A GPL violation is a copyright problem, not an etiquette problem. The GPL is conditional permission: copy, modify, and distribute this code under these terms, or do not copy at all. Meet the terms and distribution is lawful. Break them, ship the binary, withhold the source, bolt on your own restrictions, and the permission is gone, along with the license defense. What remains is ordinary copyright infringement, with everything that label brings: takedowns, injunctions, damages, and impounded products.
Enforcement has rules of its own, though. Only the people who hold copyright in the violated code can act with real force, the community's history with strategic enforcement shapes what courts and platforms expect, and the two main tools, a compliance demand and a DMCA takedown, do very different things. Here is how the pieces fit together.
What GPL Compliance Requires When You Distribute
The GPL's obligations attach to distribution. GPLv2 calls it distribution; GPLv3 calls it conveying. Either way, the trigger is handing the software, or a product containing it, to someone outside your organization. Running GPL code inside your company creates no obligations, and neither does offering it as a hosted service, the gap that motivated the Affero GPL, which adds network use to the triggers.
When you do distribute, the license requires:
- Corresponding Source: the complete, buildable source code, including build scripts, makefiles, and toolchain details, not a code dump that will not compile.
- Intact notices: copyright lines and the license text travel with the work.
- No additional restrictions: you cannot wrap the source in an NDA, charge beyond cost for it, or condition access on a purchase.
- Source access: ship source with the product or offer it in writing. GPLv2 requires that written offer to stay valid at least three years; GPLv3 has parallel mechanics plus installation information for consumer devices, so owners can install modified versions on hardware they bought.
- Freedom to charge: GPL software can be sold like anything else. Free refers to freedom, not price.
The unresolved edge is what counts as a derivative work. If your program calls GPL libraries or mixes code, whether your code must also carry the GPL turns on a derivative-works analysis US courts have never settled with a clean line. Linking methods, architecture, and actual copying all matter. Prudent teams isolate GPL components or get counsel before shipping, and virtually every enforcement campaign agrees on one boundary: internal use is safe, and the gray zones sit around linking.
Who Has Standing to Enforce the GPL
Enforcement belongs to copyright holders. A recipient of GPL software holds a non-exclusive license, permission, not ownership, and non-exclusive licensees cannot sue for infringement in the US. If your router's vendor violates the GPL, you can complain to the code's owners, but you cannot take the vendor to court yourself, and you cannot sign a takedown notice on the strength of being a user. The same ownership analysis governs who can file a DMCA takedown: the signer must be the rights holder or an authorized agent.
Fragmentation follows from that rule. The Linux kernel has no copyright assignment and no contributor agreement, so thousands of individuals each own their patches, and each can enforce only what they wrote. That shaped the German case Christoph Hellwig brought against VMware in 2015: the Hamburg court dismissed it the next year because he had not proven, specifically enough, which lines he owned and that they had been copied. Standing is only as good as your records. Projects that use assignment, as GNU packages assigned to the Free Software Foundation do, enforce from a position of strength.
US procedure adds two layers. You must register the work with the Copyright Office before filing an infringement suit, the Supreme Court confirmed that requirement in 2019, and the Office's software deposit rules let you register identifying portions of source rather than the whole program. Statutory damages and attorney's fees, however, generally require registration before the infringement or within three months of publication, which decades-old public code rarely has. Injunctions and impoundment remain available regardless. That is why most US enforcement seeks compliance, not cash, and whether copyright registration is worth it depends on your goals and timeline.
None of this is unique to copyleft. The same conditional-grant logic governs Creative Commons enforcement and every other public license.
How Copyleft Enforcement Went Strategic
GPL enforcement did not begin in court. The Free Software Foundation spent its first two decades resolving violations quietly, letters, phone calls, compliance plans, with a strong preference for bringing companies into compliance over collecting anything. Litigation was a last resort.
Germany changed that. In 2004 Harald Welte launched gpl-violations.org, a one-man clearinghouse for complaints about GPL violations in embedded devices, and a Munich regional court granted him a preliminary injunction against router vendor Sitecom, reasoning that a company flouting the GPL has no permission left to copy the code at all, continued distribution is simply infringement. German procedure made that route unusually fast, and Germany became copyleft's early enforcement capital.
