Skip to main content
SourceTrust
See other licenses

CC-BY-4.0

Creative Commons Attribution 4.0

Credit the creator and you may use the work commercially. The credit may sit anywhere a user can reasonably find it.

On this page

What it does

Creative Commons Attribution 4.0 covers creative works and data rather than code: icons, illustrations, photographs, documentation art and data sets. Creative Commons themselves advise against using it for software, so a package declaring it is usually shipping assets. You may use the work commercially, change it, remix it and redistribute it inside a paid product. The one condition is credit, and section 3(a)(2) lets you satisfy it in any reasonable manner for the medium, means and context. Font Awesome licenses its icon set this way.

Details

The duty follows the asset wherever it appears, so a hosted interface, a shipped binary and a mobile app are all covered. What it does not require is a credit line stuck to every icon. Section 3(a)(2) accepts a link to a page that carries the information. A credits screen reachable from the asset is usually enough, and an about box or a documentation footer often works too. The judgement is whether an ordinary user could find it. The version that fails is a separate legal page nobody links to.

Pros

  • Easy to drop into a closed, paid product. Procurement has seen this family hundreds of times.
  • No copyleft on your own files. You keep your source private.

Cons

  • The notice duty is easy to miss in a desktop, mobile, or container build. A web page is not a substitute for notices inside the artifact.
  • Buyers who want an express patent grant will ask you to prefer Apache-2.0 over a short MIT-style text.

What it allows and requires

Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.

Permissions

  • Commercial use

    Commercial use is allowed. CC-BY and OFL do not ban selling a product that includes the work.

  • Modify

    You may adapt the work, within the license's share-alike or non-commercial limits if those apply.

  • Distribute

    You may share copies of the original and, where allowed, of your adaptations.

What CC-BY-4.0 requires when you ship

When a copy that includes CC-BY-4.0 code leaves your company, the grant is broad and the paperwork is easy to miss. Distribution here means an installer, a mobile binary, a container image, or an SDK another team embeds. Work this list against the artifact you actually hand over, not against a README. A hosted service that never gives out a copy still belongs on the record, but the notice duty does not fire until a copy exists.

  1. You meet the condition when the credit carries the creator's name, the copyright notice, a reference to the license, a reference to its warranty disclaimer, a link to the work where practical, and a note if you changed it.

  2. You satisfy section 3(a)(2) when the credit sits somewhere a user can reasonably reach from the asset, such as a credits screen or an about box.

  3. You cover a link-based credit when the page you point at actually carries the required information and keeps working.

  4. You handle a changed asset when you state that you changed it, without suggesting that the creator endorses your product.

  5. You keep every deployment covered when you use the same credit in a hosted interface, a shipped binary and a mobile app, because the duty is not tied to distribution.

The duties named in CC-BY-4.0

The license text itself is short. These are the named conditions. They follow the code, including files you vendor into your own repository and transitive packages in the lockfile.

Give credit

Give the credit the license asks for, in a reasonable manner, without implying endorsement.

Things to be aware of

  • Teams put the credit only on a legal page nobody can reach from the asset. Link to it from where the asset appears, or the reasonable-manner test is not met.
  • Teams overcorrect and stamp a credit line onto every icon. The license does not ask for that, and it usually makes the product worse.
  • Teams forget the change indication after recolouring or cropping an asset. Say that the work was changed; it is one sentence.
  • Teams assume CC BY behaves like a software license and apply it to code. Creative Commons advise against that, so read what the package actually contains.

What the Creative Commons Attribution 4.0 does not do

Search results often flatten Creative Commons Attribution 4.0 into a slogan. These are the usual misreads. CC-BY-4.0 is a grant with conditions, not a permission to skip the paperwork below.

  • CC BY 4.0 does not require you to publish your own source merely because you used the asset. Credit is the condition, not copyleft.
  • It does not demand a credit line stuck to every icon. Section 3(a)(2) accepts any reasonable manner for the medium, including a reachable credits screen.
  • It is not a software patent grant. Creative Commons advise against using this license for code.

How CC-BY-4.0 differs from nearby licenses

These licenses are often confused with CC-BY-4.0, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.

