The FOSS Way: An Introduction to GPL3

August 2, 2007

The legal issues surrounding free and open source software (‘FOSS’) used to be unknown territory to most lawyers, even those claiming a specialism in IT. Although a dedicated band of techies and lawyer-enthusiasts have been discussing the topic for many years, until recently FOSS has existed outside the mainstream.


There is clear evidence that this has now changed. Google uses free software extensively, including a modified version of the Ubuntu free software operating system – which it calls ‘Goobuntu’ – on its office computers. The search company  funds various external FOSS projects, as do other IT giants such as IBM. Although most people still use Windows as their operating system, up to 8 million people (or so it has been claimed) have defenestrated their machines and switched to one Linux distribution or other.


While FOSS has been gaining in popularity, communication amongst technology lawyers of FOSS legal issues has also increased dramatically. Taking the SCL and its Scottish sister as but one example, members have been exposed to many articles, talks and webinars on the subject. The SSCL 2007 Lecture by Professor Eben Moglen (which can be viewed online via the SCL site) was about GPL3, in draft form at the time. Moglen, the founder of the Software Freedom Law Center, was the main lawyer involved in drafting v3. By all accounts the lecture was well received, and the SSCL members’ ‘questions from the floor’ displayed an evident knowledge of some of the finer points of GPL.


The GPL (full name, the GNU General Public Licence) was arguably the first general-use free software licence. In essence, it says that if you receive GPL-licensed software, you can use it for any purpose.  Its requirements/conditions are to do with distributing software. It is worth noting that, as well as software, GPL can be used for any other type of work that is protectable by copyright.


The first version of GPL was released in 1989, with version 2 following in 1991; 16 years later, GPL2 remains the dominant FOSS licence.


June 2007 saw the publication of GPL3 after an extensive consultation process. In the course of its creation, the Free Software Foundation consulted not just known FOSS fanatics and a few sympathetic lawyers; consultation spanned the globe and included large corporations. This did not however lead to a finished product loved by all – some of those consulted about v3 are unhappy with the result.


FSF is currently working hard on encouraging its adoption by software creators. FSF has already had some success, with GPL3 being used for Samba, a key Linux component that allows it to interoperate with Windows systems and share resources.


Before launching into the meat of GPL3, I should explain that the licence uses a number of defined terms that, without further explanation, are not particularly helpful to those trying to get to grips with GPL. For example, when FSF created the v3 terms ‘convey’ and ‘propagate’ to replace the plain English word ‘distribute’ in the context of software, it did so because of the differences in how that word is interpreted in jurisdictions across the world.


Where using a defined term rather than plain-English would necessitate a long explanation, I will opt for plain-English. For example, I will use ‘distribute’ rather than ‘convey’ and ‘propagate’. The reader may be left asking ‘but how can that apply to scenario x?’ If this happens, I apologise, but any other approach would make this article longer than GPL itself! References to GPL3 unless I state otherwise.




  • Scope of licence.

    • The licence can be used for any type of work protectable by copyright, not just software.
    • The licence lasts for as long as copyright subsists in the work. The licence is irrevocable unless its terms are breached.
    • The licence is between the user and the copyright holder.
    • Sublicensing is expressly prohibited. (GPL states that this is because sublicensing is made unnecessary by the previous point).
    • The licence covers verbatim copies of the software, software based upon GPL software, and modified versions of GPL software.
    • Unlike traditional commercial licences, the licence does not restrict what the user can do with the software (whether object code or source code).

  • To prevent software owners using patents to impose additional terms on users of their software, the licence includes the use of any patents owned by the copyright holders that fall within the scope of the software. GPL contains detailed provisions about patents.
  • Use or distribution of GPL software in breach of GPL is ‘void’ and terminates the licence, but with some opportunity for the licence to be reinstated.
  • Any distribution of source code of verbatim or modified GPL software must include clear placement of the GPL legal notices. Modified copies must also state that the user modified the software, and include a ‘relevant’ date; obvious dates to use would be the date on which the modified version is completed or first released to the public.
  • Where object code to verbatim or modified GPL software is distributed:

    • this must include clear notices that the code is issued under GPL;
    • modified versions must state they are modified and include a ‘relevant’ date;
    • the distributor must either provide the source code with the object code, or provide recipients with clear directions as to where the source code can be obtained. If distributing the object code by way of a physical medium such as CD-rom, where the source code is not included the distributor must offer to provide a copy of the source code. The offer must be valid for as long as the distributor supports that version of the software, and for at least three years in any event. If under the offer the distributor will provide the source code in a physical medium, it can only charge for reasonable costs.

