Your Company Received an Open Source License Violation Letter: Real Exposure and Next Steps

Last updated: November 2026. Reviewed by Pavel Kolmogorov, California business litigation attorney (State Bar No. 321018).

A letter claiming your product contains GPL code does not by itself force you to publish your source. No court has ordered anything yet, and these disputes commonly end in compliance, replacement of the component, or a negotiated payment. The exposure is still real. Open source license conditions can be enforced through copyright law, including by injunction. (Jacobsen v. Katzer (Fed. Cir. 2008) 535 F.3d 1373, 1381-1382.) Kolmogorov Law, P.C. defends software companies in Orange County, Los Angeles, and across California.

Call (909) 235-6116 or contact us online to discuss an open source compliance demand before you answer it or change your product.

What the letter is, and who can send it

Open source software is copyrighted software that the owner lets everyone use on stated terms. The letter says your product uses a component without following those terms. The sender may be the developer or company that owns the code, an enforcement organization, or now and then a competitor.

Who sent it matters. Only the legal or beneficial owner of an exclusive right under a copyright may sue for infringement. (17 U.S.C. § 501(b).) A sender that neither owns such a right nor acts for someone who does is left with a contract theory, and that law is less settled.

No statute sets a response deadline. The date in the letter is the sender's choice. Treat it seriously anyway, because some licenses tie the right to cure a violation to prompt action after notice.

Permissive and copyleft licenses ask for different things

Many permissive licenses, such as the MIT, BSD, and Apache licenses, mostly ask that you keep copyright notices and include the license text. Violations can often be cured by adding what is missing.

Copyleft licenses ask for more. The GNU General Public License family generally requires a company that distributes a program built on GPL code to offer the corresponding source code under the same license. That is the "release your source" demand.

Whether the obligation reaches your own code depends on facts the sender usually cannot see. Was the component modified? Is it combined into one program, or does it run separately? Do you distribute the software at all, or only run it on your own servers? As they are commonly read, most GPL versions treat a purely hosted service differently than the network-focused variants do. Courts have not drawn a clear line on where a derivative work begins.

I see companies assume the worst case from the first paragraph of the letter. The worst case is rarely the right reading.

How an open source license violation is enforced

Copyright comes first. A federal appeals court, applying California contract principles, held that the terms of an open source license were enforceable conditions, so that copying outside them could be infringement. (Jacobsen, supra, 535 F.3d at pp. 1381-1383.) The Ninth Circuit draws the same line for software licenses generally. Terms that limit the scope of a license are conditions, and breaching them can be infringement when the conduct touches one of the owner's exclusive rights. Other terms are covenants, enforceable only as contract. (MDY Industries, LLC v. Blizzard Entertainment, Inc. (9th Cir. 2010) 629 F.3d 928, 939-941, as amended Feb. 17, 2011.)

Contract is the second. A license is also an agreement, and contract claims have been allowed to proceed next to copyright claims. Whether someone who merely received the software can sue for the source code as a beneficiary of the license has been raised in California litigation. I would not treat that question as settled either way.

Your real exposure

Start with what a court can order. It can enjoin further distribution of an infringing product. (17 U.S.C. § 502(a).) For many companies that is the true risk: a shipping product that has to be pulled or rebuilt.

Money is usually the smaller piece. The owner may recover actual damages and the infringer's profits attributable to the infringement. (17 U.S.C. § 504(b).) Statutory damages and attorney fees are generally available only if the work was registered before the infringement began, or within three months after first publication. (17 U.S.C. § 412.) Many open source projects were never registered on that schedule, so ask the sender for the registration. Our page on statutory damages and fees explains the ranges.

Old conduct has a limit as well. A civil copyright claim must be filed within three years after it accrued. (17 U.S.C. § 507(b).)

The exposure no statute lists is commercial. An unresolved claim can stall an enterprise sale, a financing, or an acquisition.

What to do, and what not to do, in the first two weeks

Do these things first.

Preserve the repositories, build files, and release history as they are. Our page on litigation holds explains why.
Have engineering confirm whether the component is present, which version, under which license, and how it is used.
Read the license itself for termination and cure terms. Some versions end your rights automatically on a violation, and others restore them if you fix the problem soon after notice.
Run the investigation through counsel so communications seeking legal advice can be privileged. The underlying facts and records are not.

Avoid these mistakes.

Do not ignore the letter.
Do not admit a violation in a quick reply.
Do not publish your source code in a panic. You cannot take it back.
Do not quietly strip the component and deny it was ever there.

Why these claims surface when a company is sold

Open source problems often come to light when a buyer or investor has the code scanned. An unresolved compliance demand, or copyleft code found inside a proprietary product, can delay a closing and later become an indemnity claim between buyer and seller. The transaction itself belongs to deal counsel. Our part is the dispute: answering the claimant, and litigating if the license claim or the indemnity fight reaches court.

What we do

I read the letter against the license text and the engineering facts, test the sender's ownership and registration, and prepare a response that preserves every defense. If a suit is filed, it will usually be in federal court, which for Orange County and Los Angeles companies often means the Central District of California.

What to bring to the first meeting

The letter and anything else received from the sender.
The name, version, and license of each component the letter identifies.
A short description from engineering of how each component is used and shipped.
Any open source policy, code scan report, or software bill of materials you have.
Customer contracts that contain open source or intellectual property warranties.

Frequently asked questions

We received a letter saying our product includes GPL code and we must release our source code. Do we have to?

Not because of the letter alone. A demand is not a court order, and whether the GPL reaches your own code depends on how the component is used and distributed. For a California company the usual paths are compliance, replacing the component, or a negotiated license. Have counsel and engineering verify the claim before you publish or concede anything.

What is an open source license violation?

It is the use of open source software outside the terms of its license, such as shipping a product without required notices or without offering source code a copyleft license calls for. In federal courts in California, breach of a term that limits the license's scope can be copyright infringement, and breach of other terms is a contract claim.

Can a company be sued for violating the GPL?

Yes. The owner of the copyright in the code can sue in federal court for infringement if the company's use falls outside the license conditions, and can ask for an injunction and damages. (17 U.S.C. §§ 501(b), 502(a).) Contract claims are also brought. A California company should confirm who owns the code and whether it was registered.

How much can an open source copyright owner recover?

It depends on registration. Actual damages and the infringer's attributable profits are available in any timely federal copyright case. (17 U.S.C. § 504(b).) Statutory damages of $750 to $30,000 per work, up to $150,000 for willful infringement, and attorney fees generally require timely registration. (17 U.S.C. §§ 412, 504(c).) California defendants should request the registration certificate early.

Our developers used an open source library years ago and nobody tracked the license. What should we do now?

Inventory first. Have engineering run a scan that lists every open source component, its version, and its license, then compare each license with how the product is shipped. Because license conditions can be enforced through copyright law, fix notice gaps and get advice on any copyleft component before the next release. A California company that does this before a letter arrives is in a far better position if one comes.

Talk to a California software and copyright litigation attorney

If your company has received an open source compliance demand, call (909) 235-6116 or contact us online. Kolmogorov Law, P.C. is located at 327 Magnet, Irvine, CA 92618, and represents software companies in Orange County, Los Angeles, and throughout California. Our intellectual property litigation page describes the wider practice.

This page provides general information about copyright and contract law and is not legal advice. Outcomes depend on the license, the way the code is used, the facts, and the court.