The licence families

There are hundreds of licences; the SPDX list catalogues more than six hundred. But they fall into eight families, and within a family the obligations are nearly identical. Knowing the eight covers 99 % of cases.

Overview

Family	Reciprocity	What it requires	Representatives
1. Public domain	None	Nothing, or nearly	CC0-1.0, Unlicense, 0BSD
2. Permissive	None	Attribution, preserve notices	MIT, BSD, Apache-2.0, ISC
3. Weak copyleft — file	Per modified file	Publish modified files	MPL-2.0, EPL-2.0, CDDL
4. Weak copyleft — library	Per library	Publish the library, allow replacement	LGPL-2.1, LGPL-3.0
5. Strong copyleft	Whole work	Publish the source of the distributed derivative	GPL-2.0, GPL-3.0, CeCILL
6. Network copyleft	Whole work, network included	Same, even without distribution	AGPL-3.0, OSL-3.0, EUPL-1.2
7. Source-available	Varies	Usage restrictions — not open source	BSL-1.1, SSPL-1.0, ELv2
8. Content and data	Varies	A regime of its own for non-software works	CC-BY, CC-BY-SA, OFL, ODbL

1. Public domain and dedication

CC0-1.0, Unlicense, 0BSD, WTFPL.

The author waives their rights or grants a maximally permissive licence. No attribution due.

The trap: CC0 expressly excludes any patent grant. A CC0 component whose author holds a patent protects you from nothing. Several foundations restrict its use for that reason and prefer a permissive licence with a patent clause.

Under French and German law, an outright waiver of moral rights is also ineffective — of no practical consequence in general, but it explains why some lawyers prefer MIT to CC0.

2. Permissive

MIT, BSD-2-Clause, BSD-3-Clause, ISC, Apache-2.0, Zlib, BSL-1.0 (Boost), CECILL-B.

Do what you like, including embedding in proprietary software, provided you preserve the copyright notices and the licence text and pass them on to recipients.

What separates them

Licence	Distinctive feature
MIT, ISC	The shortest. Attribution, nothing more.
BSD-2-Clause	Equivalent to MIT.
BSD-3-Clause	Adds a non-endorsement clause: you may not use the authors’ names to promote your product.
BSD-4-Clause	Adds an obsolete advertising clause: every advertisement must credit the author. Unmanageable at scale, and GPL-incompatible. Refuse it.
Apache-2.0	Express patent grant, automatic termination of that grant if you bring patent litigation against a contributor over the software, and a duty to flag modified files. A `NOTICE` file to propagate where one exists.

Why Apache-2.0 is often the best choice. It is the only common permissive licence that addresses patents explicitly. For a product you sell, that is real protection MIT does not offer.

The incompatibility to know: on the Free Software Foundation’s reading, Apache-2.0 is incompatible with GPL-2.0-only (the patent and indemnity clauses count as further restrictions) but compatible with GPL-3.0. That is why many projects moved to GPL-2.0-or-later.

The real risk of permissive licences is operational, not legal: the forgotten attribution file. It concerns hundreds of components, it generates automatically from the SBOM, and its absence is the most frequent and most easily fixed breach in the field.

3. Weak copyleft, at file granularity

MPL-2.0, EPL-2.0, CDDL-1.0, CECILL-C.

Reciprocity attaches to the files themselves. Modify a file under MPL-2.0 and that file stays MPL-2.0 and must be published. The rest of your project, including the files that call it, may remain proprietary.

This is the most workable family: it protects upstream without contaminating your code.

Licence	Distinctive feature
MPL-2.0	The reference model. Patent clause. GPL-compatible through an explicit clause, unless the author disabled it.
EPL-2.0	Comparable reciprocity. An optional “secondary licence” clause enables GPL compatibility, at the author’s choice.
CDDL-1.0	GPL-incompatible, and that incompatibility is why ZFS is not merged into the Linux kernel. Treat as a special case.

The trap: “per file” assumes you know which files were modified. Copy-pasting an MPL function into one of your proprietary files moves your file under MPL. File separation is therefore an engineering discipline, not a formality.

4. Weak copyleft, at library granularity

LGPL-2.1, LGPL-3.0.

The library stays free; the work that uses it may stay proprietary. But on one condition, often misread:

The end user must be able to replace the library with a modified version of their choosing and have your program run with it.

That is what makes dynamic linking natural and static linking expensive: statically, you must supply your application’s object files so the user can relink themselves, or any equivalent means.

Version	Distinctive feature
LGPL-2.1	The classic regime. No anti-lock-down clause.
LGPL-3.0	Inherits the GPL-3.0 clauses: patents, anti-DRM, and above all installation information for consumer products. Far more constraining in embedded and mobile.

The trap: in ecosystems where dynamic linking does not exist — a JavaScript bundle, a Go binary, a Rust executable, a mobile app — the LGPL must be treated as strong copyleft, because the replacement condition is in practice impossible to satisfy.

5. Strong copyleft

GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, CeCILL (the French equivalent, GPL-compatible).

