Stripe says it cannot take down an offering, only decide whether to keep serving the business, and asks for evidence that the business uses Stripe.³¹ Visa accepts reports only from the rights owner or an authorised attorney, after earlier enforcement such as cease-and-desist letters.¹⁹ Mastercard asks for copies of at least three cease-and-desist letters or DMCA notices; the acquiring bank then has five business days to investigate and report back.³⁰
• Communities and promotion. For Discord, Telegram, GitHub, search engines and streaming channels, see our guide to private servers, cheat sellers and pirated APKs, which covers them route by route.

What a notice needs

• In the US, section 512(c)(3) lists six elements: your signature; the copyrighted work; the infringing material and where it is; your contact details; a statement of good-faith belief that the use isn't authorised; and a statement, under penalty of perjury, that the notice is accurate and that you are authorised to act.⁴⁰
• In the EU, a notice under Article 16 of the Digital Services Act gives a sufficiently substantiated explanation, the exact URL or URLs, your name and email address, and a statement of your good-faith belief. A notice gives the provider actual knowledge where a diligent provider can identify the illegality without a detailed legal examination.⁴¹
• In India, a notice to a service that stores copies transiently or incidentally describes the work, shows your ownership or exclusive licence, explains why the copy infringes and where it is, and undertakes to produce a court order within 21 days; the recipient stops facilitating access within 36 hours of a notice it accepts.^42,43
• Be accurate. In the US, anyone who knowingly materially misrepresents infringement is liable for damages; under the Digital Services Act, platforms suspend, after a warning, the processing of notices from those who frequently submit manifestly unfounded ones.^40,41

The law, through independent counsel

This summarises the statutes and official texts as we read them on 22 October 2026. It isn't legal advice: court and enforcement steps are for independent counsel in each country.

• United States.
  • Rights: copyright includes the right to perform audiovisual works publicly, which covers transmitting them to the public in separate places and at different times.⁴⁴ Whether a game stream is a public performance is a question for counsel.
  • Notices and identities: section 512 sets out notice and counter-notice: after a counter-notice, the material returns between 10 and 14 business days later unless the provider hears that an action has been filed. It also lets a copyright owner ask a district court clerk for a subpoena to identify an alleged infringer, and lets a court order access providers to block a specific online location outside the United States.⁴⁰
  • Circumvention: section 1201 bars circumventing a measure that effectively controls access to a work, and trafficking in tools and services for doing so; under section 1203, a court can award statutory damages of US$200 to US$2,500 per act of circumvention, device, product, component, offer or performance of service.⁴⁵
• European Union.
  • Rights: the InfoSoc Directive gives authors the right to communicate works to the public, including making them available on demand, protects effective technological measures against circumvention, and lets rights holders seek injunctions against intermediaries whose services a third party uses to infringe.⁴⁶
  • Software: under the Software Directive, loading, displaying, running, transmitting or storing a program needs the rightholder's authorisation where those acts require reproducing it.⁴⁷
  • Games and their protection: the Court of Justice has treated video games as complex matter, comprising a computer program as well as graphic and sound elements, protected under the InfoSoc Directive, and held that protection measures can cover both the game and the console.⁴⁸
  • Notices: the Digital Services Act gives notice-and-action, statements of reasons, internal complaint handling and priority for trusted flaggers.⁴¹
• United Kingdom.
  • Rights: communication to the public, including on-demand availability, is an act restricted by copyright, and rights holders have remedies against anyone dealing in means of circumventing technical protection.⁴⁹
  • Injunctions: section 97A lets the High Court (in Scotland, the Court of Session) grant an injunction against a service provider that has actual knowledge of another person using its service to infringe copyright.⁵⁰
• India.
  • Rights and remedies: a computer programme is a literary work; communication to the public covers making a work available at times and places the public chooses; the Copyright Act provides civil remedies including injunctions and damages, and criminal penalties.⁴²
  • Circumvention: section 65A makes circumventing an effective technological measure with the intention of infringing an offence punishable with up to two years' imprisonment and a fine.⁴²
  • Intermediaries: under the IT Rules as updated in 2026, platforms must bar copyright-infringing content in their user terms; a grievance is acknowledged within 24 hours and resolved within seven days; and content must be removed within three hours of a court order or a reasoned written notice from an authorised government officer.⁵¹
• China. The courts in the cases above applied the right of communication through information networks under Article 10 of the Copyright Law.^3,12

Whether a cloud stream is a public performance or a communication to the public, whether a cloud host counts as an intermediary, and whether a server-side ownership check is a technological measure are questions for independent counsel.

