The Gift that Keeps on Giving – Distribution and Copyleft in Open Source Software Licenses

Heather Meekera

(a) Partner, Greenberg Traurig, LLP

DOI: 10.5033/ifosslr.v4i1.66


Copyleft obligations in licenses like GPL version 2 are triggered by "distribution," but what exactly does that mean? This article examines the question of what constitutes distribution under U.S. copyright law, and how that question plays out in complex business settings where free software thrives today.


Law; copyright; software; copyleft


This item is part of the Articles section of IFOSS L. Rev. For more information, please consult the relevant section policies statement. This article has been independently peer-reviewed.


In 1991, version 2 of the GNU General Public License was released. GPLv2, the most popular and controversial of open source software licenses, sparked a revolution in software licensing. Under its “copyleft” scheme, anyone distributing the licensed software, or derivative works of it, was required to make available source code, and offer that source code on GPLv2 terms.

Over the past two decades, as the popularity of GPL-licensed software like the Linux kernel has skyrocketed, the requirements of GPLv2 have driven business and technical strategy in the information technology market. Those in private industry therefore have placed significant economic resources at stake, hinging on the precise meaning of certain terms of GPLv2. One of those is the question of what constitutes “distribution” – the act that triggers the copyleft requirements of GPLv2. Using and modifying a program are allowed under the GPL without restriction, but when distribution occurs, the copyleft obligations apply. Companies struggle every day to identify what constitutes distribution, and often to avoid it, in order to avoid expending technical and legal resources on complex GPL compliance analysis. This article summarizes the open questions, and how those questions can be considered and resolved in everyday practice.

An American Term of Art

The GPL is at essence a conditional copyright license, and has no choice of law provision. Therefore, theoretically, only an action regulated by the applicable copyright law can trigger application of its copyleft conditions. In the United States, the “commercial right” of copyright is called distribution or publication. Therefore, in the United States, the question of what triggers copyleft obligations is considered to be identical to what constitutes distribution under copyright law.

GPL version 3, or GPLv3, which was released in 2007, attempted to internationalize the license to fit with local variations on this concept, by using neutral words such as “propagate” and “convey.” Unlike its successor, GPLv2 specifically names distribution as the trigger for copyleft requirements. GPLv2 remains in wide use – and particularly is the license applicable to the Linux kernel, so the question of what constitutes distribution under GPLv2 is still alive and well in the open source world.

Distribution, though one of the enumerated rights of copyright under U.S. law, is not defined in the Copyright Act (Title 17 of the United States Code). Title 17 grants a copyright owner the exclusive right to “distribute copies…of the copyrighted work to the public by sale or other transfer of ownership, or by rental, lease, or lending.”1 The Act states that “offering to distribute copies…to a group of persons for purposes of further distribution, public performance, or public display, constitutes publication.”2 – but this does not define distribution. Where a statute’s terms are ambiguous on its face, the rules of statutory interpretation allow us to look to the statute’s legislative history. The 1976 House Report3 also does not define “distribution”, but defines “publication” in the negative by saying, “any form of dissemination in which a material object does not change hands – performances or displays on television, for example – is not publication.”4 Later case law equated distribution with publication.5
Section 106(3) of the Copyright Act accords to the copyright owner the exclusive right “to distribute copies or phonorecords of the copyrighted work to the public by sale or other transfer of ownership, or by rental, lease, or lending.” Put differently, the copyright owner has the exclusive right publicly to sell, give away, rent or lend any material embodiment of his work.6 As the legislative history of this Section shows, the definition of “distribution” is “virtually identical with that in the definition of ‘publication’ in section 101.”7 Thus, in essence, exclusive right of distribution is a right to control the work’s publication.

In the United States, therefore, distribution means providing a tangible copy to another person. The question of what constitutes distribution therefore devolves to two questions: what is a tangible copy and what is another person?

The transfer of the work must be made “to the public” in order to trigger the definition of “distribution” under the Copyright Act. In the absence of a statutory definition of the phrase “to the public,” courts have held that a “limited” distribution that “communicates the contents of a manuscript to a definitely selected group and for a limited purpose, and without the right of diffusion, reproduction, distribution or sale,” is not distribution to the public.8
In other words, a distribution is a “general” publication if it is not made (1) to a limited group, (2) for a limited purpose, and (3) “without the right of diffusion, reproduction, distribution or sale.” The legislative history of the Copyright Act makes clear that, “when copies or phonorecords are offered to a group of wholesalers, broadcasters, motion picture theaters, etc., publication takes place if the purpose is further distribution, public performance, or public display.”9 Thus, even if the work is distributed to a single person or entity, the publication would be general if the recipient is free to diffuse, reproduce, distribute, or sell copies of the work.

