Can You Use GPLv3 in a Commercial Application?

Yes, you can use GPLv3 in a commercial application. The license permits selling the software, bundling it into paid products, and building a business around it without paying royalties to the original authors.¹ “Free” in GPLv3 refers to freedom, not price, and Section 10 specifically bars anyone from imposing royalties or license fees on the rights the license grants. The catch is copyleft: once you distribute the software or a modified version to someone outside your organization, they receive the same freedoms you did, including access to the source code. Whether that obligation ever kicks in depends entirely on how you use the code.

Internal Use Triggers Nothing

This is the single most important rule for a business evaluating GPLv3 software. If you never distribute the code outside your organization, you owe nothing. You can download it, modify it heavily, deploy it across every internal server you own, and never share a line of source. The FSF’s official FAQ is unambiguous: “an organization can make a modified version and use it internally without ever releasing it outside the organization.”²

Copies shared between employees within the same company don’t count as “conveying” under the license. The copies belong to the organization, not to individual staff. Many companies run GPLv3 tools internally for years without ever triggering copyleft. The obligations arise only when you give or sell copies to people or entities outside your organization.

SaaS and Network Use

Running GPLv3 software on a server and letting users interact with it over the internet is also not distribution. A company can take GPLv3 code, modify it, put it behind a web application, and serve millions of users without releasing source. The FSF designed this deliberately. The AGPLv3 preamble acknowledges: “The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.”³

That gap is significant enough that the FSF wrote a separate license to close it. The Affero General Public License version 3 (AGPLv3) adds a single clause, Section 13, requiring anyone who modifies the software to offer source code to all users interacting with it over a network.³ Otherwise the two licenses are identical. If you’re evaluating a project for use inside a SaaS product, check which one it uses. GPLv3 imposes no source-sharing obligation for network use; AGPLv3 does.

What You Owe When You Distribute

Once you hand a compiled GPLv3 program to someone outside your organization, whether by sale, download, or embedded in hardware, you must make the corresponding source code available. “Corresponding Source” means everything needed to reproduce the binary: the source files, the build scripts, and the installation instructions. Section 6 gives you several ways to deliver it:¹

Ship the source alongside the binary, on the same medium or in the same download.
Include a written offer to supply the source. For physical products, that offer must remain valid for at least three years, or as long as you offer spare parts or customer support for that model, whichever is longer. You can charge up to your reasonable cost of physically performing the transfer.
If you distribute binaries from a server, host the source on the same server, or on a different one with clear directions, at no additional charge.
For peer-to-peer transmission, tell peers where to find the source on a network server at no charge.

Every copy of the software must also include the full text of GPLv3 itself so recipients know their rights.¹ Compliance disputes usually turn on whether the source is truly complete and whether a recipient can actually rebuild the binary from it. A source archive missing a build dependency or an undocumented toolchain step does not satisfy the requirement, even if the core files are all present.

How Copyleft Can Pull In Your Own Code

If you distribute a modified version of GPLv3 software, that modified version must also be licensed under GPLv3. Your changes go back into the commons. This applies whether you’re patching a bug, adding a feature, or incorporating GPLv3 code into a larger program.¹

The harder question is what counts as a “work based on the Program.” If your proprietary code and GPLv3 code compile into a single executable, the combined work falls under GPLv3. The FSF’s position is that linking matters regardless of method: both static linking (combining code at compile time) and dynamic linking (loading a library at runtime) can create a combined work subject to copyleft. The FSF FAQ states that if programs share data structures or call functions in each other, they form “a single program” for licensing purposes.² Not every lawyer agrees a court would reach the same result for dynamic linking, but that is the licensor’s stated intent and most compliance programs treat it as the operative rule.

Aggregation Is Safe

Shipping GPLv3 software alongside proprietary software on the same storage medium does not infect the proprietary code, as long as the two are separate and independent works. The license calls this an “aggregate” and states plainly: “Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.”¹ A Linux distribution that includes both GPLv3 utilities and proprietary applications is the classic example. The line is whether the programs are combined into one work or merely co-located.

License Compatibility

Code under certain permissive open-source licenses can be combined with GPLv3 code and distributed under GPLv3 terms. Apache 2.0, the Modified BSD license, and the MIT/Expat license are all compatible with GPLv3.⁴ Code under GPLv2-only (without the “or later” clause) is not compatible with GPLv3, which creates real problems for projects trying to combine components under different GPL versions. Check compatibility before you integrate third-party code, not after the product ships.

