What violating open-source licenses can cost you

• 01

  Copyright infringement claims

  When you violate key conditions (missing required license text, withholding source, skipping attribution), courts have ruled this is copyright infringement, not merely a breach of contract.

  Jacobsen v. Katzer (2008): The U.S. Federal Circuit held that violating an open-source license’s conditions (such as disclosure requirements) constitutes copyright infringement, giving rights holders access to copyright remedies. That decision cemented the enforceability of open-source licenses in court.

  Welte v. Sitecom (Germany, 2004): The first GPL license ever litigated. The Munich District Court held Sitecom was bound by the GPL’s terms, establishing under German law that the license is a binding, enforceable contract, not just a philosophical statement.

  Welte v. D-Link (Germany, 2006): The court found D-Link had violated the GPL by shipping a Linux-based device without required source and license text, and ordered reimbursement of the plaintiff’s legal expenses, reinforcing that vendors are bound by GPL terms.

  SourceTrust's compliance health score flags packages still missing required license text or attribution before you publish, not after a court finds you noncompliant.

• 02

  Injunctions: Forced to stop distributing

  Rights holders can seek injunctive relief. You may be ordered to stop distributing your product until you comply.

  Software Freedom Conservancy v. Westinghouse (US, 2010): After Westinghouse failed to respond to a BusyBox GPL enforcement suit, the court entered a default judgment with the first permanent injunction in the US barring distribution of GPL-violating HDTV products, plus forfeiture of the infringing units. Other defendants in the same suit, including Best Buy and Samsung, settled out of court rather than face the same outcome.

  • For vendors selling software, that can mean lost revenue and customers while you remediate under pressure
  • Copyleft licenses (GPL family) are especially high stakes: Non-compliance can block sales entirely until obligations are met

  Connected repos re-sync automatically on every push, so a new copyleft dependency lands in your review queue days after merge, not months after a lawsuit forces a response.

• 03

  Financial damages and legal costs

  Courts can award monetary damages, and the losing party often pays legal fees. In some jurisdictions, moral damages for reputational harm to authors are possible.

  Entr’ouvert v. Orange (France, 2024): Orange was ordered to pay over EUR 900,000, including EUR 150,000 in moral damages, for distributing GPL-licensed code without providing source.

  Sebastian Steck v. AVM (Germany, 2024): An individual developer enforced LGPL obligations against a large corporation, recovering EUR 7,500 in legal expenses and forcing AVM to supply missing installation scripts: Proof that small rights holders can pursue large companies.

  A dated, published attestation snapshot is evidence you took obligations seriously, the opposite of the willful disregard that drove treble damages in the Westinghouse case.

• 04

  Forced open-sourcing of proprietary code

  Copyleft licenses (GPL, LGPL, AGPL) can require you to release derivative work source under the same license when you distribute non-compliantly.

  Combine proprietary code with GPL code and ship without meeting obligations, and you may face pressure, or orders, to open-source far more than you intended. That is the practical risk behind “viral” copyleft.

  Separate Testing and Published branch review catches a copyleft dependency before it reaches your Published branch and your shipped product.

• 05

  Contract claims in parallel

  Some jurisdictions also treat license violations as contract breaches, giving rights holders additional paths to pursue you beyond copyright law.

  Exports carry the exact license text and notices most licenses, and courts, treat as the underlying conditions, whether the claim is framed as copyright or contract.

• 06

  Reputational damage

  Public knowledge that you violate licenses, ignore obligations, or demand compliance from customers while failing yourself damages trust with enterprise buyers, contributors, and investors.

  • Enterprise procurement and security reviews
  • Open-source community and hiring brand
  • Board and investor diligence on legal hygiene

  A public attestation page with a trust seal is the artifact that answers a procurement or press inquiry before it becomes one.

• 07

  Deal-killing in M&A and audits

  Unresolved violations surface in acquisition diligence, SOC 2 and ISO 27001 reviews, and enterprise security questionnaires.

  • Deals delayed, repriced, or killed
  • Audit findings and failed certifications
  • Expensive remediation under deadline, often without a maintained inventory to start from

  Paste your attestation URL into the diligence questionnaire instead of scrambling to rebuild an inventory during the deal clock.

• 08

  International enforcement

  Enforcement is not U.S.-only. Courts in Germany, France, and elsewhere have imposed meaningful penalties. The trend is toward harder enforcement, not softer norms.

  SPDX and CycloneDX exports from the same reviewed snapshot cover the formats different jurisdictions ask for, without maintaining separate spreadsheets per market.

This page is educational context, not legal advice. Cases and outcomes vary by jurisdiction and facts. Consult qualified counsel for your situation.