Prevention and detection for publishers

License cloud streaming deliberately

• Know where your games stream legitimately. Keep a list of the cloud platforms you have opted in or licensed, by title and region: on GeForce NOW and Steam Cloud Play the publisher opts in, and regulators have treated cloud streaming rights as licensable on their own.^9,10,11
• Say it in your terms. State in your licence agreement and terms of service that accounts may not be sold, rented or shared, and that games may not be played through cloud services you haven't authorised. The store terms above show the model.^7,14

Check ownership on your servers, not in the client

• Steam. Steamworks has the game client send a session ticket to the publisher's secure server, which verifies it with Steam and can then check whether the user owns the game. Valve says the ownership check must be called from a secure server and never directly by clients.^8,21 Family Sharing is on by default and lets players use the libraries of up to five close family members; Valve says such licences are temporary, and the check shows when a copy is borrowed and who owns it.^21,52
• Android. Google's Play Integrity API returns a licensing verdict that is unlicensed for, among others, sideloaded apps. Google warns that caching verdicts invites proxying, where a verdict from a good device is reused elsewhere, and says the API works best alongside other signals rather than as your only anti-abuse measure.^53,54
• GeForce NOW. NVIDIA's Cloud Check API returns a signed response, built on a fresh random value for each request to prevent replay, that tells a game whether it really runs on GeForce NOW. NVIDIA says developers may relax some anti-cheat and integrity checks when it confirms GeForce NOW; do that only after validating the signed response.⁵⁵
• Know DRM's limits. Valve says the Steam DRM wrapper protects only against extremely casual piracy and is easily removed by a motivated attacker.²⁰ A peer-reviewed study of 86 PC games with a commercial anti-tamper product found that cracking reduced revenue mainly in the first twelve weeks after release, according to heise's report.⁵⁶

Limit sessions and watch for sharing

• Limit concurrent sessions, as GeForce NOW does with one session at a time, and act on accounts that run many sessions at once or from many places.²²
• Read the network. OWASP suggests weighing whether an IP address belongs to a residential or a hosting network, and its location, and warns that IP blocks should be temporary and never the only defence.²⁴ NVIDIA publishes GeForce NOW's IP ranges for uses such as banning based on IP heuristics, and warns that many accounts may share one GeForce NOW address.⁵⁷ Sign-ins to one account from hosting networks that aren't among your authorised cloud partners are a signal worth investigating; that is our inference, not a documented rule.

Protect accounts against takeover

• Multi-factor authentication is by far the best defence against credential stuffing, according to OWASP, which also recommends checking new passwords against breached-password lists and letting users see and end their active sessions.²⁴
• Password rules: NIST's SP 800-63B-4 requires checking new passwords against a blocklist that includes compromised passwords, limiting consecutive failed attempts to no more than 100, and allowing password managers.⁵⁸

Watch the channels

Search results, app stores, Telegram and Discord, and the marketplaces where accounts are sold show where a service recruits players and takes payment. Capture what you find to the evidence standard above before you report it.²⁹

When reports aren't enough

The service comes back under a new domain or app. Report each new address with the same evidence, and work up the chain: its host, its app stores and its payment providers.^4,5,19

You need to know who runs it. In the US, a district court clerk can issue a subpoena to identify an alleged infringer under section 512(h), and Cloudflare responds to valid subpoenas.^28,40 Take both steps through independent counsel.

Hosts don't act. Courts can order intermediaries to act: injunctions against intermediaries in the EU, section 97A injunctions against service providers in the UK, and, in the US, orders to block online locations outside the country.^40,46,50 These are for independent counsel.

Your game is on a platform you didn't license. Use your agreements and the platform's partner contacts first: NVIDIA's terms say it may inform publishers of suspected violations of a game's terms.^9,22

Doing this at scale

For a publisher with several titles and regions, cloud gaming piracy rarely sits in one place: the same service runs on rented servers, sells through an app and a payment page, and recruits players in communities. The work becomes a cycle: map, file, follow up and re-check.

