A copyleft license lets you use, change and share software, and requires that distributed modified versions stay under the same freedoms. The duty usually starts when you distribute the software, not when you only use it. Strong copyleft such as the GPL is stricter than weak copyleft such as the LGPL. This is general information, not legal advice.
Where does the idea come from?
The GNU Project describes copyleft as a general method for making a program free and requiring all modified and extended versions to be free as well. It works through copyright: the author states the program is copyrighted, then adds distribution terms that give everyone the rights to use, modify and redistribute the code, but only if those terms are unchanged. Permissive licenses such as MIT and Apache-2.0 do not carry that condition.
What are the main copyleft licenses?
GNU lists several forms. The GNU General Public License (GPL) is the main one. The GNU Affero GPL (AGPL) is designed for programs likely to run on servers: modified versions used to provide a service to the public must have their source released to that public. The GNU Lesser GPL (LGPL) is a compromise form that applies to some libraries. The GNU Free Documentation License covers manuals and similar text.
The AGPL difference is the one that surprises teams. An ordinary GPL program run as a hosted service does not trigger a source release the way the AGPL does, since the user never receives a copy.
When does the obligation actually start?
The GNU GPL FAQ is plain on this. The GPL does not require you to release your modified version, or any part of it. You may make modifications and use them privately, and that applies to organizations and companies too: they can use a modified version internally without ever releasing it. But if you release the modified version to the public in some way, the GPL requires you to make the modified source available to the program's users, under the GPL.
So the questions to ask are about distribution. Do you ship a binary to customers? Embed a library in a downloadable app? Put code on a device? Those are the events that matter.
Does linking to a GPL library make my code GPL?
That is the most disputed question in the field. The GPL FAQ has several entries on it, including whether a library under the GPL (as opposed to the LGPL) means software using it must be under the GPL or a compatible license, and whether static and dynamic linking differ. The answers depend on how the pieces are combined and on the license version. Do not settle it by rumor. Read the FAQ entries and ask counsel.
What does a real check look like?
Constructed example: a team ships a desktop installer. A dependency scan shows 300 packages. Two are LGPL libraries, loaded dynamically, and one is an AGPL component that the team forked and runs on its own servers for a customer portal. The installer question is about the LGPL notices and the right to replace the library. The portal question is about the AGPL network clause, since users interact with a modified version. Same scan, two different obligations.
How to check or apply this
- Generate a software bill of materials for each shipped product and server application.
- Record the license of every direct and transitive dependency, using SPDX identifiers where available.
- Tag each by delivery model: shipped to customers, hosted service, or internal tool only.
- Flag copyleft licenses that meet a trigger: GPL or LGPL in shipped code, AGPL anywhere users reach it over a network.
- Decide per case: replace the component, comply (notices, source offer, relinking rights), or get a commercial license from the author.
- Add a policy gate so a new copyleft dependency prompts review before merge, not after release.
- Keep a record of the decision and the license version, since GPLv2 and GPLv3 differ.
Safeguard's SBOM and dependency scanning list licenses next to vulnerabilities, and policies and gates can require a review when a rule you set is broken. Your counsel makes the call.
Quick check
Does the GPL force me to publish internal changes?
No. The GNU FAQ says you can modify GPL software and use it privately, including inside a company, without releasing it. The duty starts when you release it to others.
Why is the AGPL treated differently?
It extends the source duty to modified versions that provide a service to the public over a network, which the GPL does not.
Sources
- GNU Project, What is Copyleft?
- GNU Project, Frequently Asked Questions about the GNU Licenses
- Open Source Initiative, Licenses
Last reviewed: 18 October 2026.
