As a developer, certain app markets for Android (Amazon or some manufacturers) require to list all open source libraries used (name , author, license etc.) accessible offline. I've created a page "open source licences" in my apps.

However on some commercial apps, I don't see any open source licence listing. I find hard to believe developers haven't used any GitHub project (most libraries on github are on Apache 2.0; some may be GPL).
EDIT : Most apps have this page in Settings > open source. I talked to several developers of 500,000+ commercial apps, they weren't aware of publishing the libraries used.

What are the risks of prosecution for the author's app in the following cases?

  1. The app has never listed the open source libraries
  2. The listing was done, but is not up to date and new libraries were used in the meantime

The above is in relation to Android/iOS apps, but most websites are also built on top of open source libraries. As a followup question, why isn't there a page on most websites to list the 3rd party libraries it uses?

  • Welcome to Open Source SE Raymond. I've suggested an edit to your post to make it a bit clearer what you're asking. Although this isn't a full answer, most apps I've looked at have their OS libraries listed in the app settings - eg. see how the Facebook or Instagram apps do it. Are these exceptions to what you are referring to with #1?
    – Tim Malone
    Commented Jun 8, 2016 at 3:38
  • Almost all the big commercial apps I know list their OS libraries. They're simply too big to ignore legalities - too tempting a target for litigation. Most do it in some "about" page/dialog like Tim mentioned. Note that there are a lot of closed source or commercial Java libraries for Android - OS is not the only way to go. As for websites, the websites themselves are the users of the app (the web server) and users of the websites are merely account holders so they don't have to publish their libraries or code. GPLv3 changes that a bit
    – slebetman
    Commented Jun 8, 2016 at 5:58
  • Also in relation to websites, the code copyrights are often viewable in the source - eg. if you load the JS library from the source you'll see the copyrights there. @slebetman Re GPLv3 changing websites publishing libraries/code, did you mean to say the AGPL?
    – Tim Malone
    Commented Jun 8, 2016 at 6:14
  • @slebetman. I don't get "the websites themselves are the users of the app (the web server) and users of the websites are merely account holders" . Could you elaborate ? Tim, thanks for the edit. I don't think it is up to the hackers to look at the front end source code. There sould be a clear section. What about the bacnend code that relies heavily on 3rd party ? Commented Jun 8, 2016 at 6:17
  • 1
    The user of the web app is the web master and the website is him (or the company) running the website application. Users of the website are just account holders. It's like, MS Excel on your laptop is used by you even though you are an accountant and the primary use of Excel is to process the payroll of 500 employees. The 500 employees are not the users of that Excel (even though in the abstract they "use" it to get paid). GPLv3 changed the language when they noticed this to make making an HTTP request equivalent to linking the app so users are finally users of the software
    – slebetman
    Commented Jun 8, 2016 at 6:20

1 Answer 1


It depends on what software they are including and what the licenses are. Many OSI-approved open source licenses have NOTICE or license redistribution requirements that are the specific steps that redistributors have to follow.

The risks depend on if the organization redistributing the bundled software anywhere (not just the app store) is providing any notice at all, what the license is, and what the policies the original software creator - i.e. Apache, some GPL project, whatever - have about pursing legal action.

The FSF has a Licensing & Compliance team that actively works to ensure that people follow the GPL for their software packages, and they have sued non-compliant redistributors.

To get a better answer, we need to know what packages and licenses you're talking about.

  • Thanks for the answer. Usually the licenses are Apache 2.0. The packages were distributed by Google, Square inc Commented Jun 15, 2016 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.