  • An ability to include certain types of non-standard provisions.
  • Software is provided ‘as is’, and warranties are excluded to the extent allowed by applicable law.
  • Where local law prohibits exclusion of the copyright holder’s liability for damages arising from the use or inability to use the software, GPL states that the Court should apply a limit that, under local law, comes closest to excluding liability.


The text of GPL3 can be found at I will now discuss some of the key provisions of GPL3 and some of the issues raised by the licence.


Application of GPL


Under the law of England and other common and civil law jurisdictions, for GPL to apply to the recipient of software that recipient must have its attention drawn to the licence before it uses the software.


A note accompanying GPL recommends that copyright holders insert a notice (for source code – at the start of each file, for object code – when the software launches)  including the following elements:

  • copyright notice
  • statement that distribution is subject to GPL
  • statement that warranties are excluded
  • link to GPL.


If software creators follow this recommendation, this writer sees no reason why GPL would not be held applicable under English law. FSF believes the GPL will be deemed to apply to the software in any jurisdiction. The German courts thought so in the D-Link case, and had just been reported to have thought so too in another case.


It is worth noting that, where no licence is in place, copyright law prevents anyone but the copyright holder from doing things such as copying a work. So, if someone ignorant of the fact that GPL applies to a particular work does something that would be a breach of the GPL, that ignorance will not be a defence to an action for copyright infringement. As with any copyright work, anyone other than the copyright holder who wants to use that work, especially for something commercial, is best advised to exercise some due diligence first.


Another point is that, even if a court were to hold that the GPL did not apply, the result would probably be that the defendant (the would-be licensee) had no licence at all to the software, and therefore that any use of the software by the defendant would be an infringement of copyright. Therefore, you cannot assume that, where the GPL is found not to apply or be enforceable for a piece of software, that software will somehow be free of the restrictions imposed by copyright.


Bare Licence or Contract?


If GPL is determined to apply to a software product, is GPL a bare licence or a contract? FSF intends GPL to be a bare licence.  GPL meets the very limited criteria required of a bare licence. Whether or not GPL is held to be a contract rather than a bare licence will vary from jurisdiction to jurisdiction.


This is not something that has caused sleepless nights at FSF; the FSF view seems to be that, because GPL is a bare licence, misuse of GPL software can be tackled. This is largely true, but there are some provisions (discussed later) in GPL that go far beyond the scope of copyright licence and therefore can only be enforced if the GPL regime creates contracts.


Governing Law and Jurisdiction


GPL is designed for use across the world and deliberately stipulates no governing law or jurisdiction. This means that these issues must be assessed on a case-by-case basis. The D-Link case was about breaches of GPL2 by a German company. GPL3 is equally silent on law and jurisdiction. In assessing whether there had been a breach, the German Court accepted jurisdiction and applied German copyright law.


Enforcing the Licence


Distributors of GPL software are not responsible for enforcing the licence terms; this falls to the copyright holder. The FSF takes the view that the mere act of distribution should not mean a distributor has to monitor or deal with GPL breaches.


There may however be many people involved in the creation of GPL software; thousands have contributed to the Linux kernel. It would be a massive and probably unfeasible undertaking for a single contributor to tackle the infringement of copyright in a piece of GPL software. The collaborative community spirit of FOSS has sought to overcome this practical problem by setting up the project to monitor and deal with GPL breaches. It was that represented the two Linux coders whose copyright had been breached in the D-Link case.


Reinstatement and Notices of Breach


If someone stops breaching the GPL, their licence is automatically reinstated. However, the copyright holder can again terminate the licence by giving notice of termination within 60 days starting on the date on which the breach ceased.


There is a separate right for a copyright holder to give the user notice of breach. If the user rectifies the breach within 30 days of receipt of notice, the licence is permanently reinstated. This right to reinstate only applies to first-time offenders –  those who have not previously breached GPL for the software in question or any other GPL software.


Additional Permissions


GPL gives copyright holders the ability to make exceptions to the conditions of GPL. It defines these provisions as ‘Additional Permissions’. To add an Additional Permission, the copyright holder must include in the source file a notice either setting out the additional terms or stating where they can be found.


The licence allows those distributing GPL software created by third parties to remove any such Additional Permissions before distribution.


