In the sense of GPL, is a Web application running on a private server without exposing its code considered "released"? (or is the word "distributed"?)
Therefore, if a GPL component is used in a Web application running on a private server without exposing its code, does this make the copyright holder of the application obliged to release its source?
No.
From GPLv3’s Definitions section (bold emphasis mine):
To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
So this basic permission applies:
You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force.
Keep in mind that this doesn’t apply to parts of the Web app that run on the client side (e.g., JavaScript).
For AGPLv3 it would be a yes (if the software is modified), which is exactly why it was made. While it contains the same definition as quoted above from the GPLv3, its section 13 says:
Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version […]
In AGPLv3’s Preamble, it’s again stated that this is not the case for GPLv3:
The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
In the sense of GPL, is a Web application running on a private server without exposing its code considered "released"? (or is the word "distributed"?)
Forget for a second about the GPL and licenses entirely and let me focus on the parts of a typical web app: you will have a backend and a frontend.
The backend may connect to some database, do some heavy processing, business logic, etc. It may generate dynamically web pages.
The frontend is whatever ends up being downloaded in a user's web browser.
Let's assume also that you are running this server privately and exposing the web application on the public internet. The private server for private use is not interesting here as no external redistribution is taking place.
Now in this context, what software is being redistributed?
Obviously everything in the frontend is redistributed to the web browser of every users. The HTML and JavaScript code is physically transferred and copied to their browsers. So there is a transfer of a copy of some of the code.
The backend is in general not copied or transferred to your users, though there is a greyer area: if the frontend is generated by some backend code (say you generate JavaScript on the fly, or you generate some HTML pages or you minify some JS or transpile Coffeescript to JS, etc), then the corresponding source code of the frontend code that is redistributed may be in fact some of the backend source code.
Therefore, if a GPL component is used in a Web application running on a private server without exposing its code, does this make the copyright holder of the application obliged to release its source?
Based on the context I outlined above, things become much clearer:
In most cases, the frontend code is redistributed and the GPL applies.
In some cases -and this is a grey'ish area- some backend corresponding source code may be redistributable as the corresponding source code for the frontend.