• Start where it runs and how it is paid: hosting and cloud providers, then app stores and payment providers.
• Stay accurate. AWS asks reporters not to report the same issue again and again, Stripe asks for no duplicate notices, and misrepresenting infringement carries liability in the US.^4,31,40
• Close the gap in the game. Server-side ownership checks, session limits and account security stop what a takedown can't.

Bytescare offers this cycle to game publishers and their licensees: monitoring on your plan's scan cycle, review of every match before it reaches you, the notices you approve, filed with the hosts, platforms and search engines involved and tracked to a decision, and, if you choose, legal escalation through independent counsel. Each platform decides on removal. Our anti-piracy service page explains how. This guide is general information, not legal advice. Bytescare is not a law firm; for a specific dispute, consult independent counsel.

FAQs

Further reading

• How game publishers take down private servers, cheat sellers and pirated APKs
• How to protect your game from piracy
• How to remove pirated courses, videos and books from Telegram

Sources

1. 全国首例涉5G云游戏侵权案宣判 (China's first 5G cloud gaming infringement case decided, 13 August 2020) · Zhejiang Daily, on Hangzhou Net · accessed 2026-10-22
2. 广州互联网法院发出首份“云游戏”诉讼禁令 (Guangzhou Internet Court issues its first injunction in a cloud gaming lawsuit, 20 April 2020) · China Intellectual Property News, on China Daily · accessed 2026-10-22
3. Featured case write-up: a cloud gaming platform's infringement of the right of communication through information networks (judgment of 15 June 2021, published 22 March 2024) · Guangzhou Internet Court, official account on The Paper · accessed 2026-10-22
4. How do I report abuse of AWS resources? · AWS re:Post (AWS Knowledge Center) · accessed 2026-10-22
5. Intellectual Property (Developer Program Policy) · Google Play Console Help · accessed 2026-10-22
6. Infringement Report Policy · PayPal · accessed 2026-10-22
7. Steam Subscriber Agreement (last updated 10 September 2026) · Valve · accessed 2026-10-22
8. User Authentication and Ownership · Steamworks Documentation, Valve · accessed 2026-10-22
9. Steam Cloud Play (Beta) · Steamworks Documentation, Valve · accessed 2026-10-22
10. 2,000 Games and Counting: GeForce NOW Library Taking Shape (27 May 2020) · NVIDIA blog · read from the Internet Archive's copy; the original address now redirects · accessed 2026-10-22
11. Press release IP/23/2705 on merger commitments that include cloud game streaming licences (15 May 2023) · European Commission · accessed 2026-10-22
12. 中华人民共和国著作权法 (Copyright Law of the People's Republic of China, as amended in 2020; Article 10) · Government-hosted text (ncsti.gov.cn) · accessed 2026-10-22
13. Microsoft Services Agreement (effective 30 September 2026) · Microsoft · accessed 2026-10-22
14. Community Code of Conduct · PlayStation · accessed 2026-10-22
15. Report on a Shenzhen court judgment against a game account-rental platform (2 November 2021) · IT Home · accessed 2026-10-22
16. Infringement Notices: Copyright and Trademark · Microsoft Legal · accessed 2026-10-22
17. Reporting abuse · Cloudflare Trust Hub · accessed 2026-10-22
18. App Store Dispute Forms · Apple Legal · accessed 2026-10-22
19. Report Brand Abuse · Visa · accessed 2026-10-22
20. Steam DRM · Steamworks Documentation, Valve · accessed 2026-10-22
21. ISteamUser (CheckAppOwnership) · Steamworks Web API Reference, Valve · accessed 2026-10-22
22. GeForce NOW Terms of Use (version of 18 August 2025; sections 1.1, 2.1, 3.2 and 7) · NVIDIA · accessed 2026-10-22
23. Report on Kaspersky's count of gaming-account logins leaked by infostealer malware in 2024 (10 September 2025) · New Straits Times · accessed 2026-10-22
24. Credential Stuffing Prevention Cheat Sheet · OWASP Cheat Sheet Series · accessed 2026-10-22