In the contemporary world of information technology, many activities stray close enough to a transfer of a copy to challenge the boundaries of this definition. It is these activities that make the question of what is distribution under GPL of such great interest to companies implementing day-to-day strategies for GPL compliance. Starting at the baseline, the most obvious business case is that of a distributed product. Whether the product is software alone, or a hardware product as well, business people understand what it means to sell a product and for it to change hands. Companies trying to comply with open source licenses like GPLv2 therefore have more difficulty assessing activities that they do not consider to be the business case of commercial distribution, but that may nevertheless constitute distribution under the law. Below, this article discusses those other business cases, from the clearest to the murkiest, as a matter of law.

A Clear Case in the Clouds

Companies constantly ask whether software transmissions or remote use – sometimes called the ASP or SAAS model, or cloud computing – constitute distribution.

While this is one of the most controversial aspects of free software licensing, it is not a troublesome interpretation issue under U.S. law for GPLv2. Advocates of free software have long recognized that if the trigger for copyleft requirements is distribution, increasingly popular cloud computing models will circumvent those requirements. This is sometimes referred to as the “ASP loophole.”10

During the drafting of GPL version 3, this issue engendered significant controversy. At one point, a variation on GPLv3 was proposed to allow the author to select an option that would cause online use to trigger copyleft requirements. Ultimately, this variation was removed from GPLv3 and memorialized in an alternative form of the license known as the “Affero GPL.” The basic form of GPLv3 makes clear that ASP or SAAS use does not trigger copyleft requirements. In GPLv3, copyleft is triggering by “conveying” rather than distribution, and “To ‘convey’ a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.”

Under US law, distribution requires actual transfer of a copy, in whatever form. Therefore, under US law, SAAS use – which involves the access of software without transfer of a local copy to the user – does not trigger copyleft requirements.11  

The Edge Cases

Leaving aside the two relatively clear business cases of a distributed product (which clearly constitutes distribution) and pure SAAS deployment (which does not), we turn to some of the edge cases that also are common business activities, but do not fall so neatly on one side of the distribution coin or the other.

With these edge cases in mind, we now turn to extrinsic evidence of the meaning of GPLv2, and best practices in managing distribution issues.

The FSF View

The GPLv2 FAQ, promulgated by the Free Software Foundation (FSF) offers the the FSF’s insight as to what it considers a distribution that would trigger copyleft requirements. For example, one of the FAQ questions is:

Is making and using multiple copies within one organization or company "distribution"?

No, in that case the organization is just making the copies for itself. As a consequence, a company or other organization can develop a modified version and install that version through its own facilities, without giving the staff permission to release that modified version to outsiders.

However, when the organization transfers copies to other organizations or individuals, that is distribution. In particular, providing copies to contractors for use off-site is distribution.15

The FAQ also discusses a transfer between an organization and a majority-owned subsidiary:

Does moving a copy to a majority-owned, and controlled, subsidiary constitute distribution?

Whether moving a copy to or from this subsidiary constitutes 'distribution' is a matter to be decided in each case under the copyright law of the appropriate jurisdiction. The GPL does not and cannot override local laws. US copyright law is not entirely clear on the point, but appears not to consider this distribution.

If, in some country, this is considered distribution, and the subsidiary must receive the right to redistribute the program, that will not make a practical difference. The subsidiary is controlled by the parent company; rights or no rights, it won't redistribute the program unless the parent company decides to do so.16

In this FAQ, the FSF acknowledges that, at least in the United States, a transfer to or from a majority-owned and controlled subsidiary may not constitute distribution. Further, the FSF gives weight to one organization’s effective control over another to determine whether the two entities are effectively one entity for the purposes of the analysis.

There is also discussion in the GPLv2 FAQ about providing modifications of GPL code under a non-disclosure agreement:

Does the GPL allow me to develop a modified version under a non-disclosure agreement?

Yes. For instance, you can accept a contract to develop changes and agree not to release your changes until the client says ok. This is permitted because in this case no GPL-covered code is being distributed under an NDA.

You can also release your changes to the client under the GPL, but agree not to release them to anyone else unless the client says ok. In this case, too, no GPL-covered code is being distributed under an NDA, or under any additional restrictions.

