The Mozilla Public License 2.0 applies its copyleft file by file. If you modify an MPL file, that file and your changes stay under the MPL. New files that contain no MPL code can carry any license you choose, even when they ship in the same product.
Where the line sits
The MPL FAQ says the copyleft applies to any files containing MPL code. That is narrower than the GPL, which reaches software based on GPL code, and the LGPL, which reaches libraries based on LGPL code.
Two cases show the line:
- You edit an MPL source file. Your edited file must be offered under the MPL to anyone you give the source to.
- You add a brand new file that has no MPL code. It is not a Modification, so it can stay proprietary, even when it forms a Larger Work with MPL files.
The FAQ adds that this lets MPL code be statically linked into a proprietary product.
Trigger is distribution
Copyleft in the MPL is triggered by distribution, not by running code on your own server. The FAQ also notes that delivering code to a client, such as JavaScript sent to a browser, counts as distribution. A team that assumes web delivery is safe needs to re-read that point.
Combining with GPL family code
The FAQ lists three conditions for combining MPL code with GPL or LGPL code under section 3.3:
- The MPL code is not marked Incompatible With Secondary Licenses.
- You combine it with an existing GPL or LGPL work, not just a stated preference for those licenses.
- The MPL source is also distributed under the GPL or LGPL.
Code is not incompatible by default. A plain copy of the MPL 2.0 text does not make it so. It takes an active choice by the licensor. Mixing with BSD and Apache code needs none of these conditions.
Practical steps
- Keep MPL files in identifiable directories so changes stay visible.
- Record local patches against MPL files and publish them with your source offer when you distribute.
- Keep the MPL header in each file you touch.
- Do not paste MPL code into otherwise proprietary files, because that makes those files covered.
For inventory work, Safeguard's SBOM and dependency scanning lists the packages; whether you edited a file is something your own repository history tells you. A free scan is available.
Quick check
Can I use an MPL 2.0 library in a closed source product?
Generally yes, provided you keep modified MPL files under the MPL and offer their source. New files without MPL code can stay proprietary.
Does serving MPL JavaScript to browsers count as distribution?
The MPL FAQ says delivering code to a client, such as JavaScript, counts as distribution.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
