I've had a look through the forums and can't see anything addressing this issue. If somebody purchases my game through itch.io, is there anything to stop them from sharing the download link with friends and essentially having an "infinite" number of copies to re-distribute to friends etc? There are a couple of purchases which have multiple (3 or 4) downloads attached to them. I'm being generous and assuming it's multiple copies on computers owned by the purchaser or failed downloads or something, though it's entirely possible the link has been shared. In the same way I suppose, there's nothing to stop somebody loading up the downloads onto a memory stick and sharing it that way.

Any thoughts greatly appreciated.

To answer the second part of your question, people can indeed simply share the downloaded game, since Itch.io doesn't apply any DRM. (You're free to implement your own scheme.) Sharing just a link is still easier, of course, but I'm not sure how download links work for buyers who aren't logged into Itch. For those who are logged in while making a purchase, the game is attached to their account, so sending the link to someone else probably won't work. However, people can always share their login details with somebody else, however unsafe that is. At most we can ask them not to.

I figured that might be the case. Thanks very much for the information. I'm currently without any form of DRM but may consider it in the future.

So I guess we should follow the local law and only share with close family? I think in my country it means people sharing in the same household. But then they could just come and play on my computer; so sending a copy of a game is actually more useful for relatives not living in the same place, which would then be illegal?

But there is the law and there is what developers would actually rather not you do, which I guess is sharing with complete strangers (or a family/friend circle a bit too big).

If the files are sent directly to other people or uploaded to some other server, there is no direct way to track them. But if an account is shared with numerous people, itch.io may be able to detect too many simultaneous connections, from too many countries (you could tunnel to mitigate that, but probably still get different regions/IPs). No idea if they do, though.