How copyleft licences work, triggers, obligations and where they bite

Copyleft is a licensing device that turns copyright's usual role on its head while relying on it completely. The idea is simple. Instead of using copyright to keep a work locked down, the owner uses it to guarantee that the work, and everything built from it, stays open. Anyone can use, modify and share the work, on one condition: if you pass on your version, you must pass on the same freedoms, under the same or a compatible licence.

That condition is called share-alike, and it is where Australian businesses get into trouble. Software built on GNU GPL, LGPL or AGPL components, and content published under Creative Commons Attribution-ShareAlike, can silently carry obligations that only switch on at particular moments: when you distribute a product, when you serve modified code over a network, or when you publish an adaptation.

This guide explains the machinery behind copyleft: how it borrows the exclusive rights in the Copyright Act 1968 (Cth), what exactly turns the obligations on, what each major licence demands, where the traps are, and what happens if you breach. If you build software, ship devices, run a hosted service or publish content, this is the mechanics you need before your first release.

The engine: copyright with a condition attached

Copyleft has no separate legal existence. It works entirely through copyright, and copyright in Australia needs no registration. Under s 32 of the Copyright Act 1968 (Cth) (the Act), copyright automatically subsists in original literary, dramatic, musical and artistic works from the moment they are created. Computer programs are protected as literary works, and the owner's exclusive rights under s 31 of the Act include reproducing the work, publishing it, communicating it to the public and making an adaptation of it.

Those exclusive rights are the power source. A licence is simply permission to do acts that would otherwise infringe them. A copyleft licence grants that permission widely, but attaches conditions. Comply with the conditions and you can copy, modify and redistribute. Breach them and the permission falls away, and the owner's exclusive rights snap back into place. Every copyleft licence is, at its core, a copyright licence with strings attached.

The players in this system:

Licensor: the copyright owner who releases the work under the licence and grants the permissions.
Licensee: your business, if you take the code or content into your product or service.
Downstream recipients: everyone you pass the work to. The licence follows the work, so each recipient gets the same permissions you got.
Contributors: third parties who add code or content to a project you publish. Their copyright matters if you later want to change the licence.
Enforcers: projects, foundations and organisations such as the Free Software Foundation and the Software Freedom Conservancy that pursue compliance on behalf of copyright holders.

Copyright in Australia lasts a long time, generally 70 years after the author's death under s 33 of the Act, so these conditions are not a short-term concern. They attach to the work for its whole life.

The single most useful thing to understand about copyleft is that the obligations are not always on. They switch on at a defined trigger, and each licence family defines its own. In every case the question is the same: have you done an act that the licence makes conditional?

For the GNU licences, the trigger is conveying a covered work. Under s 0 of the GNU GPL v3, to convey means any kind of propagation that enables other parties to make or receive copies, and the definition is explicit that mere interaction with a user through a computer network, with no transfer of a copy, is not conveying. A covered work is the program itself or a work based on it, and a work is based on the program when it copies from or adapts all or part of it in a way that requires copyright permission.

What does not trigger the obligations matters just as much:

Internal use: you may make, run and propagate covered works that you do not convey, without conditions, under s 2 of GPL v3. Running a modified version on your own servers, or inside your own organisation, does not require you to publish anything.
Aggregation: putting GPL-licensed software on the same storage medium as separate, independent works does not bring those other works under the licence, under s 5 of GPL v3. The line between separate works and one combined program is where much of the real-world uncertainty lives.
Off-site contractors: the Free Software Foundation's guidance is that copies made within one organisation are not distribution, but providing copies to contractors for use off-site is distribution, and that switches the obligations on.

For Creative Commons BY-SA, the trigger is different. It never bites on use alone. It only bites when you produce Adapted Material, which the licence defines as material derived from or based upon the licensed work through translation, alteration, arrangement, transformation or other modification requiring permission, and then share that adaptation to the public.

The Affero GPL adds a third kind of trigger, network interaction, covered below. Once you know which licence you are dealing with, the analysis becomes a checklist: do we convey copies, do we adapt and share, or do we serve modified code over a network?