Permitted Non-standard Terms


GPL allows copyright holders, or those authorised by copyright holders, to add the following types of terms:

  • liability limits or disclaimers different to those contained in GPL – given the very limited liability that the licensor is subject to under GPL, this could only mean increasing the licensor’s level of liability, perhaps to justify the distribution fees charged by the licensor
  • obligations to preserve specified (reasonable) legal notices or author attributions
  • prohibitions of misrepresentation of the origin of the software
  • obligations to mark modified software versions to differentiate them from originals
  • limits to the use of licensor or author names for publicity purposes
  • withholding the right to use a trade mark or brand
  • an indemnity from distributors of the software to the licensor or author covering any ‘contractual assumptions of liability’ imposed on the licensor/author.


Taking the final provision described above, where English law applies my view is that copyright holders will struggle to enforce such a provision. This is almost certainly so in the usual FOSS scenario, where copyright holder and end-user are many steps removed. In that scenario, the copyright holder would have to rely on the Contracts (Rights of Third Parties) Act 1999, meaning it would have to establish that GPL created a contract. This could prove to be quite a struggle. Copyright holders should not place too much reliance on this type of provision.


Implications of Including Other Non-standard Provisions


What if the software is accompanied by non-standard provisions that do not fall within the definition of ‘Additional Permissions’ or the permitted types of non-standard terms described above? These are called ‘further restrictions’; they may not be imposed, and have no effect.


The GPL also deals with the situation where conditions additional to GPL are applied to software.  The licence prohibits the distribution of software that has incompatible additions attached. The GPL cites by way of example a distributor requiring a royalty from customers.




Most GPL software available today was issued when v2 was the current version. If you are a distributor of GPL v2 software, can you apply GPL v3 when you next distribute it or does v2 software stay v2 forever?


Eben Moglen summarised FSF’s position on this subject when taking questions after his SSCL speech:


When a program is labelled “GPLv2 or any later version”… the author is delegating to the users a part of the authority to relicense.’


Most GPL software issued today states ‘v2 or later version’, meaning that for such software users can choose to follow v2 or v3.


Packaging GPL v3 Software with Other Software


There are scenarios where GPL3 software might be distributed with software issued under totally different licences, or an earlier version of GPL. One example might be the sale of a computer carrying a variant of the Linux operating system. Each Linux distribution comprises a raft of different software, each of which could have been issued under different FOSS licences.


In this situation GPL states that other software products do not become subject to GPL unless they are ‘by their nature extensions’ of the GPL-licensed software. This applies whether the other software is in source code or object code form. So, to take the example above, the v3 parts of the Linux system would stay v3, and GPL would not apply to any software issued under other licences.


Mixing Code Issued under Different GPL Versions


Mixing v2 code with v3 code, by linking, combining or merging, can give rise to messy legal issues. As Richard Stallman himself has said, the two licences are ‘incompatible’ because both state that if code is combined with software issued under that licence, it will become subject to that licence.


Luckily, most GPL software out there is ‘v2 or later’, and if you combine it with v3 software, v3 will apply.


Should your client wish to mix ‘v2 only’ software with v3 software, this may result in your client having to work a few nights in the office to resolve or eliminate the resulting legal issues. Possible solutions could be to avoid copyright infringement by performing a clean-room rewrite of the ‘v2 only’ code, or to get the copyright holder to reissue that code under ‘v2 or later’ or v3.




Under GPL, the copyright holders license the use of any patents they own that fall within the scope of the software. GPL contains provisions covering three scenarios where patents apply. Scenario 1 envisages a one-off transaction of GPL software where recipients are authorised to use a specific copy of the software. Here, GPL automatically extends the patent licence to all recipients of that software. FSF’s intention was that patents should not prevent GPL software from being used as freely as the GPL allows.


The other two scenarios are simply a reaction to the 2006 agreement between Microsoft and Novell. Amongst other things, Novell is a major distributor of the SuSE variety of Linux. Microsoft needs no introduction. In announcing the deal, the two said that the aim was to make Windows and Linux work better together. Engineers from the companies would jointly develop technologies to improve interoperability, including virtualisation – allowing Windows to run in a virtual machine on Linux and vica versa – and improve compatibility between documents created in Microsoft Office and OpenOffice. All pretty harmless stuff, right?


What FSF really objected to was the patent infringement part of the deal. The two companies promised to each other’s customers that they would not sue them for any patent infringement that using the other’s operating system might entail. Microsoft has quite a history of making allegations about Linux, including claims that Linux infringes its patents. The most recent example was the claim in May 2007 (after the Microsoft/Novell deal) that Linux infringed a staggering 228 of its patents, a number which it then increased to 235. Microsoft has yet to substantiate the allegations, or even to identify the relevant patents, and the bigwigs of the free software world (including, it should be said, Novell) have dismissed Microsoft’s claims out of hand.


