GPLv3 section 8 says a violation terminates your rights, but a cure can bring them back. If you stop all violation, your license is reinstated provisionally, and permanently if the copyright holder does not notify you within 60 days. A first notice can also be cured within 30 days.
What section 8 says
Any attempt to propagate or modify a covered work outside the license is void and automatically ends your rights, including related patent licenses.
Reinstatement works in two ways:
- You stop. If you cease all violation, your license from that copyright holder is reinstated provisionally, until the holder explicitly and finally terminates it. It becomes permanent if the holder has not notified you of the violation by some reasonable means before 60 days after you stopped.
- You are notified for the first time. Your license is reinstated permanently if the holder notifies you, it is the first time you have received notice of violation of this license from that holder, and you cure the violation within 30 days of receiving the notice.
The text also says termination does not end the licenses of people who got copies from you, as long as they comply.
Why speed matters
Provisional reinstatement is not permanent. Until the 60 day period passes without notice, or the 30 day cure succeeds, the holder can still finally terminate. So the work starts the day you find the problem, not when a letter arrives.
Section 8 applies to the GPLv3 family. GPLv2 has a different termination clause, so check the version before you rely on these periods.
What to do the day you find it
- Stop the violating distribution. Pull the download or pause the shipment.
- Write down what happened. Which versions, which components, which dates.
- Fix the cause. Publish the Corresponding Source, add notices and license texts, or remove the component.
- Get counsel involved before contacting any rightsholder.
- Check other products for the same component.
Prevention
Most violations come from a missing source offer, missing license texts or a component nobody knew was inside an image. A current SBOM per release removes the third cause. Safeguard's SBOM and dependency scanning can produce that inventory; try the free scan. The cure steps themselves belong with your legal advisers.
Quick check
Does a violation permanently end my GPLv3 license?
Not necessarily. Section 8 provides for provisional and permanent reinstatement if you stop violating and, for a first notice, cure within 30 days.
Do the same periods apply to GPLv2?
Do not assume so. GPLv2 has its own termination wording. Read the version that applies to the code.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