Two US developments followed. In 2008 the Federal Circuit decided Jacobsen v. Katzer, technically an Artistic License case, but the reasoning travels. The court held that an open source license's restrictions are conditions on the permission, not mere contract promises, so using code outside the license is copyright infringement and injunctions can issue. Then came BusyBox, the compact Unix toolset embedded in thousands of devices. In 2007 developers Erik Andersen and Rob Landley filed the first US GPL lawsuit, against Monsoon Multimedia; it settled within weeks, with payment and a required open source compliance officer. More suits followed against consumer electronics companies, Best Buy among them in 2009.
Money changed the tone. Landley publicly walked away from the campaign, saying the lawsuits had become about cash rather than compliance; defenders answered that settlements are what make enforcement deter. The argument inside the community never fully closed. Results were uneven regardless: in 2014 Conservancy won a $90,000 default judgment against Westinghouse, then watched a defunct defendant make collection mostly theoretical.
Strategy matured into process. Conservancy's suit against Vizio, filed in California state court in 2021, deliberately avoids copyright claims: it argues that end users are third-party beneficiaries of the GPL and asks for specific performance, release the source. Whatever its final outcome, it is the most serious attempt yet to route around the standing wall. In the other direction, dozens of companies, starting with IBM, signed the GPL Cooperation Commitment in 2018, promising violators at least 32 days to cure before enforcement begins. The arc bends toward process. The leverage underneath never changed: copyright.
Curing a GPL Violation: What Happens After You're Caught
Most GPL enforcement ends here, in paperwork, which is where everyone should want it to end.
A typical compliance demand asks for the source code of the product at issue, restored notices, removal of any additional restrictions, a commitment covering future releases, and a named compliance contact. Community-oriented enforcement, the approach the FSF and Conservancy both publish, prioritizes source release over money; where payments appear, they exist as deterrence.
Termination is where the license versions diverge. Under GPLv2, any violation voids the license automatically, and reinstatement is entirely at the copyright holder's discretion. In practice that is usually an email granting permission to distribute again once the company cures, but no violator has a right to it. GPLv3 builds the cure into the license itself: fix the violation within 30 days of notice and, if it is your first notice from that holder, your rights are permanently reinstated. The Cooperation Commitment's 32 days is deliberately more generous still.
If you receive a violation notice, do not argue scope by email, do not ignore it, and do not quietly delete the product. Under GPLv2 your license is already terminated, and every additional copy shipped is new infringement. Audit fast: which versions went out, which components, whose copyright. Preserve what you find, cure, and get reinstatement in writing. If what arrived is a DMCA takedown against your repository rather than a private letter, the clock and the procedure are different, read up on what to do when you receive a DMCA notice before you reply, because counter-notice deadlines run in days.
What a DMCA Takedown Can and Cannot Fix for GPL Code
Takedowns work on copies, and only copies, that someone else hosts. Section 512 of the Copyright Act protects hosts through the DMCA safe harbor: they are not liable for what users upload if they run a notice-and-takedown process, which makes the notice itself the lever rather than a demand letter to the host. So when someone posts a proprietary fork of your GPL project, leaks your source, or distributes your firmware images through an account, the host can be made to remove them. GitHub's guide goes further and treats code used beyond the scope of its license as actionable under its DMCA process, study how GitHub takedowns work before filing, because the platform's requirements decide what happens next.
Takedowns cannot force a company to release source for devices already sold, and they cannot cure a license. Removing the hosted copy does nothing to the product in the field. Two specific risks come with the tool. First, a host may look at a GPL dispute, call it a licensing disagreement, and decline, platforms do reject notices, and there are defined next steps when a takedown is rejected. Second, the target can counter-notice, which starts a statutory clock: the host restores the material after roughly 10 to 14 business days unless you file suit. Learn what happens after a counter notice before you send anything. A knowingly false notice also carries liability for misrepresentation, so ground it in ownership and dated evidence.
