GNU GPL License Explained — Plain English Guide (Copyleft & Commercial Use)

The GNU General Public License (GPL) is a strong copyleft license that lets you use the code commercially but requires any distributed derivative work to be licensed under the GPL too — meaning if you ship modified GPL code, you must also ship the source. It’s the license behind the Linux kernel, Git, and WordPress, and the most debated license in open source.

What You’ll Learn

By the end of this guide, you’ll understand what copyleft means in practice, when the GPL’s “viral” clause triggers, whether you can build commercial products on GPL code, and how to stay compliant without a lawyer on retainer.

Why It Matters

The GPL is one of the most common open-source licenses on GitHub, but it’s also the most misunderstood. Using GPL code incorrectly in a commercial product can force you to open-source your entire application. Companies like VMware and Cisco have faced lawsuits over GPL violations. Know the rules before you use the code.

Real-World Use

Your company wants to embed the Linux kernel in a hardware appliance you’ll sell. The Linux kernel is GPLv2. When you ship the appliance, you must make the kernel source code (including any modifications) available to your customers. But your proprietary application running on top of Linux — communicating through standard system calls — stays private. That’s the key distinction.

Quick Reference

What the GPL Actually Says

The core idea of the GPL is copyleft: instead of “all rights reserved,” it says “all rights granted — but only if you pass along the same freedoms.” If you distribute a program that contains GPL code, the entire distributed work must be under the GPL.

GPLv2 vs GPLv3

There are two common versions. GPLv2 is simpler and used by the Linux kernel. GPLv3 adds:

• Explicit patent grants — contributors grant patent rights to users
• Anti-Tivoization — you can’t block users from installing modified software on devices
• Termination provisions — automatic reinstatement if you cure a violation within 30 days

Both versions have the same copyleft mechanism. Choose GPLv3 for new projects unless you need Linux kernel compatibility (which is GPLv2-only).

Can I Use GPL Code in Commercial Products?

Yes, but with conditions. The GPL does not restrict commercial use. You can:

• Sell GPL-licensed software (Red Hat, Canonical, and WordPress all do this)
• Use GPL code in products you sell
• Charge for distribution, support, or warranties

However, if you distribute modified GPL code to others, you must:

• Provide the complete corresponding source code
• License your modifications under the GPL
• Include the original copyright notices
• Document any changes you made

The “Distribution” Trigger

The GPL’s obligations only activate when you distribute the software. If you use GPL code internally — in your own company’s infrastructure, never shipped to customers — you have no obligations to release source code.

This creates the common pattern: use PostgreSQL (MIT/PostgreSQL license) and Linux (GPLv2) in your SaaS backend internally → no source release needed. Embed modified GPL code in a shipped device → source must be provided.

The “Viral” Clause Explained

The GPL’s “viral” nature is the most misunderstood concept in open-source licensing. Here’s what actually happens:

Strong Copyleft Effect

If you take GPL-licensed code and modify it, then distribute the modified version, the entire derived work must be GPL-licensed. This means:

• Your modifications must be GPL
• Any code that is a “derivative work” of the GPL code must be GPL
• You cannot combine GPL code with proprietary code in a single distributed work

What “Derivative Work” Means

A derivative work is not just cutting and pasting code. If your program:

• Links against a GPL library → your program is a derivative work (for strong copyleft)
• Communicates via pipes/sockets → generally not a derivative work
• Runs as a separate process → not a derivative work
• Uses system calls to interact → not a derivative work

This is why the Linux kernel’s system call interface is explicitly exempted — your proprietary userspace programs don’t need to be GPL.

The Library Exception (LGPL)

The GNU Lesser General Public License (LGPL) is a weaker version designed for libraries. It allows proprietary code to link against LGPL-licensed libraries without the proprietary code becoming GPL. More permissive than GPL, less permissive than MIT.

Real-World Projects Using GPL

Common Misconceptions

“I can’t use GPL code in commercial software”

Incorrect. The GPL explicitly allows commercial use. “Commercial” and “proprietary” are not the same thing. Red Hat makes billions from GPL software.

