I have a (somewhat hypothetical) question regarding GPL on embedded systems. I know there are quite a few of them already out there, but I didn't find some which apply to this situation.
First off: I know the internet is not a lawyer, the question is mostly out of curiosity about legal concepts. I don't want to find a loophole in GPL to exploit, in my particular case, all company-specific code on the devices is plaintext python anyway, so customers could just mount the SD card and change whatever they like. Also, the company will have professional legal advice, no matter what comes out of this discussion. The thought just arose while researching a bit on this topic.
Consider the following scenario: Customers pay a subscription fee to access a webservice where they can configure and query particular devices. For example, imagine the devices are monitoring air temperature + humidity at locations specified by the customer and send the data back to the server through, e.g., LTE network through an embedded router. The customers then can view the data on the webservice. The devices contain company code to communicate with the server, reading the sensors etc., which might be GPL.
As far as I understand, customers leasing devices containing GPL code still counts as "distribution" and hence one has to provide the GPL code. However, in this scenario, the devices do not become property of the customer: They do not lease / pay for the device, only for the service, the devices are not the main product, they are just means to facilitate the service. The devices are physically present at some location (e.g., customer's premises) and remain in property of the company. To make the example even more "extreme", lets say that customers do not install the devices themselves, they order an employee of the company to put the device at an appropriate place. So they do not ever have contact with the device nor is the device in any way connected to their network. They are physically present on the customers premise but nothing more.
Does GPL apply here? Does the situation change if the devices also provide some interaction with the local environment (display something, flip some switches via GPIO etc.)?
To summarize / generalize, my question boils down to "what exactly counts as distribution"? In my understanding, it should be about any variant of ownership / property, I cannot see how it could be (solely) tied to where the object that physically runs the code is, otherwise moving things would probably be extremely interesting.
Also, you could then probably exploit this by "renting" a server rack (or anything similar) at the customers location and putting whatever box inside of it + lock it from access. But then, how is this different from renting a server at a hosting company and putting GPL code on there, only offering the customer a web interface? GPL does, as far as I understand, not cover the product of such code, i.e. input / output. In other words: If I use GPL code on a webserver backend, I don't have to distribute the code IIRC, neither to the hosting company nor the customer, because I am not distributing the code, it does not leave the boundaries of what is mine (even though the server running it is rented). But then, if the customer does not rent the device, he simply allows me to place my property (the device) on his premises (and possibly allows me access to the local infrastructure) I'm not really distributing, am I? If so, why? And how is it different from rented servers?
EDIT: This question seems somewhat related, however slightly differs in the sense that users interact with the "black box".
