A video membership site keeps a diary about every member. Nobody writes it by hand. It’s a row for each time someone pressed play: who they were, which video, from what address, on what browser, and how far they got. WPMediaShield writes those rows because they are what give a watermark meaning, and because they let you answer “who watched lesson four last week”.
Then one day a member emails and asks what you hold on them, or asks you to delete it. Here’s what the plugin stores per member, why you would want to keep it, what an export or erase request does to it, and what you can sensibly tell the member. All of it describes what the plugin does. None of it is legal advice, and the plugin doesn’t make a site compliant with any law. Your obligations depend on where you and your members are, so check them for your own business.
Key points
- Each watch session stores the member’s user ID, the video, IP address, browser string, device type, browser name, seconds watched, furthest position and completion. All of that is in the free plugin.
- Erasure through WordPress blanks the IP address and browser string on those rows but keeps the rows, so the user ID, the video and the viewing figures stay.
- Pro adds playback events, which are deleted for that member on erase, and a CSV export of sessions that includes IP addresses.
- Retention is off by default. Turning it on moves old sessions out of your reports, but doesn’t delete them.
What a video site records about each member
Start with the free plugin, because every site has it. Once a logged-in member starts a protected video, MediaShield opens a watch session and writes one row. Taken from the plugin’s database schema, the columns are these:
- the member’s user ID and the video’s ID
- the IP address and the full browser string (the user agent, cut to 500 characters)
- a device type and a browser name worked out from that string
- when the session started and when it last reported in
- total seconds watched, the furthest position reached and the completion percentage
While the video plays, the player reports in, so those last figures keep updating until the member stops. A break between two sittings usually makes two sessions, not one.
Two smaller records sit beside the sessions. Milestones are one row per member, per video, per level reached (25, 50, 75 and 100 percent), with the time it was reached. With milestone tags in use, each tag a member has earned is kept in one block on their user profile.
That’s the whole list for the free plugin. Notice what’s missing: no email address and no payment detail. Each session row points at a WordPress account by ID, and the account holds the name and email. Payment isn’t something the plugin takes at all, and it keeps no billing record.
Guests are recorded too
Let non-members play a video (the login requirement is a setting, and it’s on by default) and their sessions are written as well, with the same IP and browser string. Every guest gets a user ID of zero, so there’s no per-person history for a guest, and milestones don’t fire for them. Keep that in mind later, because an erase request is matched by account email, and a guest has no account to match.
What the address in the row really is
Out of the box, the plugin reads the connecting address and nothing else. Behind a CDN or a reverse proxy, that address may belong to the proxy and not the member. A filter, mediashield_trusted_ip_headers, names the header your proxy sets. To make the IP column useful, check what it shows for your own test login before you rely on it.
Why you would want that record
Two reasons come up again and again, and neither is idle curiosity.
Tracing a leak comes first. On the player, the watermark draws the member’s display name and IP over the picture and moves it around. That text is built when the session starts and sent to the browser in that one response, and it isn’t saved as its own record. If a clip turns up on a public site, what you have is the name and address visible in the clip, plus the session history that lets you check it: did that account watch that video, at about that time, from that address? A watermark with nothing behind it is an accusation. A watermark plus a matching session row is evidence you can work through calmly.
WPMediaShield Pro lets you choose what the watermark shows: the name, email, IP address, user ID, the time, the site name and a line of your own text. Name and IP are what the free plugin shows. The choices are covered in video watermark for WordPress, including the part that matters most here. A recording that leaks carries whatever you printed, so a field like email is a decision about your members’ privacy as well as your own safety.
Plain running of the business is the second reason. In the free plugin, the Viewers screen lists members you can search by name or email, with how many videos each has watched, their average completion and when they were last active. Click through and you get that member’s watch history: the video, a progress bar and the last time they watched. That’s how you notice that a member who has paid for six months never got past lesson two, which is a better reason to send a friendly email than any marketing calendar. How to use that screen to keep people watching is covered in our post on running a video membership site.
Those same rows also power resume, where the player picks up from the furthest position, and the stream limit, which counts devices as an IP and browser pair. How that works is explained in the article on stopping members sharing logins.
What Pro adds to the record
Running MediaShield Pro? A few more things are stored, all tied back to a member.
