Who Enforces GPL Compliance
GPL enforcement is conducted by a small number of specialized organizations. The Software Freedom Conservancy (SFC) represents open source projects and pursues compliance through legal action when voluntary resolution fails. The Free Software Foundation (FSF) holds copyright on GNU software and enforces GPL compliance. The SFLC (Software Freedom Law Center) provides legal representation to open source developers. Individual copyright holders also pursue enforcement — many GPL projects have multiple contributors, all of whom hold copyright in their contributions.
Notable Enforcement Actions
The Hellwig v. VMware case in Germany (BusyBox GPL enforcement) established important precedents for GPL enforcement in European courts. The SFC pursued compliance actions against multiple consumer electronics manufacturers — including Vizio, whose court proceedings in the U.S. established that product purchasers have standing to sue for GPL violations, a significant expansion of enforcement potential. The GPL Cooperation Commitment provides some protection for companies that cure violations promptly upon notification, but this protection has limits.
The Most Common Violation Types
The most frequent GPL violations fall into three categories: failure to provide corresponding source code when distributing GPL-licensed software (the core violation); incomplete source code provision (providing some but not all of the required source); and failure to include required license notices and copyright attributions (a violation even of permissive licenses like MIT and Apache 2.0). Transitive dependency GPL violations — where the violating code was included unintentionally through indirect dependencies — are the most common in commercial software.
The Orange S.A. Precedent
The 2024 ruling against Orange S.A. — where a French court ordered over €900,000 in damages for GPL violation — is the most significant recent enforcement action. The Lasso library at the center of the case was a SAML/XML security library used by Orange since 2006. The violation was not deliberate, but the court found that deliberateness is not required — incorporating GPL code without compliance is a violation regardless of intent. The case reinforces that the GPL is enforceable in European courts with significant financial consequences.
How to Protect Your Organization
Effective GPL compliance requires three things: automated scanning of your full dependency tree to identify GPL-licensed components; a clear policy defining how GPL code may or may not be used; and a remediation process for removing or relicensing GPL components that violate the policy. Many organizations also establish a legal review process for any LGPL or other "weak copyleft" components that require case-by-case evaluation.
Detect License Violations Before They Become Lawsuits — Fossity
Fossity — Fossity's license compliance engine scans your full dependency tree and flags GPL, AGPL, and other copyleft licenses before they create legal exposure. Define your license policy once and automatically enforce it in every pipeline, every build, every day.
Visit Fossity.com →