The controversial world of software patents is outside this article’s remit. However, whether or not Microsoft’s claims have any substance, they have damaged the perceived legitimacy of FOSS and have done nothing to persuade corporations and the public sector to use FOSS software.


To deal with the Microsoft/Novell deal, GPL firstly addresses the distribution of GPL software ‘knowingly reliant’ upon a patent licence. In this scenario, if the source code for the software is not publicly available free-of-charge and on GPL terms, the distributor has three choices:


  • make the source code publicly available; or
  • deprive itself of the benefit of the patent licence – a ‘Final Rationale’ document published by FSF in the run-up to the release of GPL v3 explains that ‘repudiation by ceasing royalty payments could be one way’ of doing this; or
  • arrange to extend the benefit of the patent licence to users of the software downstream (such an arrangement must be compatible with GPL).


In other words, remove the benefits of the patent deal or you cannot distribute the software under GPL3. This provision raises many questions. How exactly does it protect end-users from patent infringement claims by Microsoft?


Applying the first bullet point, perhaps the point here is that, with the source code, those end-users with patent attorneys at their disposal can assess whether the source code does infringe a patent. Taking the second bullet point, a distributor depriving itself of the benefit would not aid an end-user; the end user would still be in breach of the patent, but now it would be joined by the distributor. Coming to the final bullet, GPL does not create a licence or contract between Microsoft and the end-user. Perhaps end-users could rely on some form of estoppel, although this would need researching in each of the world’s jurisdictions, or at least those containing the large corporate and public sector FOSS users that Microsoft would presumably target.


Of course, by suing end-users Microsoft might itself be in breach of the GPL. Even if FSF or the end-user could establish this, you are still left with unfortunate end-users facing expensive patent infringement claims. The above provision is therefore of less comfort to GPL3 software users than the (apparent) lack of substance to Microsoft’s claims about Linux infringing its patents.


Secondly, GPL provides that, if (after 28 March 2007) the distributor enters into a patent licence that is incompatible with GPL, it cannot distribute GPL software to which that patent licence applies where:

  • it must pay the patent licensee fees based on the act of distribution; and
  • its customers receive an equivalent licence from the licensee.


It’s pretty difficult to make sense of this provision without the knowledge that it is designed to prevent distribution by Novell of software that falls within the scope of the patent licence that it received from Microsoft. Even then, and having read it many times, this writer is still struggling.


Novell has not specifically commented on these provisions, although quoted Novell’s head of PR stating that it was able to distribute GPL software, adding that ‘if… GPLv3 does potentially impact the agreement we have with Microsoft, we’ll address that with Microsoft.’  




GPL seeks to prevent what its authors like to call ‘tivoization’. This is a reference to TiVo, a digital video recorder sold in the USA.


Recent versions of the TiVo firmware include modified versions of GPL2 software. TiVo Inc. publicly releases the source code to the modified software. However, if someone were to customise the source code and then upload it to a TiVo, their efforts would be wasted because TiVo contains measures that prevent users from running customised software.


Whilst TiVo’s actions are within the letter of GPL2, FSF took issue with this, and similar measures implemented by other manufacturers, and sought to prevent such actions from occurring with GPL3 software. Upon the launch of GPL3, Richard Stallman published an article called ‘Why Upgrade to GPL Version 3’. On the tivoisation point, Stallman’s main objection to anti-modification measures is that ‘the manufacturers… take advantage of the freedom that free software provides, but they don’t let you do likewise’. He insists that the user of free software must retain control over what the software does.


To combat ‘tivoization’, GPL stipulates that, if you include GPL software in a ‘user product’ that is sold on and users are able to install modified object code on the product, the requirement to either provide, offer to provide, or direct users to the source code applies. In addition, you must provide users with any information (such as authorisation keys) needed to install and execute modified versions of the software in that product. Here, ‘user products’ means ‘tangible personal property used for personal, family or household purposes’ (such as music players, and possibly computers sold with GPL software installed) and products built into homes (eg an alarm system).


Tackling DRM


GPL states that those distributing or copying works covered by the licence must ‘waive any right to forbid the circumvention of technological measures’.


Digital rights management (‘DRM’) is a much-discussed and controversial technology.  Its critics are many, and it will come as no surprise that the authors of GPL3 are among them.