The GPL would give the client the right to redistribute your version. In this scenario, the client will probably choose not to exercise that right, but does have the right.17

Many companies find the distribution question confusing because they find this FAQ confusing. In this FAQ, the FSF considers two different scenarios: (1) the contractor releases the modified code to the public generally at the direction of the client and (2) the contractor releases the modified code to the client under the GPL, and the contractor promises not to release the modified code to anyone else. Unfortunately, this FAQ section does not specify whether “a modified version” refers to a modification of the contractor’s own GPL code, or GPL code that may have been already modified by the client, or a modification of third party code.  Clearly, these three situations could be analyzed differently. If the FAQ refers to GPL code owned by either the client or the contractor, it is a trivial question; obviously the owner of GPL code can choose to deliver that code under GPL terms or not as it sees fit, because an author (as licensor) is not bound by the copyleft obligations of GPL, only the licensee. If the FAQ refers to modifications to third party code, it implies that, even if the delivery of the original code constitutes a distribution, that distribution does not trigger the copyleft obligations of GPL.

Other information promulgated by the FSF suggests that this FAQ element is not intended to address third party code. But that is, by far, the most common situation: a company wants to use some GPL code, but needs modifications. It finds an expert in the code willing to modify it on a contract basis. This is a common scenario, and in fact its ubiquity is one of the touted advantages of open source software. But the company may not plan to ever distribute the software. Therefore, if providing the code to the consultant is distribution that triggers copyleft requirements, the company will likely be unwilling to engage the consultant.

The FSF’s view is problematic for a couple of reasons. First, a practical problem: companies that hire consultants simply don’t distinguish between the business cases of in-house and contractor development. They do not expect to encounter a completely different GPL compliance landscape based on the distinction. Because FSF’s view contravenes business expectations, it is a trap for the unwary. Second, a legal problem: the provision of code for development purposes is more akin to “communicat[ing] the contents of a manuscript to a definitely selected group and for a limited purpose, and without the right of diffusion, reproduction, distribution or sale” (i.e. not publication under copyright law) than it is to common notions of redistribution or publication. Therefore, there is a strong argument that such a transfer is not distribution under the law.

The International View

It is important to keep in mind that the “distribution” question as it is analyzed here is largely unique to United States law. Because GPLv2 does not have a choice of law provision, and is a conditional copyright license, it governs only what is protected via local copyright law. A full discussion of the tenets of international copyright law bearing upon this issue is beyond the scope of this article, but it seems likely the question would have different answers outside the U.S.  The Berne Convention for the Protection of Literary and Artistic Works,18 as amplified by the WIPO Copyright Treaty, provides for a right to “make available” a literary work, which may be broader than the United States’ notion of distribution, and most importantly, could include SAAS offerings. Therefore, the triggers for copyleft obligations, based on activity outside the U.S., may have a lower threshold than in the U.S.

Best Practices for Contract Drafting and Deal Structuring

As lawyers in private practice await clarity in the common law on distribution issues, they may wish to consider certain drafting and structuring practices to clarify their clients’ intent, or to minimize the uncertainty of result in the event that courts later announce decisions on distribution questions. None of these is certain to address distribution issues in light of a contrary court pronouncement, but they might help discourage claims, provide evidence of intent, or reduce confusion when those not directly involved in the deal are asked to later assess distribution issues.

Development Agreements

To avoid confusion on whether development activities constitute distribution, consider adding terms such as:

These approaches are attractive because they comport with customary confidentiality provisions and “work made for hire” provisions in development agreements, which often recite customer control of the development activities to support treatment of the work as “work made for hire”, under CCNV v. Reid.19  

Mergers and Acquisitions

SAAS Agreements

Intercompany Agreements

An Enduring Puzzle

Distribution questions seem unlikely to be answered any time soon by United States courts. The open source enforcement actions that have been brought to date have not addressed the question. Given the other heady issues still unclear in open source law (such as the scope of derivative works under GPLv2 and the interaction of patent law and open source licensing), they may not be ripe for dispute. Also, most authors who release code under GPLv2 are simply not focused on issues like intercompany agreements and mergers or acquisitions, because they are primarily technologists rather than corporate strategists. If GPL authors generally do not intend to enforce their rights in these edge cases, there may not be a constituency that is interested enough to bring a lawsuit that will make law in this area. It therefore seems likely these questions will persist as long as GPLv2 remains a widely used license, and based on the prevalence of the Linux kernel alone, this will be a long time. Companies assessing open source compliance should be sure they have identified the types of distribution that are most likely to be questioned, so they can use open source software with confidence, and plan their transactions in a way that comports with their open source compliance strategy.