CC-BY-4.0
Credit the creator and you may use the work commercially. The credit may sit anywhere a user can reasonably find it.
CC-BY-3.0
The older Creative Commons Attribution license. The same deal as 4.0, with a stricter credit form and national ported versions.
CC-BY-SA-4.0
Use it commercially, but anything you build on it stays under the same license. This is where Stack Overflow snippets bite.
CC-BY-NC-4.0
Free for non-commercial purposes only. In a paid or ad-supported product the grant does not reach you, whatever the download page said.

Common questions about Creative Commons Attribution 4.0

Answers to common questions about what Creative Commons Attribution 4.0 requires, when its duties apply, and what evidence belongs with a release.

What is the Creative Commons Attribution 4.0?

Creative Commons Attribution 4.0 covers creative works and data rather than code: icons, illustrations, photographs, documentation art and data sets. Creative Commons themselves advise against using it for software, so a package declaring it is usually shipping assets. You may use the work commercially, change it, remix it and redistribute it inside a paid product. The one condition is credit, and section 3(a)(2) lets you satisfy it in any reasonable manner for the medium, means and context. Font Awesome licenses its icon set this way.

What does CC-BY-4.0 require when you ship a product?

You meet the condition when the credit carries the creator's name, the copyright notice, a reference to the license, a reference to its warranty disclaimer, a link to the work where practical, and a note if you changed it. You satisfy section 3(a)(2) when the credit sits somewhere a user can reasonably reach from the asset, such as a credits screen or an about box. You cover a link-based credit when the page you point at actually carries the required information and keeps working. You handle a changed asset when you state that you changed it, without suggesting that the creator endorses your product. You keep every deployment covered when you use the same credit in a hosted interface, a shipped binary and a mobile app, because the duty is not tied to distribution.

Does CC-BY-4.0 require me to open my own source?

It is not a software patent grant. Creative Commons advise against using this license for code.

How do I attribute CC-BY-4.0 in a product I ship?

Attribution for CC-BY-4.0 means the copyright line and the license text travel with every copy a recipient actually gets. That can be an about screen, a licenses file inside the installer, or a notice in the container image. A public page helps a buyer audit the inventory. It does not replace notices inside the artifact. If you copied files into your own repository, the header on those files still has to stay.

Is a website notice enough for CC-BY-4.0?

No. CC-BY-4.0 talks about copies. A public attestation page is the honest list for procurement. The condition is met when the notices sit in the material you hand over. Put them in the installer, the about screen, or a licenses file inside the binary, then keep the same texts on the page.

Do transitive CC-BY-4.0 dependencies count?

Yes. The condition follows the code, not the package you chose by name. If the lockfile pulled in CC-BY-4.0 transitively and you distribute that tree, those notices travel too. Listing only direct dependencies is how teams miss the duty.

How is CC-BY-4.0 different from Creative Commons Attribution 3.0?

CC-BY-4.0 asks this: Credit the creator and you may use the work commercially. The credit may sit anywhere a user can reasonably find it. Creative Commons Attribution 3.0 asks this: The older Creative Commons Attribution license. The same deal as 4.0, with a stricter credit form and national ported versions. Open the Creative Commons Attribution 3.0 page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.

Where do I record CC-BY-4.0 for a buyer?

Any identifier starting with CC-BY raises the attribution item on the project checklist, in every deployment context, because an asset is visible to users whether you host it or ship it. SourceTrust does not inspect your interface for the credit. It surfaces the item, stores the acknowledgement on the component, and blocks publishing until every applicable item is confirmed. Who approved the component and when is recorded on the approval decision, not on the item. The license text it fetched is what your published page and your export files carry.

Where do I record CC-BY-4.0 for a buyer?

Any identifier starting with CC-BY raises the attribution item on the project checklist, in every deployment context, because an asset is visible to users whether you host it or ship it. SourceTrust does not inspect your interface for the credit.

It surfaces the item, stores the acknowledgement on the component, and blocks publishing until every applicable item is confirmed. Who approved the component and when is recorded on the approval decision, not on the item.

The license text it fetched is what your published page and your export files carry. Read /docs/reviewing-component for the review flow.

See also

The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.

Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.

Ship the proof.

Import Creative Commons Attribution 4.0 and the rest of what you ship. Free to import and review. You only pay when you publish.

Start for free

Cookies on sourcetrust.dev

We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.