Subscriptions are a great way to draw a steady stream of revenue from readers — unless readers share their login credentials with everyone they know.
As publishers try to grow subscription businesses, they have to figure out how to handle password-sharing, a phenomenon that subscription services like Netflix and Spotify have wrestled with for years.
On one hand, subscribers are often the most enthusiastic members of a publisher’s audience, and limiting access cuts into their ability to proselytize. But allowing flagrant password-sharing disincentivizes would-be subscribers, and it’s hard to limit it without aggravating your users.
Password-sharing is a well-documented problem for subscription content companies, particularly in digital video. Reuters/Ipsos research released last summer found that more than one-fifth of 18- to 24-year-olds had used a login from somebody outside their household to stream content; overall, 12 percent of adults said they’d done so.
Senior executives at companies like Netflix and HBO regularly downplay the impact of password-sharing. In 2016, Netflix CFO David Wells said that cracking down on the practice wouldn’t necessarily lead to an uptick in subscribers.
It’s unclear how widespread the practice is among subscription news publishers’ audiences. Publishers contacted for this story and asked to discuss password sharing, including The New York Times, The Washington Post, McClatchy, Tronc, Financial Times and Gannett, either did not respond to requests for comment or did not make executives available for interviews. Michael Silberman, svp of strategy at paywall services vendor Piano, said Piano hears about the problem occasionally, but it’s not a growing concern.
It’s hard to eliminate password-sharing because of all the devices people use.
“Any time you get into restricting access, you create a customer service headache for yourself,” said Peter Ericson, founder of Zeen101, a software firm that makes paywall and other products for publishers on WordPress.
It’s also hard to tell which logins are legitimate and which are not. Someone logging into their account from a computer located in another state might just be a subscriber who’s traveling. A new login on a new browser could just mean that a reader decided to switch to Firefox after years of using Chrome.
On top of that, being too punitive can make a publisher seem unreasonable. “[For most people], there’s an expectation: ‘If I have a subscription, can’t I share it with my wife?’” Ericson said.
The difficulty of identifying password-sharers has marketing consequences. In theory, a person who’s accessing subscriber content through a friend or family member should be a prime target for marketers. But that person can’t be targeted if they can’t be identified.
Many publishers have some wiggle room in their subscription policies. The New York Times says in its subscriber FAQ that digital subscribers can share their accounts with “one or two” people. The Washington Post discourages subscribers from sharing their passwords but allows subscribers one bonus subscription that they can share.
“We believe that our subscribers are our best ambassadors,” Miki King, the Post’s vp of marketing, said in a statement. “So we encourage our premium subscribers to share access with new readers to help them discover the breadth of The Post’s content and the quality journalism.”
Looking at a user’s IP address won’t detect all sharing activity. For example, many large businesses all use the same IP address, making it impossible to tell if an entire office of people is accessing a subscription with a single person’s login.
That’s why some publishers limit access by device. The Wall Street Journal, for example, lets digital subscribers access content from up to five different devices, which can be changed.
Other publishers like newspaper chain McClatchy have taken a hands-off approach to individual password-sharing, considering it a privacy issue. Instead, it is currently developing family- and office-specific subscription plans.
Ericson said personalization by news publishers can indirectly curtail sharing. People whose site experience is customized based on their reading behavior might be reluctant to have that experience muddied by someone else using the product.
Ultimately, password sharing hasn’t become a front-burner issue for many publishers yet because they’re more focused on growth.
“There’s a lot of runway left in terms of overall industry growth, and certainly growth for newer entrants,” Silberman said. “There are any number of tactics publishers can use to drive subscriber growth and improve retention before they need to worry about building complex features to limit sharing.”
More in Media
The Rundown: Google has drawn its AI payment lines — and publishers’ leverage is narrow
For publishers trying to navigate AI licensing, the message was blunt: Google is willing to pay for access, but not for training – and it remains unwilling to define AI Overviews as a compensable use of journalism.
Media Briefing: Google’s latest core update a reminder that pageviews can’t remain the primary metric
Google’s latest core update signals pageviews can no longer be the primary metric, favoring intent-solving publishers over scale.
After an oversaturation of AI-generated content, creators’ authenticity and ‘messiness’ are in high demand
Content creators and brand marketing specialists on how 2026 will be the year creator authenticity becomes even more crucial in the face of rampant AI-generated “slop” flooding social media platforms.