“GPL means I have to open-source my entire app”

Only if you distribute a derivative work. Using GPL tools (like Git or GCC) doesn’t affect your code. Even linking to GPL libraries creates obligations only for the linked work, not your entire system.

“GPL code can’t be used in SaaS products”

This is the “SaaS loophole.” If you run GPL code on your server and users access it over the network, you haven’t “distributed” it — so no source release is required. The GNU AGPLv3 License was created specifically to close this loophole.

“If I use one GPL function, my whole project is GPL”

It depends on how you use it. If it’s a separate program you run, no. If you copy the function into your codebase, the copied code must stay GPL. But your surrounding code is only affected if it’s a derivative work — which mainly triggers when you statically link or distribute as a single binary.

“I can avoid GPL by using it in a web service”

True for GPL, false for AGPLv3. See the AGPL license explainer for details.

GPL Compliance in Practice

Scenario: Embedded Device

You build a smart thermostat running Linux with custom kernel drivers.

• Must release: Linux kernel source + your kernel module source (if GPL or derivative)
• Must not: Encrypt the kernel or hide modifications
• Must include: Copyright notices and a copy of the GPL
• Must offer: Written offer for source code (usually printed on the device)

Scenario: SaaS Backend

You run a modified version of a GPL-licensed database behind your web API.

• No source release required: You haven’t distributed the modified database to customers
• But: If you ever distribute the software (as a Docker image, appliance, or downloadable tool), obligations trigger

Scenario: Desktop Application

You fork a GPL-licensed desktop app, add features, and distribute the binary.

• Must release: Complete source code for your modified version
• Must license: Your modifications under GPLv3 (or whichever version the original used)
• Must include: Build and install instructions

When to Choose the GPL

Choose GPL for your own projects when:

• You want to ensure all improvements are shared with the community
• You’re building infrastructure code (libraries, tools, kernels) where locking it down hurts everyone
• You’re competing with proprietary software and want to prevent proprietary forks from dominating
• You want the strongest protection for user freedom

Avoid GPL when:

• You want the code used in proprietary commercial products (choose MIT or Apache 2.0)
• You’re building a library that needs wide adoption (choose LGPL or MIT)
• You want corporate adoption without legal review costs (many companies ban GPL v3)

FAQ

GPL vs Other Licenses

graph TB
    A[GPL] --> B[Strong Copyleft]
    B --> C[Derivatives must be GPL]
    B --> D[Source must be provided]
    E[LGPL] --> F[Weak Copyleft]
    F --> G[Linking allowed without copyleft]
    H[MIT / BSD] --> I[No Copyleft]
    I --> J[Can close-source derivatives]

Practice Questions

1. Your company modifies the Linux kernel for a hardware product. Do you need to release the kernel source? Yes. Distributing the device triggers the GPL’s source disclosure requirement for the kernel.

2. You run a modified GPL database on your internal CI server. Do you need to publish the changes? No. Internal use without distribution has no source release obligation under GPL.

3. You build a mobile app that uses a GPL library via dynamic linking. You distribute the app. What happens? Your app is likely considered a derivative work, so the entire app must be GPL-licensed. Static vs dynamic linking doesn’t change the GPL’s copyleft effect.

4. Can a company take your GPL project, modify it, and sell it as a proprietary product? No. Because they must distribute the modified version under GPL, which prevents them from adding proprietary restrictions.

5. You find GPL code in a competitor’s proprietary app. What can you do? Report the violation to the copyright holder (the original author). Only the copyright holder can enforce the GPL. You cannot sue on their behalf.

Mini Project: GPL Compliance Audit

1. Find a Git repository that uses GPL-licensed dependencies
2. Run pip-licenses, cargo-license, or npx license-checker to identify GPL components
3. For each GPL dependency, determine:
   • Are you distributing modified versions?
   • If yes, is the corresponding source available?
   • Are copyright notices included?
4. Create a NOTICE file documenting compliance
5. Set up automated license checking in CI/CD

Challenge: Contribute to a GPL-licensed project that has an active compliance effort (like the Linux kernel or a GNU project). Review their licensing headers and notice how they handle contributor copyright assignments.

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro. This guide is for educational purposes and does not constitute legal advice. Consult an attorney for specific licensing questions.