The licence families and what each one demands

GNU GPL: strong copyleft for software

Version 2 (June 1991) and version 3 (29 June 2007) are the two GPLs in active use. GPL v2 s 2(b) requires that any work you distribute that in whole or in part contains or is derived from the program be licensed as a whole, at no charge, to all third parties under the GPL. GPL v3 s 5(c) says the same thing in different words: the entire work must be made available under the GPL to anyone who comes into possession of a copy. The Linux kernel is the most famous GPL-licensed project, and much commercial software quietly includes GPL components. If you convey the combination, the combined work must be released under the GPL, and if you convey it in object code form you must provide the corresponding source. GPL v3 s 6 lets you do this by accompanying the code with a written offer valid for at least three years, or by offering the source from a network server at no charge.

GNU LGPL: the library exception

Version 3 of the LGPL (29 June 2007) is the GPL plus additional permissions. It allows an application to use an LGPL library while the application itself stays under whatever terms you choose, including proprietary terms, provided you give prominent notice that the library is used, accompany the work with copies of the licences, and satisfy the relinking requirement in s 4(d). Users must be able to replace the library with a modified version, either because you give them the minimal corresponding source and corresponding application code on terms that allow relinking, or because you used a suitable shared library mechanism such as dynamic linking. What you cannot do is modify the library itself and keep those changes secret. Modifications to the library must be conveyed under the LGPL or the GPL under s 2.

GNU AGPL: closing the software-as-a-service loophole

The GPL famously allows a company to run a modified version of a GPL program on its own servers and never release the source, because no copy is conveyed. The Affero GPL (version 3, 19 November 2007) closes that gap. Under s 13 of the AGPL, if you modify the program, your modified version must prominently offer all users who interact with it remotely through a computer network the opportunity to receive the corresponding source, by providing access from a network server at no charge. Note the trigger carefully: the obligation attaches to a modified version. Running an unmodified AGPL program as a service creates no new source obligation, but the moment you modify it, every user of your hosted service can demand your modified source.

Creative Commons BY-SA: copyleft for content

CC BY-SA 4.0 is the share-alike licence for text, images, video and other creative works, and it is not designed for software. It imposes two conditions. First, attribution: if you share the licensed material, including in modified form, you must retain the creator's identification, the copyright notice, a notice referring to the licence and the disclaimer of warranties, and a link to the material, and you must indicate if you modified it, under s 3(a). Second, share-alike: if you share adapted material, the licence you apply must be a Creative Commons licence with the same licence elements, this version or later, or a BY-SA compatible licence listed by Creative Commons, under s 3(b). In practical terms, if you adapt a BY-SA image and publish it on your website or in your marketing, your adaptation must be released on the same terms, with attribution back to the original creator.

What compliance actually requires

Once a trigger has fired, compliance is mostly about delivering what the licence promises:

Know your inventory: maintain a software bill of materials and a content register recording every third-party component, its licence and its version. You cannot comply with a licence you do not know you have.
Preserve notices: GPL v3 s 4 requires you to keep copyright notices, licence texts and warranty disclaimers intact on every copy you convey, and s 5(a) requires prominent notices stating that you modified the work and when.
Deliver the right source: the corresponding source must correspond exactly to the binaries you ship and must include what is needed to build and run them. GPL v3 s 6 allows delivery by written offer valid for at least three years, or by offering the source on a network server at no charge, and GPL v2 s 3(b) has the same three-year offer mechanism.
Attribute content: for CC BY-SA, provide the attribution line, the licence notice and the link back to the original work, with modifications indicated.
Build it into the process: make licence checks part of your release pipeline rather than a post-release scramble, and keep confidential configuration and secrets out of any repository you will publish.

