Every academy discovers account sharing the same way: a student emails support because "the video keeps pausing on my phone," and the analytics show one login watching in two cities simultaneously. The polite fiction of the shared family password costs the business real money — a single paid enrollment quietly serving a study group of five — but the clumsy fix costs more: hard one-device limits that lock out the legitimate student who watches on the phone during commutes and the laptop at night. The design question is not whether to limit devices; it is how to set the ceiling so that honest multi-device life works and coordinated sharing does not.
Two devices per course: the number that works #
Two concurrent devices per course covers the overwhelming majority of legitimate study behavior — phone plus laptop, tablet plus desktop — while making group sharing operationally annoying: someone in the study group is always the one kicked out, and coordination overhead replaces the free ride. Three should be the generous ceiling for corporate cohorts where shared training-room machines are normal. The mechanics matter as much as the number: when a student exceeds the limit, they should hit an approval request, not a wall. A device-approval flow — the student taps "approve my new device," you accept or deny from the dashboard — converts a security event into a service interaction, and the audit trail it produces is exactly the evidence you need when a refund dispute mentions "access problems."
What to do when you catch a sharer #
Resist the ban reflex. The students sharing an account are often your most commercially interesting audience — they are a warm study group who already value your content enough to organize around it. The sequence that converts instead of burns: restrict the extra devices, send a human message that names the behavior without moralizing ("we noticed concurrent sessions — looks like a study group!"), and offer the group a cohort discount for individual seats. You will be surprised how often the shared account becomes three paid enrollments, and how rarely the same student triggers the alert twice. Save hard enforcement — instant device removal, which any admin can do — for the accounts that ignore two friendly interventions.
Device limits are the least glamorous feature in the security stack and the one with the clearest return: every blocked share is either a protected enrollment or a conversion opportunity, and the approval workflow means you never have to choose between revenue protection and student experience. Pair them with content access control — locking specific lessons or sections per student group — and you have the practical middle ground between the open course anyone can scrape and the fortress nobody can study in.