About the author

Heather Meeker is the chair of the IP/IT licensing and transactions group at Greenberg Traurig, LLP, and specializes in drafting and negotiating intellectual property transactions for software and other technology clients. She was an Adviser to the Principles of the Law of Software Contracts project of the American Law Institute, and in 2011 was selected by the Daily Journal as one of the top 25 intellectual property licensing lawyers in California. Her book The Open Source Alternative: Understanding Risks and Leveraging Opportunities was published by Wiley & Sons in February, 2008.



Licence and Attribution

This paper was published in the International Free and Open Source Software Law Review, Volume 4, Issue 1 (March 2012). It originally appeared online at

This article should be cited as follows:

Meeker, Heather (2012) 'The Gift that Keeps on Giving – Distribution and Copyleft in Open Source Software Licenses', IFOSS L. Rev., 4(1), pp 29-40
DOI: 10.5033/ifosslr.v4i1.66

Copyright © 2012 Heather Meeker

This article is licensed under a Creative Commons UK (England and Wales) 2.0 licence, no derivative works, attribution, CC-BY-ND available at

As a special exception, the author expressly permits faithful translations of the entire document into any language, provided that the resulting translation (which may include an attribution to the translator) is shared alike. This paragraph is part of the paper, and must be included when copying or translating the paper.



117 U.S.C. Section 106(3).

217 U.S.C. Section 101.

3H.R. Rep. No. 94-1476.


5Harper & Row Publs., Inc. v. Nation Enters., 471 U.S. 539, 552 (1985).

6National Car Rental Sys., Inc. v. Computer Assocs. Int'l, Inc., 991 F.2d 426, 430 (8th Cir. 1993).

7Reg. Supp. Rep., p. 19.

8White v. Kimmell, 94 F. Supp. 502, 505 (S.D. Cal. 1950); Data Cash Sys., Inc. v. JS&A Group, Inc., 628 F.2d 1038, 1042-43 (7th Cir. 1980) (concluding that “a ‘limited publication’ is really in the eyes of the law no publication at all”); John G. Danielson, Inc. v. Winchester-Conant Props., Inc., 322 F.3d 26, 36 (1st Cir. 2003); Brown v. Tabb, 714 F.2d 1088, 1091 (11th Cir. 1983); William A. Graham Co. v. Haughey, 430 F. Supp. 2d 458, 470 (E.D. Pa. 2006); Milton H. Greene Archives, Inc. v. BPI Commc'ns, Inc., 378 F. Supp. 2d 1189, 1198 (C.D. Cal. 2005); Penguin Books U.S.A., Inc. v. New Christian Church of Full Endeavor, Ltd., 288 F. Supp. 2d 544, 555 (S.D.N.Y. 2003).

9 H.R. Rep. No. 94-1476, at 138 (1976).

10The term is often attributed to Richard Stallman, but that may not be accurate. See the interview with Mr. Stallman in Groklaw, in which he says the term is misleading.

11It is worth considering that even in SAAS implementations, some components may be distributed. Today, most SAAS is accomplished only via a browser, so client software is no longer a common requirement to use SAAS. However, there are always exceptions, mostly notably Javascript, or mobile applications. Keep in mind that these are usually clearly distributed and would be subject to copyleft requirements.

12In addition, because the copyleft requirements of GPL only allow binary recipients to seek source code copies, where the recipient is a majority-owned affiliate, the issue may be moot; the recipient would simply never make the request.

13Other than special kinds of contracts, where assignment would change the basic nature of the contract, like contracts for personal services or requirements contracts. See Restatement (Second) Contracts, Section 317.

14For patent, see PPG Indus. Inv. v. Guardian Indus. Corp., 597 F.2d 1090 (6th Cir. 1979). For copyright, although the law is conflicting see e.g. SQL Solutions, Inc. v. Oracle Corp., 1991 U.S. Dist. LEXIS 21097 (N.D. Cal. 1991). This is an unpublished decision and arguably contrary to the California Supreme Court’s view in Trubowich v. Riverbank Canning Co., 182 P.2d 182 (Cal. 1947).

15 (emphasis added). This same FAQ appears in the GPLv3 FAQ as well. (

16 (emphasis added). This same FAQ appears in the GPLv3 FAQ as well. (

17 This same FAQ appears in the GPLv3 FAQ as well. (

18Online at

19Community for Creative Non-Violence v. Reid, 490 U.S. 730 held that the factors for determining whether a work of authorship is a work made for hire (owned by the company) or not (and owned by the company, but by the author), are, among others, the level of skill required to create the work, the source of the tools used in creating the work, where the work was created, the duration of the relationship between customer and author, the extent of the contractor’s discretion over when and how long to work, and whether the work is part of the regular business of the customer or consultant. Therefore, many consulting agreements recite where work will be performed, as well as other facts that might bear on whether distribution has occurred.