Geography matters as much as platform policy. The DMCA is US law; a foreign host may honor it by contract or ignore it entirely, and outcomes vary country by country.
Compliance Demand or Takedown: How to Choose
Run your situation through four questions.
- What outcome do you want? Source released, only a compliance demand achieves that. A hosted copy removed, only a takedown does that quickly.
- What is your relationship to the code? Only a copyright holder or authorized agent can credibly send either. Owners choose; everyone else can only advocate.
- Who is the violator? A company with customers and partners usually responds to a firm letter. An anonymous reposter of your firmware has nothing to protect; skip the letter and file the notice.
- Where does the material live? In a shipped product, demand compliance. On a platform, file a takedown. If both, send the demand and let the takedown proceed while it is pending.
Costs and timelines differ accordingly. A compliance letter is slow, weeks, and cheap, and it produces durable fixes; the 32-day cure window is a fair template for your deadline. A takedown is fast and inexpensive, see how long a DMCA takedown takes and what takedowns cost, but it resolves less: a removed copy is not a cured license, and a counter-notice can restore it. If your counterparty is worth suing, weigh a cease-and-desist versus a DMCA notice rather than defaulting to either. Whatever you send, build the record first: an evidence checklist covering ownership, the violation, and your notices is what carries a demand, a takedown, and any case that follows. Consistency compounds, platforms must terminate repeat infringers to keep their safe harbor, so chronic violators eventually lose accounts, not just posts.
Enforcement does not have to be a solo project. Commercial matters, a competitor shipping your code, a product line built on your work, are exactly what software and app protection services are built for, with monitoring that catches violations before they spread.
Open Source GPL Enforcement: Frequently Asked Questions
Can I file a DMCA takedown over a GPL violation?
Sometimes. You need to hold copyright in the misused code or act as the holder's authorized agent, and the notice must target a hosted copy, a repository, a download page, a posted firmware image. A takedown cannot force a company to release source for units already sold; only a compliance demand or litigation gets that. If you are a user rather than a contributor, you lack standing for either.
Who can sue to enforce the GPL?
In the US, only the copyright owner of the violated code or an exclusive licensee, and only after registering the work. Recipients and users cannot sue. Conservancy's Vizio suit tests a contract-based workaround on behalf of end users, but the theory is unproven. Enforcement abroad follows each country's copyright law; Germany, home of the early injunctions, has historically been friendlier to fast action.
Do I have to open-source my whole product if it uses GPL code?
Only if your product is a derivative work of the GPL code and you distribute it. Internal business use and hosted services generally trigger nothing. Whether combining your code with GPL code creates one program is fact-specific, linking methods and architecture matter, and US courts have never drawn a clean line. Isolate components or get counsel before shipping.
What happens if I ignore a GPL compliance notice?
Under GPLv2 the license has already terminated, so every additional copy shipped is copyright infringement, with exposure to injunctions, damages, and disrupted sales. GPLv3 offers cure windows, and they close. Ignoring the notice is the most expensive path available; curing source obligations is usually modest engineering work. Respond, audit, cure, and get reinstatement in writing.
How long does GPL enforcement take?
A compliance letter typically resolves in weeks; the 32-day cure period of the GPL Cooperation Commitment is a realistic template for your deadline. DMCA takedowns move faster, often within days once the notice is complete. Litigation is the slow lane, measured in years. Most matters never get past the letter stage, which is why the letter is worth writing well.
Your Next Steps
- Establish your position. Contributor or rights holder? Gather what proves you own the code, commits, records, registrations, because ownership proof is what enforcement runs on.
- If you distribute GPL code, audit one shipping product before someone else does: does the source offer exist, are the notices intact, did anyone bolt on conditions?
- If you received a notice, respond inside the window, cure, and secure written reinstatement.
- If you are enforcing, match the tool to the target: demands for compliance, takedowns for hosted copies.
- If the other side will not move, escalate with professionals, see our pricing for flat-rate takedown and protection plans, and know when to hire a copyright lawyer instead of going alone.