Spore uses a modified version of the controversial digital rights management (DRM) software SecuROM as copy protection, which requires authentication upon installation and when online access is used. This system was announced after the originally planned system met opposition from the public, as it would have required authentication every ten days.
Additionally, EA released the game under a policy by which the product key of an individual copy of the game would only be authenticated on up to three computers.
In response to customer complaints, this limit was raised to five computers. After the activation limit has been depleted, EA Customer Service will consider further activations on a case-by-case basis. A survey conducted by EA revealed that only 14% have activated on more than 1 PC and less than 1% of users have tried to activate Spore on more than 3 PCs.
By September 14, 2008 (ten days after the game's initial Australian release), 2,016 of 2,216 ratings on Amazon.com gave the game one out of five stars, most citing EA's implementation of DRM for the low ratings. Electronic Arts cited SecuROM as a "standard for the industry", and Apple's iPod song DRM policy as justification for the control method. Former Maxis developer Chris Harris labeled the DRM a "screw up" and a "totally avoidable disaster".
The SecuROM software was not mentioned on the box, in the manual, or in the software license agreement.
An EA spokesperson stated that "we don't disclose specifically which copy protection or digital rights management system we use [...] because EA typically uses one license agreement for all of its downloadable games, and different EA downloadable games may use different copy protection and digital rights management.” A pirated version without the DRM was released two days before the initial Australian release and was immediately distributed over BitTorrent file sharing protocol, making Spore the most pirated game of 2008.
On September 22, 2008, a class action law suit was filed against EA, regarding the DRM in Spore, complaining about EA not disclosing the existence of SecuROM, and addressing how SecuROM runs with the nature of a rootkit, including how it remains on the hard drive even after Spore is uninstalled.
On October 14, 2008, a similar class action lawsuit was filed against EA for the inclusion of DRM software in the free demo version of the Creature Creator.
EA began selling Spore without SecuROM on December 22, 2008 through Steam. Furthermore, EA Games president Frank Gibeau announced that maximum install limit would be increased from 3 to 5 and that it would be possible to de-authorize and move installations to new machines, citing the need to adapt their policy to accommodate their legitimate customers. EA has stated, "By running the de-authorization tool, a machine 'slot' will be freed up on the online Product Authorization server and can then be re-used by another machine. You can de-authorize at any time, even without uninstalling Spore, and free up that machine authorization. If you re-launch Spore on the same machine, the game will attempt to re-authorize. If you have not reached the machine limitation, the game will authorize and the machine will be re-authorized using up one of the five available machines." However, the de-authorization tool to do this is not available on the Mac platform.