Copyleft and the GPL family

Copyleft is open source with a string attached: you get all the freedoms — run, study, modify, redistribute — on the condition that you extend those same freedoms to anyone you give the software to. Distribute a modified version and you must release your modifications under the same license. Where a permissive license¹ lets a recipient take the code closed, copyleft forbids exactly that. It is a clever inversion of copyright — sometimes called "all rights reversed" — using the author's copyright not to restrict copying but to guarantee it stays open downstream.

🔗 Learn more — ¹ Permissive licenses: MIT, BSD, and Apache 2.0

What copyleft is for

The point of copyleft is to make the freedoms non-revocable by anyone downstream. A permissive license trusts each recipient to keep the code open; copyleft removes the choice. If you ship a product built on copyleft code, your users get the same right to the source that you had. The GNU General Public License (GPL), written by Richard Stallman for the GNU Project, is the canonical copyleft license — and it's the reason the GNU/Linux userland could never be quietly absorbed into a proprietary OS.

The strength of the condition varies. The family runs from weak copyleft (the obligation stops at a library boundary) to strong copyleft (it covers the whole program) to network copyleft (it even covers software you never distribute, only run as a service).

GPLv2 vs GPLv3

There are two GPL generations in wide use, and the difference is not cosmetic:

• GPLv2 (1991) — the classic strong copyleft. Distribute a derivative, share the source under GPLv2. It has no explicit patent grant, which is the root of a real incompatibility (covered in license compatibility²).
• GPLv3 (2007) — added two big things. Anti-tivoization: if you ship GPLv3 code inside a consumer device, you must also provide the installation information needed to run a modified version — closing the trick (named after TiVo) of shipping the source but locking the hardware so modified builds won't boot. And an explicit patent grant plus non-assertion clause, giving downstream users the patent peace GPLv2 never spelled out.

🔗 Learn more — ² Open-source license compatibility

The version matters for compatibility, so a project that says "GPL" without a number is being ambiguous; the SPDX ids force the choice — GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only.

LGPL — weak copyleft for libraries

The Lesser GPL exists so a copyleft library can be used by software under any license, including proprietary. You may link an LGPL library into a closed program without that program becoming LGPL; only changes to the library itself must stay LGPL. The condition is that the user must be able to relink or replace the library with their own modified version — usually satisfied by dynamic linking, or by shipping relinkable object files if you link statically. This is "weak" copyleft: the boundary is the library, not the whole application. It's the pragmatic choice for a library author who wants improvements back but doesn't want to scare off every proprietary user.

AGPL — copyleft for the network

The GPL has a famous gap: its obligations trigger on distribution, and running software as a hosted service is not distribution. A cloud provider can take GPL code, modify it, run it as a SaaS product to millions, and never ship a binary — so it never has to share its changes. This is the SaaS loophole.

The Affero GPL (AGPLv3) closes it. Section 13 — "Remote Network Interaction" — says that if you run a modified version to serve users over a network, you must offer those users the corresponding source. Network interaction is treated like distribution. This is why the AGPL is the license of choice for server software that fears being strip-mined by a cloud vendor, and why several projects adopted it defensively after a relicensing fight.

The copyleft spectrum

flowchart TD
    LGPL["LGPL: obligation stops at the library boundary"] --> GPL["GPL: obligation covers the whole program you distribute"]
    GPL --> AGPL["AGPL: obligation also covers software you only run as a service"]

    classDef plain stroke:#7b88a1,stroke-width:2.5px
    classDef key stroke:#a3be8c,stroke-width:2.5px
    class AGPL key
    class LGPL,GPL plain

Weak to strong copyleft. Each step widens what the share-alike condition reaches — from a single library, to a whole distributed program, to a service you host but never hand out. The AGPL (highlighted) is the only one that reaches network use.

Copyleft is one half of the choice every project author faces. The other is permissive, and which to pick — adoption versus reciprocity — is a decision with a real tradeoff.