- Playback events. Play, pause and similar events with the position and time, used for the heatmaps. By default these are deleted after 90 days. A developer can change that window with a filter, and it will not go below two days.
- Alerts. Whenever Pro flags something like one account using several IP addresses in a short window, it writes a row naming the member and the video. Flags are listed on the Alerts screen. Nobody is emailed, so you only see them if you go and look. How easily a flag is raised depends on the sensitivity setting: at medium, five different addresses within twelve hours.
- Upload queue rows. Should a team member upload a video through the plugin, the queue row records who did.
- Milestone completion marks. Stored on the member’s profile.
- Legacy licence rows. Sites that upgraded from before 1.4.1 may still hold an old table of encrypted-stream licences, with a device ID. New installs don’t have it.
Pro also has an Export screen. Choose watch sessions, milestones or per-user watch stats and a date range, and it downloads a CSV. Session files include the IP address, device type and browser for every row. Useful for an investigation, it’s worth treating with care afterwards, since a spreadsheet of members’ IP addresses sitting in a downloads folder is its own piece of personal data that no plugin will tidy up for you.
On the Realtime screen you see who is watching right now: viewer, video, progress, device and how long they have been on. Addresses aren’t displayed.
What an export request does
Say a member asks what you hold on them. WordPress has a built-in route for this: under Tools > Export Personal Data you enter their email, send the request, and download the file once it is ready. MediaShield hooks into that screen, so its data arrives in the same file with no extra step.
From the free plugin, the file has a group called MediaShield Video Data holding:
- every watch session, with the video title, start time, completion, total seconds, IP address and user agent
- every milestone, with the video and when it was reached
- the milestone tags the member has earned
Sessions are read from the live table and the archive table together, so a member whose older history has been archived still gets all of it back. Large histories are split into pages of 100, so a long record doesn’t time out.
With Pro active there are more groups: playback events, upload queue rows, milestone completions, and legacy licence rows where they exist. Alerts rows aren’t exported, so any flags you hold about a member aren’t in the file. Note that and decide how you want to handle them.
One more limit: the export finds the member by the email on their WordPress account. Someone who was only ever a guest has no account, and no way for the plugin to know which anonymous sessions were theirs.
What an erase request does
Under Tools > Erase Personal Data the flow is the same: enter the email, confirm the request, run it. What MediaShield does with it is more specific than “delete everything”, and you’ll want to know that before you tell a member it’s done.
Piece by piece, the action works like this:
- Watch sessions: anonymised, not removed. The IP address and the user agent are blanked on every session of that member, in the live table and the archive. Rows stay.
- Milestones: deleted. The rows are removed, and so is the block of earned tags on the member’s profile.
- Alerts: deleted when Pro is active. The free plugin’s eraser removes the member’s alert rows if Pro is running.
- Playback events, upload queue rows and completion marks (Pro): deleted. Legacy licence rows too, where that table exists.
- Heatmap totals (Pro): cleared for the videos that member watched. Those totals are counts per position with no names in them, but they were built partly from the member’s events, so the stored rows for those videos are removed.
What stays after erasure
Be straight with yourself about the sessions. After erasure, each row still carries the member’s user ID, the video, the start time, the seconds watched, the furthest position, the completion percentage, the device type and the browser name. Those stay on purpose, so your totals and top-video figures don’t shift. What gets removed is the IP address and the full browser string.
Should a member later ask “have you deleted me”, the accurate answer is that you removed the address-level detail along with the milestone and event records, and that session rows remain, linked to an account ID. Whether that satisfies the request depends on your own rules and on what the account itself still holds. The privacy tool deals with the plugin’s data. Removing the WordPress user is a separate step in WordPress, and the tool won’t do it for you.
Leak tracing carries a trade-off. Once you have blanked the IP on a member’s sessions, you lose that half of the trail. Both the name on the watermark and the fact of the session remain, but the address doesn’t. Decide ahead of time how you weigh those two duties, because the request will arrive when you are not in the mood for a policy debate.
Retention: keeping less, and what it really does
A setting under MediaShield > Settings, in a card called Analytics Retention, controls how many months of watch history the free plugin keeps. The default is 0, which keeps every session, and you can set it from 0 to 120.
