GPL, MIT, Apache-2.0: What the Differences Actually Cost

What Each Licence Actually Demands

The MIT Licence is famously short. A company that ships a product using MIT-licensed code must retain the original copyright notice and licence text in its distribution. That is the full obligation. No source disclosure, no reciprocity, no restriction on how the code is used in a proprietary binary. The Apache License, Version 2.0, runs considerably longer and adds three meaningful requirements: retention of attribution notices, preservation of any NOTICE file the upstream maintainer supplies, and a patent grant — each contributor explicitly licenses their patent claims to downstream users. For corporate legal departments, that patent grant is often the reason Apache-2.0 wins over MIT on a shortlist; it reduces the exposure to patent claims from contributors who later turn hostile.

The GNU General Public License, in its version 2 and version 3 forms, imposes a fundamentally different logic. Copyleft means that any work that is derived from GPL-licensed code — or that links against it in ways that constitute a derivative work — must itself be distributed under the GPL when it is distributed at all. Version 3 added anti-tivoisation clauses, which require that the hardware or firmware distributing a GPLv3-covered binary must permit the user to install modified versions. That clause alone has caused companies shipping embedded devices to audit their entire dependency trees for GPLv3 exposure.

A printed Software Bill of Materials document on a desk beside a keyboard, the document's header and table structure legible, a pen resting across the top corner — PLATE 02A bill of materials only helps if somebody downstream is obliged to read it.Photo: Kindel Media / Pexels

The boundary between "derivative work" and "independent program" is where corporate legal analysis actually lives. The GPL FAQ maintained by the Free Software Foundation distinguishes, for example, between a program that links a library at runtime through a well-defined interface versus one that is statically compiled with it — but the FAQ is not a court judgment, and that ambiguity has never been fully resolved by litigation in most jurisdictions.

An old shareware CD-ROM sleeve — a 1990s compilation disc — shot flat on a light surface as a period object, the printed cover art and 'shareware' label clearly visible — PLATE 03The channel that ran on an honour system, before a store sat in the middle of every install.

The Gap in Practice: Adoption Decisions and Corporate Bans

Google's well-documented internal policy, described in public talks by engineers from that organisation over many years, restricts the use of AGPLv3-licensed code in products that are exposed to users over a network, because the GNU Affero General Public Licence extends the GPL's copyleft to network-delivered software: any user who interacts with an AGPL-covered service must be able to obtain the source. That requirement, if applied broadly to Google's infrastructure, would trigger disclosure obligations across services the company treats as proprietary. The policy is not about principle but about the legal surface area.

Amazon Web Services, when it built its ElastiCache managed service on Redis, relied on the fact that Redis was then BSD-licensed — functionally equivalent in obligation to MIT. When Elastic moved Elasticsearch to the SSPL in January 2021, AWS forked the project under the Apache-2.0 licence, naming the fork OpenSearch. The licence was the proximate cause of the fork, not any technical disagreement. Similarly, when Redis Ltd moved Redis from BSD to the RSALv2 and SSPL dual licence in March 2024, the Linux Foundation sponsored a community fork — Valkey — within weeks, again under BSD terms.

What those episodes share is a calculation that is purely cost-based. A company running permissively licensed software on managed infrastructure owes nothing back to the upstream project as a matter of licence law. Switch to copyleft or to a source-available licence that imposes service-level obligations, and the cost of compliance rises in ways that managed-service operators are not willing to absorb.

For a company shipping an on-premises product, the GPL's copyleft creates a different problem: it propagates. A product that statically links a GPLv2-only library cannot be distributed under a proprietary licence. That single dependency forces a choice — remove the library, rewrite the functionality, dual-licence the product, or ship the entire product under the GPL. None of those options is free, and the first two are measured in engineering weeks. The third requires that every contributor to the product has transferred or licensed their copyright in ways that permit dual-licensing — which is why a Contributor Licence Agreement is not a bureaucratic formality but an enabling document. Without a CLA, a project steward cannot relicence at all, regardless of what the board decides.

What Apache-2.0's Patent Grant Costs the Other Way

The Apache-2.0 patent grant is the licence's most commercially significant clause in the opposite direction: it constrains contributors, not just downstream users. Any contributor who submits code to an Apache-2.0 project grants a royalty-free, worldwide licence under their patent claims that read on that contribution. If a company later asserts those patents against a user of the project, the Apache-2.0 licence terminates for that asserting party. This is sometimes called a patent retaliation clause, and it is one of the reasons the Open Source Initiative's approved-licence list distinguishes Apache-2.0 from MIT despite both being permissive: Apache-2.0 carries real obligations for any contributor who holds patents in the relevant technology space.

A licence file — its SPDX header and copyright notice clearly visible — displayed in a terminal window on a large monitor, shot at an angle that shows both the text and the room behind it

For a large technology company contributing to, say, an Apache Software Foundation project, the patent grant is a strategic concession. It is also why some companies prefer to release their own infrastructure tools under Apache-2.0 rather than MIT: a competitor who forks the code and then sues them for patent infringement loses their licence to the original code automatically.

The GPL family handles patents differently across versions. GPLv2 is silent on the point in a way that has produced legal uncertainty. GPLv3 added an explicit patent licence grant and a "no further restrictions" clause designed to prevent a distributor from layering patent encumbrances on top of the licence. The incompatibility between GPLv2 and Apache-2.0 — the FSF ruled that Apache-2.0's patent termination clause constitutes an "additional restriction" under GPLv2's terms — means that GPLv2-only code cannot be combined with Apache-2.0 code in a single distributed binary. That incompatibility matters in practice for any project that mixes Linux kernel code (GPLv2-only by Linus Torvalds' longstanding stated preference) with Apache-2.0-licensed components in userspace tools.

An adult speaker on a conference stage mid-presentation, a slide behind them showing the text of an open-source licence clause, the audience partially visible in the foreground — PLATE 05Licence changes are argued in public, on stage and on mailing lists, before they are argued in court.

The three licences together create a spectrum: MIT asks almost nothing, Apache-2.0 asks for attribution and patent peace, and GPL asks for reciprocity. The real cost is not a legal fee — it is the engineering and governance decisions a company must make before it ever ships a line of someone else's code.