Screen capture tools copy the contents of screen memory. I mean the part of the video memory the GPU continuously sends to the monitor. The video decoding process *may* store images in screen memory, by first writing each decoded video frame in YUV format into an off-screen buffer, then instructing the GPU to render this image as a texture into screen memory. This is lossy because rendering converts YUV to RGB. Another option is an overlay. Here the GPU reads pixels from screen memory and the off-screen buffer in parallel, blends them, and sends them to the monitor. In this case a screen capture tool gives you only a blank rectangle, although a specialized tool may still obtain the decoded frames from off-screen video memory. There's no loss here but raw YUV or RGB images are unsuitable for distribution and have to be lossy compressed again, giving slightly worse quality than the stream downloaded from Netflix. The GPU may discourage this by implementing the decoding process entirely in hardware, encrypting its memory, or at least the video buffers, and encrypting the signal to the monitor. Then you could still intercept the compressed, unencrypted video stream sent from the CPU to the GPU. To prevent this the CPU may establish an encrypted channel to the GPU. In other words, the player receives the compressed, encrypted video stream from the net, possibly de- and reencrypts it, sends the encrypted, compressed data frame by frame to the GPU which decrypts, decompresses, and displays them. To prevent someone from hacking the player and obtaining decryption keys, parts of it may run in encrypted main memory as well, using Intel's SGX. That still leaves the analog hole. If you can screen-cap images out of a Netflix video it's because their DRM doesn't depend on these features for hardware compatibility reasons. What the pirates do, I suppose, is to analyze the player code, download the compressed and encrypted stream, decrypt it as the player would, and possibly recompress it into their favored format.