Benefits of a CLA when using Apache 2.0 License

Question

I understand that there are benefits to CLA for some licenses (as well as drawbacks and tradeoffs), however the Apache 2.0 License already has section 5 stating the following:

5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.

Assuming pull requests are accepted through public channels, what benefit does a CLA actually provide beyond what is provided for in this license clause? More to the point, what sort of legal issues or court cases could arise?

Many CLAs require a lot of personal information that is a burden on the contributor and the licensor (contributor may want to stay anonymous and licensor may not want to deal with PII storage requirements).

It seems like the project could be made up of unidentifiable users contributing code directly to the project and that the license would cover this. Why would the provenance of code ever need to be called into question or a CLA explicitly signed?

Why would the contributor or their estate ever be allowed to back down from clause five and if they did why would having previous record of their real identity be necessary? The contributor would need to appear in court as a real entity to bring their case. If they can't prove in court that they are the anonymous contributor, then they do not have a case to begin with and if they can prove that link then it should be reasonable for the licensor to prove that any contributor was or should have been aware of the contribution guidelines which already act as a passive CLA.

Furthermore, can an Apache 2.0 licensed project without CLAs change it's license in the future? It seems like clause five combined with the sub-licensing allowances in the license would make this legally allowable.

I understand that from a lawyer's perspective, the more legal body armor the better, but I can't think of an actual example in which the CLA as well as contributor PII collection would somehow end up being necessary in court (once again given Apache 2.0 clause five as well as public channels for pull request review). Do courts ever ask someone to provide a record of all copyright holding contributors?

Answer 1

First of all, you don't need a CLA. The general assumption when someone contributes to an open source project is that they accept to license their contribution under the license of the project. The clause you mentioned in Apache 2.0 just makes this explicit as explained here Does inbound=outbound apply to Apache 2.0 without a CLA?

Furthermore, can an Apache 2.0 licensed project without CLAs change it's license in the future? It seems like clause five combined with the sub-licensing allowances in the license would make this legally allowable.

Indeed, an Apache 2.0 licensed project without CLA can change its license to a compatible license in the future since this is allowed by the license.

However, such a project cannot be relicensed to e.g. GPL v2 which is not compatible. Depending on the terms, a CLA could allow this.

Finally, CTAs (Copyright Transfer Agreements) can be also useful to enforce copyright. At least this is what the FSF argues.

EDIT: @LarryGritz's answer made me think about something else that a CLA can be used for: getting a declaration from the contributor that they are the copyright owner of the code their produce or, if they reused existing open source code, that they checked the conditions for including / re-licensing it were met.

Answer 2

I am not a lawyer, but I am the manager of open source projects that are pretty strict about CLAs.

My $0.02 is that while there may not be much of a legal benefit as far as the PROJECT is concerned -- you could make a good argument that the act of submitting the PR is implicitly a statement that the author believes the code is unencumbered and they have the right to contribute it, enough to protect the project and its other members from liability -- that doesn't mean that there isn't a big benefit of having CLAs in place.

Especially in the case of a "corporate CLA," the signed CLA document may be an important protection for the contributor, with regard to their employer. Many employers have very broad IP assignments as part of their employment agreement, that can make it seem that even work done on an employee's own time and equipment belong to the employer. Many employees don't even realize the breadth of the agreements they quickly signed when they started their jobs. The employer signing a CLA will preclude possible later disputes about whether the employee was authorized to submit the work.

And maybe even an employee signing the individual CLA might be prompted to think more deeply about any contradictory agreements they may have signed (for example, with their employers), whereas merely submitting a PR in the excitement of sending a patch might not prompt them to as carefully think through whether they really have the rights necessary.