Where the traps are

The disputes in this area cluster around a handful of recurring problems:

The derivative line: the GPL applies to works based on the program, but not to separate independent works merely aggregated with it. Whether a plugin, a module or a dynamically linked component makes the whole a covered work is a fact-specific question. The Free Software Foundation's guidance is that a wrapper module between GPL and proprietary code does not avoid the obligation if the GPL code is part of the whole.
The SaaS surprise: GPL code running on your servers is usually safe. AGPL code you have modified is not, even though nothing is distributed.
Contractors and off-site copies: handing modified GPL code to a contractor for off-site use is distribution, whether or not you charge for it.
Licence compatibility: you cannot combine GPL v2-only code with GPL v3 code, because the two versions are not compatible and the combination would breach GPL v2 s 6. AGPL v3, by contrast, expressly permits combining with GPL v3 works under s 13. CC BY-SA is a separate ecosystem and is not interchangeable with the GNU licences.
Version traps: code released under GPL v2 or any later version can be used under v3, but code that is GPL v2 only cannot. Record which version applies, and whether the or-later option applies.
No retroactive relicensing: you can change the licence on future versions of code you own, but not on versions already released. If third parties contributed, you need their permission, or a contributor licence agreement from the start.
Moral rights: for creative content, the attribution conditions in CC licences sit alongside the author's right of attribution under s 193 of the Act, which is infringed where attributable acts are done without identifying the author under s 195AO. Getting attribution wrong can be a separate problem from the licence breach.

What happens when a copyleft licence is breached

A copyleft breach does not usually begin with a demand for money. It begins with the licence itself falling away. Under s 8 of GPL v3, any attempt to propagate or modify a covered work outside the licence is void and automatically terminates your rights, although the licence is reinstated if you cease the violation, and a first-time violator who is notified and cures within 30 days is reinstated permanently. Under s 6(a) of CC BY-SA 4.0, your rights terminate automatically on breach, and are reinstated if the violation is cured within 30 days of your discovery of it.

Once the licence has terminated, the owner's exclusive rights apply again. Copying, communicating or adapting the work without permission is then an infringement of copyright under the Act, and s 115 of the Act gives the owner a full range of remedies: an injunction, damages or an account of profits, and additional damages where the infringement is flagrant.

In practice, most copyleft enforcement is a compliance conversation rather than litigation. Copyright holders and organisations such as the Free Software Foundation and the Software Freedom Conservancy typically first ask for the missing source code or notices to be published. Because the underlying remedy is copyright infringement, an Australian business that ignores a compliance request is exposed to an action in the Federal Court with real costs consequences. The cheap fix is to know your trigger points before the request arrives.

When to get a lawyer involved

Copyleft advice is most valuable at three moments:

Before you ship: a review of your architecture and your inventory can tell you which licences you actually have, which triggers will fire on distribution, and whether your SaaS stack contains modified AGPL code.
Before you publish: if you are releasing your own code or content under a copyleft licence, a lawyer can help you structure contributor agreements, confirm you own the intellectual property your employees and contractors created, and set up a dual-licensing model that keeps a commercial pathway open.
When a demand arrives: compliance requests carry deadlines, and the 30-day cure windows in the licences are real. Acting quickly, and getting advice on what the licence actually requires, usually ends the matter far more cheaply than defending an infringement claim.

None of this requires a full-scale legal project. A focused assessment of your trigger points, your licences and your release process is a scoped piece of work, and it is the difference between a deliberate licensing strategy and discovering your obligations from a demand letter.

What triggers a copyleft obligation on release

The pattern in copyleft disputes is remarkably consistent. The business that gets into trouble did not set out to breach anything. It shipped a product, launched a service or published content, and only then discovered that a component it had used for months carried a condition that fired at exactly that moment. Every licence in this area has the same shape: the freedom is real, and the condition is precise. The trigger is distribution, adaptation or network interaction, and the cost of guessing wrong is the loss of your licence and an infringement claim on top.

So before your next release, run the checklist: what copyleft components are in the build, which licence versions, do we convey, do we serve modified AGPL code, and can we produce the corresponding source if asked? If the answer to any question is uncertain, that is the point to get a short, scoped assessment. A consultation to map your triggers before the first release is far less expensive than the alternative, and it turns a demand letter into a footnote in the planning process instead.