diff --git a/libwvdrmengine/cdm/core/include/policy_engine.h b/libwvdrmengine/cdm/core/include/policy_engine.h
index c05f5418..584d790f 100644
--- a/libwvdrmengine/cdm/core/include/policy_engine.h
+++ b/libwvdrmengine/cdm/core/include/policy_engine.h
@@ -80,6 +80,8 @@ class PolicyEngine {
 
   bool IsLicenseOrPlaybackDurationExpired(int64_t current_time);
 
+  bool CanRenew() { return policy_.can_renew(); }
+
  private:
   friend class PolicyEngineTest;
 
diff --git a/libwvdrmengine/cdm/core/include/wv_cdm_types.h b/libwvdrmengine/cdm/core/include/wv_cdm_types.h
index 8dc8d24a..780917b4 100644
--- a/libwvdrmengine/cdm/core/include/wv_cdm_types.h
+++ b/libwvdrmengine/cdm/core/include/wv_cdm_types.h
@@ -203,6 +203,7 @@ enum CdmResponseType {
   LICENSE_REQUEST_SIGNING_ERROR,
   EMPTY_LICENSE_REQUEST,
   SECURE_BUFFER_REQUIRED,
+  LICENSE_RENEWAL_PROHIBITED,
 };
 
 enum CdmKeyStatus {
diff --git a/libwvdrmengine/cdm/core/src/license.cpp b/libwvdrmengine/cdm/core/src/license.cpp
index a75075fa..61611f0d 100644
--- a/libwvdrmengine/cdm/core/src/license.cpp
+++ b/libwvdrmengine/cdm/core/src/license.cpp
@@ -319,6 +319,11 @@ CdmResponseType CdmLicense::PrepareKeyUpdateRequest(
     return INVALID_PARAMETERS_LIC_2;
   }
 
+  if (is_renewal && !policy_engine_->CanRenew()) {
+    LOGE("CdmLicense::PrepareKeyUpdateRequest: license renewal prohibited");
+    return LICENSE_RENEWAL_PROHIBITED;
+  }
+
   LicenseRequest license_request;
   if (is_renewal)
     license_request.set_type(LicenseRequest::RENEWAL);
diff --git a/libwvdrmengine/cdm/core/test/test_printers.cpp b/libwvdrmengine/cdm/core/test/test_printers.cpp
index 442bb6f6..3c573c99 100644
--- a/libwvdrmengine/cdm/core/test/test_printers.cpp
+++ b/libwvdrmengine/cdm/core/test/test_printers.cpp
@@ -339,6 +339,8 @@ void PrintTo(const enum CdmResponseType& value, ::std::ostream* os) {
       break;
     case EMPTY_LICENSE_REQUEST: *os                << "EMPTY_LICENSE_REQUEST";
       break;
+    case LICENSE_RENEWAL_PROHIBITED: *os           << "LICENSE_RENEWAL_PROHIBITED";
+      break;
     default:
       *os                                          << "Unknown CdmResponseType";
       break;
diff --git a/libwvdrmengine/cdm/test/request_license_test.cpp b/libwvdrmengine/cdm/test/request_license_test.cpp
index 3191442a..11d4e0c4 100644
--- a/libwvdrmengine/cdm/test/request_license_test.cpp
+++ b/libwvdrmengine/cdm/test/request_license_test.cpp
@@ -1380,6 +1380,28 @@ TEST_F(WvCdmRequestLicenseTest, StreamingLicenseRenewal) {
   decryptor_.CloseSession(session_id_);
 }
 
+TEST_F(WvCdmRequestLicenseTest, StreamingLicenseRenewalProhibited) {
+  decryptor_.OpenSession(g_key_system, NULL, EMPTY_ORIGIN, NULL, &session_id_);
+  std::string key_id = a2bs_hex(                  // streaming_clip11
+      "000000427073736800000000"                  // blob size and pssh
+      "EDEF8BA979D64ACEA3C827DCD51D21ED00000023"  // Widevine system id
+      "08011a0d7769646576696e655f746573"          // pssh data
+      "74221073747265616d696e675f636c69703131");
+  GenerateKeyRequest(key_id, kLicenseTypeStreaming);
+  VerifyKeyRequestResponse(g_license_server, g_client_auth, false);
+
+  std::string license_server;
+  std::string init_data;
+  wvcdm::CdmAppParameterMap app_parameters;
+  wvcdm::CdmKeyRequestType key_request_type;
+  EXPECT_EQ(wvcdm::LICENSE_RENEWAL_PROHIBITED,
+            decryptor_.GenerateKeyRequest(
+                session_id_, key_set_id_, "video/mp4", init_data,
+                kLicenseTypeStreaming, app_parameters, NULL, EMPTY_ORIGIN,
+                &key_msg_, &key_request_type, &license_server));
+  decryptor_.CloseSession(session_id_);
+}
+
 TEST_F(WvCdmRequestLicenseTest, OfflineLicenseRenewal) {
   // override default settings unless configured through the command line
   std::string key_id;
diff --git a/libwvdrmengine/include/WVErrors.h b/libwvdrmengine/include/WVErrors.h
index fd22020b..c77a4ddc 100644
--- a/libwvdrmengine/include/WVErrors.h
+++ b/libwvdrmengine/include/WVErrors.h
@@ -176,7 +176,8 @@ enum {
   kLicenseRequestNonceGenerationError = ERROR_DRM_VENDOR_MIN + 161,
   kLicenseRequestSigningError = ERROR_DRM_VENDOR_MIN + 162,
   kEmptyLicenseRequest = ERROR_DRM_VENDOR_MIN + 163,
-  kErrorWVDrmMaxErrorUsed = ERROR_DRM_VENDOR_MIN + 163,
+  kLicenseRenewalProhibited = ERROR_DRM_VENDOR_MIN + 165,
+  kErrorWVDrmMaxErrorUsed = ERROR_DRM_VENDOR_MIN + 165,
 
   // Used by crypto test mode
   kErrorTestMode = ERROR_DRM_VENDOR_MAX,
diff --git a/libwvdrmengine/include/mapErrors-inl.h b/libwvdrmengine/include/mapErrors-inl.h
index 45003e7c..045af38f 100644
--- a/libwvdrmengine/include/mapErrors-inl.h
+++ b/libwvdrmengine/include/mapErrors-inl.h
@@ -341,6 +341,8 @@ static android::status_t mapCdmResponseType(wvcdm::CdmResponseType res) {
       return kLicenseRequestSigningError;
     case wvcdm::EMPTY_LICENSE_REQUEST:
       return kEmptyLicenseRequest;
+    case wvcdm::LICENSE_RENEWAL_PROHIBITED:
+      return kLicenseRenewalProhibited;
     case wvcdm::UNKNOWN_ERROR:
       return android::ERROR_DRM_UNKNOWN;
     case wvcdm::UNUSED_1: