I believe it only occurs if there's "suspicious" activity. Which may relate to ISP, country of origin, file size/format, etc.
