It’s not even clear to me that the mechanism they’re using today is problematic. I don’t know what it is, but the author seems to think they do but aren’t sharing details beyond “trust me bro”. I agree that some kind of inspection-based detection might run afoul of the law, but I don’t see why that’s necessary. All you need to know is that the client is requesting videos without any of the ad requests making it through, which is entirely server-side.