25. GeForce NOW FAQ · NVIDIA · accessed 2026-10-22
26. Stream Your Own Game with Xbox Cloud Gaming (Beta) (20 November 2024) · Xbox Wire, Microsoft · accessed 2026-10-22
27. US 10,918,939 B2, a patent on streaming games from a hosting service (granted 16 February 2021) · Google Patents · accessed 2026-10-22
28. Assisting copyright holders · Cloudflare Trust Hub · accessed 2026-10-22
29. Berkeley Protocol on Digital Open Source Investigations (2022) · UN Human Rights Office (OHCHR) and UC Berkeley Human Rights Center · accessed 2026-10-22
30. Anti-Piracy Policy · Mastercard · read from the Internet Archive's copy of 4 October 2026; the live page refuses automated requests · accessed 2026-10-22
31. Intellectual Property Notice Process (16 September 2025) · Stripe · accessed 2026-10-22
32. How do I submit a Digital Millennium Copyright Act (DMCA) notice to AWS? · AWS re:Post (AWS Knowledge Center) · accessed 2026-10-22
33. Report suspected abuse on Google Cloud Platform · Google · accessed 2026-10-22
34. 2024 Global Amendment to the Registrar Accreditation Agreement (section 3.18) · ICANN · accessed 2026-10-22
35. Submit a copyright removal request · YouTube Help · accessed 2026-10-22
36. Copyrights (Google Ads policy) · Google Advertising Policies Help · accessed 2026-10-22
37. Telegram FAQ ("A bot or channel is infringing on my copyright. What do I do?") · Telegram · accessed 2026-10-22
38. Discord's Copyright & IP Policy · Discord · accessed 2026-10-22
39. App Review Guidelines (last updated 16 October 2026; guidelines 4.7 and 5.2) · Apple Developer · accessed 2026-10-22
40. Title 17 of the US Code, chapter 5 (section 512) · US Copyright Office · accessed 2026-10-22
41. Regulation (EU) 2022/2065 (Digital Services Act) · Publications Office of the European Union · accessed 2026-10-22
42. The Copyright Act, 1957 (consolidated) · Office of the Controller General of Patents, Designs and Trade Marks (IP India) · accessed 2026-10-22
43. The Copyright Rules, 2013 (rule 75) · IP India · accessed 2026-10-22
44. Title 17 of the US Code, chapter 1 (sections 101 and 106) · US Copyright Office · accessed 2026-10-22
45. Title 17 of the US Code, chapter 12 (sections 1201 to 1204) · US Copyright Office · accessed 2026-10-22
46. Directive 2001/29/EC (InfoSoc Directive), consolidated text (a documentation tool with no legal effect) · Publications Office of the European Union · accessed 2026-10-22
47. Directive 2009/24/EC on the legal protection of computer programs · Publications Office of the European Union · accessed 2026-10-22
48. Judgment of the Court of Justice of 23 January 2014, Case C-355/12 · Publications Office of the European Union · accessed 2026-10-22
49. Copyright, Designs and Patents Act 1988, sections 20, 296 and 296ZD · legislation.gov.uk · read from Internet Archive copies made in 2026 · accessed 2026-10-22
50. Copyright, Designs and Patents Act 1988, section 97A · legislation.gov.uk · read from the Internet Archive's copy of 29 August 2026; the live site refuses automated requests · accessed 2026-10-22
51. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, updated as on 10 February 2026 · Ministry of Electronics and Information Technology, Government of India · accessed 2026-10-22
52. Steam Families · Steamworks Documentation, Valve · accessed 2026-10-22
53. Overview of the Play Integrity API · Android Developers, Google · accessed 2026-10-22
54. Integrity verdicts · Android Developers, Google · accessed 2026-10-22
55. Cloud Check API Reference (GeForce NOW SDK) · NVIDIA, on GitHub · accessed 2026-10-22
56. Report on a peer-reviewed study of anti-tamper protection and PC game revenue (11 October 2024) · heise online · accessed 2026-10-22
57. How to Obtain GeForce NOW IP Addresses (GeForce NOW SDK) · NVIDIA, on GitHub · accessed 2026-10-22
58. SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (August 2025) · US National Institute of Standards and Technology · accessed 2026-10-22