If you distribute a binary containing GPL code — or a work derived from it — you must give every recipient the corresponding source of the whole work, under the same licence, including build and installation scripts.

The decisive word is distribute: the GPL is triggered only by conveying to a third party. Purely internal use, or running the software on your own servers, does not trigger it — see SaaS backend.

`only` versus `or-later`

The suffix is not cosmetic: it determines whether the recipient may apply a later version of the licence.

GPL-2.0-only: frozen at version 2. Incompatible with GPL-3.0 components.
GPL-2.0-or-later: the recipient may choose version 3, restoring compatibility.
A project with no explicit statement is conventionally read as -or-later — but the question has been litigated. Document what you observe; do not presume.

What GPL-3.0 adds to GPL-2.0

Addition	Effect
Explicit patent grant	Real protection, absent from v2
Anti-lock-down clause (“Installation Information”)	For a consumer product, you must supply what is needed to install a modified version. See Embedded / IoT
Anti-DRM clause	The software must not be invoked as a technological protection measure
Apache-2.0 compatibility	Resolves the v2 incompatibility
Termination with a cure period	A violation cured within 30 days of notice no longer permanently forfeits rights

Exceptions

Some projects attach an exception that narrows the GPL’s reach. In SPDX these use the WITH operator:

Exception	Effect
`GPL-2.0-only WITH Classpath-exception-2.0`	Used by OpenJDK: linking does not create a derivative work. It is what makes proprietary Java possible.
`GPL-3.0-only WITH GCC-exception-3.1`	Code compiled by GCC is not contaminated by the runtime libraries.
`Apache-2.0 WITH LLVM-exception`	Lifts an attribution constraint on generated code.
`GPL-2.0-only WITH Autoconf-exception-2.0`	Generated scripts are not contaminated.

Never read a GPL licence without checking for an exception: it changes the verdict entirely.

6. Network copyleft

AGPL-3.0, OSL-3.0, EUPL-1.2 (on its broadest reading), RPL.

Designed to close what is known as the “service provider loophole”: the GPL triggers only on distribution, and an online service distributes nothing.

AGPL-3.0, section 13: if you modify the program and users interact with your modified version remotely over a network, you must offer them the corresponding source of your version.

The nuance that matters

Read literally, the obligation targets the modified version. Running strictly unmodified AGPL software as a service does not trigger section 13.

In practice the exception almost never applies: as soon as you combine the AGPL component with your own code — a library call is enough to raise the combined-work question — the whole becomes “your version”, and it is the whole whose source must be offered.

The prudent position, and the one most corporate policies take: treat any AGPL component present in an exposed service as triggering the obligation, and reserve the literal reading for a strictly unmodified component, isolated in its own process, and documented as such.

EUPL-1.2 deserves a mention on a European site: it is the Union’s own licence, its copyleft extends to making the work available over a network, and above all it carries a compatibility clause listing the licences the work may be relicensed to (GPL, AGPL, MPL, EPL, CeCILL, LGPL…). That clause makes it an interesting choice for a European public project.

7. Source-available — not open source

BSL-1.1 (Business Source License), SSPL-1.0, Elastic License 2.0, Confluent Community License, Redis Source Available License, the PolyForm family, and the Commons Clause rider.

The code is readable, sometimes modifiable, but use is restricted. None is approved by the Open Source Initiative. Treat them as proprietary software: they belong to contract negotiation, not to open source policy.

Licence	Principal restriction
BSL-1.1	Production use restricted, save for an “additional use grant”. Automatically converts to an open source licence on a change date, typically four years out.
SSPL-1.0	If you offer the software as a service, you must publish that service’s entire source — orchestration, backup, monitoring, interfaces. Prohibitive in practice.
Elastic License 2.0	Prohibits providing the product as a managed service, circumventing licence keys, and removing notices.
Commons Clause	Not a licence but an addendum grafted onto a free licence, removing the right to sell. A library under “MIT + Commons Clause” is not MIT.

The real risk in this family is the upstream licence change. Several major projects moved from a free licence to a source-available one in recent years. Versions you already obtained remain covered by the old licence, but later versions do not — and your security updates come from later versions. See Pitfalls.

8. Content, data and fonts

Often forgotten because they do not concern code — and regularly the source of the most concrete problems.

Licence	Object	What to know
CC-BY-4.0	Content	Attribution required, including in a commercial product
CC-BY-SA-4.0	Content	Share-alike: a derivative must be published under the same licence. Content contamination.
CC-BY-NC	Content	Non-commercial use only. Prohibited in a product you sell. The most frequent error on icons and illustrations.
CC-BY-ND	Content	No derivatives: no cropping, no recolouring.
OFL-1.1	Fonts	Free redistribution, but a reserved font name clause: a modified font may not keep its original name. Selling the font on its own is prohibited.
ODbL	Databases	Copyleft on the database and on derived databases.

Creative Commons itself advises against using its licences for code: they address neither the source/binary distinction nor patents.

The case that is not a family: no licence at all

In SPDX this is NOASSERTION. In your policy it must be blocking, on the same footing as a prohibited licence — not treated as a benign missing field.