In his ‘Why upgrade to GPL version 3’ article, Stallman describes DRM as ‘nasty features designed to restrict your use of the data on your computer’. GPL3 does not seek to somehow ban DRM, instead (to quote Stallman again) it ‘makes sure you are just as free to remove nasty features as the distributor… was to add them.’


Eben Moglen gave a persuasive justification for this stance in his SSCL speech:


If you want to experiment with locking down layer below 7… we have no objection – not only do we have no objection to you doing it, we’ve no objection to your using our parts to do it with. But when you use our parts to build machines which control peoples’ daily lives… build devices which are modifiable by them to the same extent that they’re modifiable by you… If you can modify the device after you give it to them, then they must be able to modify the device after you give it to them – that’s a price for using our parts.’


Online Services?


Previous versions of GPL have not dealt with online services, perhaps unsurprising since GPL2 was released in 1991. In recent years, such services have been increasingly common and popular, and many (such as Google) use FOSS code behind the scenes. Despite FSF zeal in areas such as patents and DRM, FSF has made no attempt to bring online services within GPL3, which remains focussed on the distribution of copyright works.


Whilst GPL3 is not itself relevant to online services, a modified version of GPL3 called Affero General Public Licence version 3 (AGPL3) is designed to cover these. . AGPL3 is currently in draft form. AGPL3 effectively states that:


  • if a service provider uses AGPL3 software to run an online service; and
  • it has modified that software; then
  • that service provider must give users access to the modified source code.


If an online service wants to differentiate itself from the competition through its operating software, it is best advised to not modify AGPL3 software to achieve that differentiation. Otherwise, it could find itself forced to release its prized code to the world. Of course, this is exactly what the AGPL3 authors intend; if you are going to take advantage of AGPL3 software, you cannot deprive others of the same advantages.


GPL3 is compatible with AGPL3; if software issued under the two licences is combined/linked, GPL3 applies to the GPL3 part, AGPL3 applies to the AGPL3 part, and the above provision applies to the combined/linked part.




For an overall impression of GPL3, one cannot do better than to quote again from Eben Moglen’s SSCL speech:

In the end, the license bears in my judgement many of the marks of legislation. It is a little too long, it is a little too complex. It divides cases where they might with some analytical clarity have been merged, and it merges cases that might with some analytical clarity have been divided. It isn’t one man’s work of art, it’s a community’s work of self-definition.’


GPL3 is an impressive piece of work. As something intended to apply across the globe, its drafting isn’t going to impress everyone but, to be fair, this writer cannot recall enjoying the drafting in any contract designed to operate across multiple jurisdictions.


The comparison of GPL3 to legislation is quite apt; some of the provisions I’ve noted are framed in a language more akin to legislation than to a licence or contract, and are of a scope that raises serious questions about their enforceability. Saying that, these wanna-be-legislative provisions are in the minority; most of GPL3 is confined to the humble and enforceable world of copyright licensing.


Overall, whilst there are some provisions of GPL3 that raise objections, the simple fact is that if you want to commercially exploit GPL3 software, you must accept its terms. If not, the alternatives are to:


  • write your own software from scratch; or
  • persuade the copyright holder to issue the software to you under a more favourable licence; or
  • use equivalent software issued under a more favourable licence (such as MIT).



Alex Newson is a Solicitor in the Intellectual Property & Technology team at Freeth Cartwright LLP: See their blog at





Collaboration, one of the key features of the FOSS world, has filtered down to the writing this article. Thanks to Ciarán O’Riordan  of the Free Software Foundation Europe, Andrew Katz of Moorcrofts, and Deryck Houghton of Freeth Cartwright LLP for their comments on the drafts of this article.

[1] There were a software licences in circulation that allowed the user to do pretty much what they wanted with software, although whether or not these would fall within FSF definition of ‘free software’ is another question.

[2] Other FOSS licences are arguably better suited to certain types of works. For example, Creatives Commons licences are specifically designed for ‘creative’ works such as photos.

[3] Although one man, Harald Welte, is the arguably the driving force behind

[4] All of the patents in question are US, and there are doubts about the enforceability of many US software patents.


[6] However, if the online service distributes the GPL3 software it runs on, GPL3 will apply to the distribution. I cannot think of any online service that distributes its operating software as part of its core business, although a small minority make their source code freely available.


[8] Dealt with in section 13. The inclusion of this provision is the only difference between GPL3 and Affero GPL3.