How Businesses Make Money With GPLv3

There is no price ceiling in the license. A company can charge whatever the market will bear for a copy, whether on a USB drive, a download, or pre-installed on hardware.¹ The preamble puts it directly: you have “the freedom to distribute copies of free software (and charge for them if you wish).” Common revenue streams layered on GPLv3 code include professional support contracts, custom feature development, training, hosting, and warranty services.

Dual licensing is another widespread model. A company that owns the copyright to a GPLv3 project can also offer the same code under a separate proprietary license for customers who want to keep their modifications private. The GPLv3 version stays free for anyone willing to comply with copyleft, while enterprise customers pay for a commercial license that lifts those obligations. It works only when the company controls all the copyrights, which gets complicated once outside contributors are involved.

Patent Grants and Litigation Limits

Section 11 includes a built-in patent license. Every contributor grants all downstream recipients “a non-exclusive, worldwide, royalty-free patent license” covering any patent claims necessarily infringed by the code they contributed.¹ A company that contributes code to a GPLv3 project cannot later sue users for patent infringement based on that same code.

Section 10 adds a broader restriction: you “may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.”¹ Filing such a suit imposes a “further restriction” on the license rights, which triggers termination under Section 8. If your company holds a significant patent portfolio, these clauses deserve careful review before you contribute to or distribute a GPLv3 project.

Consumer Hardware and the Anti-Tivoization Rule

When you distribute GPLv3 software as part of a “User Product,” you must also provide the installation information a customer needs to run modified versions of the software on that device. That includes any authorization keys, signing certificates, or unlock methods required.¹ The rule is named for TiVo’s practice of shipping Linux-based devices that used cryptographic signing to block modified firmware.

A “User Product” is any consumer product normally used for personal, family, or household purposes, or any product designed or sold for incorporation into a dwelling. Routers, smart-home devices, set-top boxes, and similar consumer electronics fall under this requirement. Enterprise server equipment and industrial machinery generally do not.

Manufacturers don’t have to support modified software or guarantee the device still works after modification. The obligation is narrower: keep the installation path open. If your hardware design makes that technically impossible and you cannot provide the installation information, the license bars you from distributing GPLv3 software on that device at all.

If You Violate the License, You Can Cure It

Any attempt to distribute or modify GPLv3 software outside the license terms automatically terminates your rights, including the Section 11 patent grants. GPLv3 is more forgiving than its predecessor on this point. Section 8 offers two paths back:¹

If you stop the violation, your license is provisionally reinstated. It becomes permanent if the copyright holder does not notify you of the violation within 60 days after you stopped.
If a copyright holder does notify you, and it is the first time that particular copyright holder has notified you of a GPLv3 violation for any work, you have 30 days from receipt to fix the problem. Curing within that window permanently reinstates your license.

The structure favors compliance over punishment. The Software Freedom Law Center, which has brought GPL enforcement actions over BusyBox against companies including Cisco and Best Buy, has noted that “the vast majority of these matters usually end with violators voluntarily coming into compliance.”⁵ Litigation happens, but it is the exception. When it does, courts have issued injunctions that pull products from the market until compliance is achieved.

If your rights are terminated and never permanently reinstated, you cannot receive new licenses for the same material. Downstream recipients who already got copies from you keep their licenses; yours are gone until properly restored.

You Cannot Add Restrictions Downstream

When you distribute GPLv3 software, each recipient automatically receives a license directly from the original copyright holders, not from you. Section 10 puts it this way: “Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work.”¹ You cannot add sublicensing fees, usage restrictions, or terms beyond what GPLv3 itself provides. If your company’s standard distribution agreement contains boilerplate that conflicts with GPLv3 rights, that boilerplate is unenforceable as applied to the GPLv3 components.

Section 7 does allow a specific, limited set of additional terms on top of GPLv3: warranty disclaimers, attribution requirements, restrictions on misrepresenting the software’s origin, limits on the use of certain names or trademarks for publicity, and indemnification requirements for distributors who assume contractual liability.¹ Anything outside that list, such as “no military use” or “commercial users must pay a fee,” is a “further restriction,” and anyone who receives the code can simply strip it out. The license is self-healing on that point: unauthorized restrictions do not stick.

1
GNU Project. GNU General Public License v3.0
2
GNU Operating System. Frequently Asked Questions about the GNU Licenses
3
Free Software Foundation. GNU Affero General Public License
4
GNU Project. Various Licenses and Comments about Them
5
Software Freedom Law Center. Best Buy, Samsung, Westinghouse, and Eleven Other Brands Named in GPL Lawsuit