Is copyleft triggered for a backend service with GPLv3 dependency dynamically linked, if the backend exposes public API endpoints for mobile client?

Question

I'm trying to figure out if GPLv3 copyleft is triggered for the following scenario:

A company has a backend service written in a dynamically typed programming language. The service has a bunch of dependencies, including a module under GPLv3 license. The GPLv3 module is linked dynamically into the backend service's main program. The service exposes some public API endpoints, exchanging JSON-based data. The company also has a mobile client distributed via major digital distribution platforms. The mobile clients use the backend's API endpoints to operate.

My questions are the following:

1. Can the backend service the company is running be considered a private copy of GPL covered work so that copyleft isn't triggered in this case and the company doesn't have to convey (distribute) a source code of its service to the public?
2. Can be the backend service program and the mobile client considered as two independent programs (taking into account that they are exchanging JSON data)?
3. Any real court cases supporting the answers for 1 and 2? (I do understand that jurisdiction may matter here)
4. How AGPLv3 for the dependency module would change the outcome?

My understanding is that:

a. Backend service is a modified version of GPL covered work (dynamically linking considered as modification, see https://www.gnu.org/licenses/gpl-faq.html#GPLStaticVsDynamic)

b. Backend service isn't conveyed/distributed, because the interaction is done over the network (see https://www.gnu.org/licenses/gpl-faq.html#UnreleasedMods)

c. Mobile client and the backend are considered two separate, independent programs, because the interaction is based on simple JSON data, with NO source code, code generation, complex internal data structures involved in exchange (see https://www.gnu.org/licenses/gpl-faq.html#MereAggregation).

So the copyleft isn't triggered in this case, the company has a right to run its software on the backend as a private copy. The copyleft would trigger if the backend service dependency would be under GNU Affero General Public License.

But I am not a lawyer, so I am not sure. Any help is highly appreciated!

Answer 1

My understanding is that: a. Backend service is a modified version of GPL covered work (dynamically linking considered as modification, see https://www.gnu.org/licenses/gpl-faq.html#GPLStaticVsDynamic)

They call it a combined work, but close enough, yes.

b. Backend service isn't conveyed/distributed, because the interaction is done over the network (see https://www.gnu.org/licenses/gpl-faq.html#UnreleasedMods)

Correct. This is the infamous difference between the GPL and the AGPL (Affero GPL). If the code had been licensed under the AGPL, you would be required to distribute the backend's source code because you are providing access to the backend over a network.

c. Mobile client and the backend are considered two separate, independent programs, because the interaction is based on simple JSON data, with NO source code, code generation, complex internal data structures involved in exchange (see https://www.gnu.org/licenses/gpl-faq.html#MereAggregation).

This one is the only part that may be tricky. As a developer I would generally assume this is the case. However, note that JSON can be used to encode complex, internal data structures. The FSF's opinion is based on the semantics of the communication - that is, the nature of the data that is being exchanged - not whether you used JSON or not.

Consider JSON A:

{
    "searchResults": [
        {"productId": "1", "name": "Flour"},
        {"productId": "2", "name": "Sugar"}
    ]
}

That is not intimate. Anyone could write code to generate or parse that.

Now consider JSON B:

{
    "sid": "04591623",
    "qbref": "67942267",
    "data": [
        {"fmt": "QZ", "bref": "85634234", "pid": 1},
        {"fmt": "QZ", "bref": "85634235", "pid": 2},
        {"fmt": "QS", "bref": "85634236", "pst": "Flo"},
        {"fmt": "QS", "bref": "85634237", "pst": "r"},
        {"fmt": "QS", "bref": "85634238", "pst": "u"},
        {"fmt": "QS", "bref": "85634239", "pst": "S"},
        {"fmt": "QS", "bref": "85634240", "pst": "ga"},
        {"fmt": "QR", "bref": "85634242", "concat": ["85634236", "85634238", "85634237"]},
        {"fmt": "QR", "bref": "85634243", "concat": ["85634239", "85634238", "85634240", "85634237"]},
        {"fmt": "PRO", "bref": "85634244", "p":"85634234", "l": "85634242"},
        {"fmt": "PRO", "bref": "85634245", "p":"85634235", "l": "85634243"},
        {"fmt": "QNH", "bref": "IATA_JFK", "alt": 1030},
        {"fmt": "REP", "bref": "67942267", "chunks": [
            {"type": "chunk", "base": "85634244", "count": "2"},
            {"type": "end"},
        ]}
    }
}

what the heck is this? It's some kind of memory dump of C structures expressed in JSON. You have no idea what this means unless you reverse-engineer it or you wrote it in the first place. What's a sid? What's a bref? Why is one of them not a number? What are these format codes? And pid and pst and p and l and alt?

I would say that to understand a format like this you have to understand the program that wrote it (or reverse-engineer the format). Presumably you would not reverse-engineer your own format but rather look at the code which writes this data in order to understand how to read it. In my interpretation of the FSF's opinion, they believe this constitutes "intimate communication exchanging complex internal data structures" and therefore makes the front-end a derivative work of the back-end.

Standard disclaimer: I am not a lawyer and this is not to be construed as legal advice.