I have a (somewhat hypothetical) question regarding GPL on embedded systems. I know there are quite a few of them already out there, but I didn't find some which apply to this situation.

First off: I know the internet is not a lawyer, the question is mostly out of curiosity about legal concepts. I don't want to find a loophole in GPL to exploit, in my particular case, all company-specific code on the devices is plaintext python anyway, so customers could just mount the SD card and change whatever they like. Also, the company will have professional legal advice, no matter what comes out of this discussion. The thought just arose while researching a bit on this topic.

Consider the following scenario: Customers pay a subscription fee to access a webservice where they can configure and query particular devices. For example, imagine the devices are monitoring air temperature + humidity at locations specified by the customer and send the data back to the server through, e.g., LTE network through an embedded router. The customers then can view the data on the webservice. The devices contain company code to communicate with the server, reading the sensors etc., which might be GPL.

As far as I understand, customers leasing devices containing GPL code still counts as "distribution" and hence one has to provide the GPL code. However, in this scenario, the devices do not become property of the customer: They do not lease / pay for the device, only for the service, the devices are not the main product, they are just means to facilitate the service. The devices are physically present at some location (e.g., customer's premises) and remain in property of the company. To make the example even more "extreme", lets say that customers do not install the devices themselves, they order an employee of the company to put the device at an appropriate place. So they do not ever have contact with the device nor is the device in any way connected to their network. They are physically present on the customers premise but nothing more.

Does GPL apply here? Does the situation change if the devices also provide some interaction with the local environment (display something, flip some switches via GPIO etc.)?

To summarize / generalize, my question boils down to "what exactly counts as distribution"? In my understanding, it should be about any variant of ownership / property, I cannot see how it could be (solely) tied to where the object that physically runs the code is, otherwise moving things would probably be extremely interesting.

Also, you could then probably exploit this by "renting" a server rack (or anything similar) at the customers location and putting whatever box inside of it + lock it from access. But then, how is this different from renting a server at a hosting company and putting GPL code on there, only offering the customer a web interface? GPL does, as far as I understand, not cover the product of such code, i.e. input / output. In other words: If I use GPL code on a webserver backend, I don't have to distribute the code IIRC, neither to the hosting company nor the customer, because I am not distributing the code, it does not leave the boundaries of what is mine (even though the server running it is rented). But then, if the customer does not rent the device, he simply allows me to place my property (the device) on his premises (and possibly allows me access to the local infrastructure) I'm not really distributing, am I? If so, why? And how is it different from rented servers?

EDIT: This question seems somewhat related, however slightly differs in the sense that users interact with the "black box".

  • 1
    You write "The devices [...] remain in possession of the company" and then "They are physically present on the customers premise". Those can't both be true: if the devices are on the customers' premises they are clearly not in possession of the company. Perhaps you mean they remain the property of the company? Could you clarify, as I think it's an important point?
    – MadHatter
    Commented Aug 7, 2021 at 14:24
  • I see. English is not my native language, so I'm unsure about the precise legal meanings (German has concepts but I am not sure how it translates, because colloqially both translations apply). I mean "remain property" (edited appropriately). They are not on the premises of the company anymore, they could basically be anywhere in the world. Feel free to assume that access to the device can be restricted, e.g. they could be put in locked strongboxes. Commented Aug 7, 2021 at 14:59
  • PS: Just to reiterate, this is mostly a thought experiment, if such details change things I'd be very curious to hear why & how :-) Commented Aug 7, 2021 at 15:07

1 Answer 1


The situation may depend on how the contract with your users is formulated. If your users "rent" space to you for placing the device, then in my view the situation would probably be seen as similar to renting server space to run your GPL application.

On the other hand, if you provide the devices to your customers as part of the service you provide, it would probably be seen in a similar light as an internet router that you get to use as part of the service delivered by your provider. For those devices, it has been established that it counts as distribution in the GPL sense.

If the final verdict is that your GPL software is being distributed, that means that you need to offer to give the source code, but you don't have to actively provide it to the customers that don't ask for it. And also, you don't need to keep supporting a device if the software got changed.

And if the customers are businesses, chances are that your customers have no interest in putting different software on the devices.

  • I see, thanks. I was aware of the "ISP gives you a router scenario". This is interesting. I guess the conclusion is that the term "distributing software" isn't fully defined legally and stuff like this is on the boundary. I could imagine that if the devices simply measure something and are completely closed off (customers only interact with the device through a central server), its not distributing, whereas if the devices would show something on a screen or similar (i.e. provide some "local" service, akin to routers) its distributing? Commented Aug 7, 2021 at 22:55
  • And indeed, you are right, practically it won't matter with extremely high probability in my actual case: The target profile of customers are small businesses which likely never even heard about "GPL" :-D (but that's not an excuse to ignore copyright) Commented Aug 7, 2021 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.