Enter a number and a monthly job copies sessions older than that into a separate archive table and deletes them from the main one, inside a single transaction. Archiving is opt-in, so a site that never touches the setting archives nothing.
Read the screen’s own warning, because this is easy to get wrong. Moving sessions to the archive removes them from your reports. Views, completion rates and the top-video list stop counting anything older. Nothing in the plugin’s reports reads the archive back, and only the privacy export and erase tools do. Retention here isn’t deletion, then. It’s a way of taking old history out of your dashboards, and the rows are still in your database, still carrying IP addresses until an erase request blanks them.
An earlier version archived everything older than 24 months without asking, which meant reports lost their history at month 25 with no explanation. Version 1.3.0 switched that off, and a one-off job walks previously archived rows back into the live table. Hence the default of zero, and hence the warning on the screen before you change it.
Where your own policy says you shouldn’t keep viewing detail forever, treat the retention setting as a reporting choice and look at your database separately. Ask a developer what that should look like for your site.
What to tell your members
You don’t need a legal essay. You need a short, true, findable statement, and a process you can follow. A starting point in plain words follows. Adapt it, and have it checked against your own obligations.
Whenever you watch a video on this site we record which video you watched, when, how far you got, the device and browser you used and your IP address. We use it to show you where you left off, to understand which videos help, and to investigate if a video is copied and shared. To see the data we hold about you, or to ask us to erase it, email us from your account address and we will use the standard WordPress export and erase tools.
A few practical notes on that text:
- Nothing gets added to your privacy policy page for you by MediaShield. Neither plugin registers suggested policy text, so the wording is yours to write.
- Say what you print on the watermark. When it carries a member’s email, tell them it may be visible on their own screen while they watch.
- Say how long you keep sessions, and make sure the answer matches your retention setting and how you handle the archive.
- Name the contact route, because a request that lands in a general inbox on a Friday is the usual way these go wrong.
For the request itself, keep a short note each time: the date, what you exported or erased, and what you told the member remained. Counts arrive as a receipt from the privacy tool, and that note is the human half.
A short routine for the day a request arrives
- Confirm the person owns the email address. WordPress’s own confirmation step does this for requests made through it.
- For an export, run Export Personal Data and send the file by a route you would trust with a spreadsheet of personal detail.
- For an erase, run Erase Personal Data, then read the counts and make sure they look plausible for a member with that history.
- Check what the plugin does not touch: CSV files you exported yourself, and your membership and payment plugins, which keep their own records.
- Reply with what you did and what remains, in the same plain words as above.
For the settings side of the same ground, see the documentation: privacy, retention and uninstall and, for Pro’s tables, privacy, data and retention. Check both against the version you run, and when they differ from what you see in the privacy tool, trust what the tool reports for your own site.
What this does not do
Limits deserve the same bluntness here as protection does.
MediaShield stores watch records for the videos in its library. Your membership plugin, your payment gateway, your email list and your analytics tags are outside its reach. A member’s request covers all of those, and none of them are handled by this plugin.
Compliance with GDPR or any other law isn’t something it provides. It gives you the standard WordPress export and erase hooks, an opt-in retention setting and a clear schema. Whether that is enough depends on your rules.
It deters casual copying and helps you identify who leaked a clip. It’s not DRM, and it can’t hide a video ID on YouTube, Vimeo, Wistia or Bunny. Those limits apply to the data question too: if a leak happens, your evidence is the watermark text and the session row, not a lock on the file.
And it’s separate from WPMediaVerse. Since the two don’t connect, a request that covers both needs each handled on its own.
To sort out where video protection fits across your whole offer, start with the post on paid video business ideas and how to protect each one. And free versus Pro lists which of the pieces above need the paid plugin.
Questions members and owners ask
Does MediaShield store a member’s email? No. It stores the user ID. Email lives on the WordPress account, and appears in the watermark only if you choose it in Pro.
If I run the erase tool, will my reports break? Not for totals. Session rows stay, so view counts and completion averages carry on. Heatmaps for the affected videos are cleared.
Does erasing remove the member’s account? No. The privacy tool deals with the plugin’s data, and removing the user is a separate step in WordPress.
Are guest viewers covered by an erase request? Because the request finds a person by account email, anonymous sessions can’t be matched to one. They keep their IP and browser string unless you deal with those rows another way.