RESOURCES · GUIDE

GPL vs LGPL vs AGPL: What Actually Differs

Three licenses, one family, very different consequences. The differences come down to two questions: what counts as a derivative work, and what counts as distribution.

The comparison

	GPL	LGPL	AGPL
Copyleft scope	Whole derivative work	The library itself; linking apps generally exempt	Whole derivative work
Triggered by	Distribution	Distribution	Distribution or network access
SaaS usage	No disclosure required (no distribution)	No disclosure required	Disclosure required — users over a network trigger obligations
Typical enterprise policy	Case-by-case review	Broadly allowed with linking rules	Often banned outright

Why AGPL gets banned

AGPL closes the "SaaS loophole": under GPL, running modified code as a service is not distribution, so source obligations never trigger. AGPL extends the trigger to network interaction — which is exactly why many cloud providers prohibit AGPL components in their stacks, and why several databases relicensed to AGPL or beyond to pressure cloud resellers.

The linking question

GPL's derivative-work boundary is where most disputes live: static linking is widely treated as creating a derivative; dynamic linking is contested territory; separate processes communicating at arm's length generally are not derivatives. LGPL exists precisely to make library linking safe. Exceptions matter too — GPL with the Classpath Exception behaves very differently from bare GPL.

Managing copyleft at scale

Three practices: detect at intake (snippet-level scanning catches copied GPL code that manifest scanning misses — see What is SCA?), map obligations per usage context (distribution vs SaaS vs internal), and keep evidence (NOTICE files, license texts, decision records). Copyleft enforcement is real — from European GPL cases to SFC v. Vizio in the US — and "nobody enforces open source" has aged badly.

FAQ

Can we use GPL code in internal tools?

Generally yes — GPL obligations trigger on distribution. Software used only internally, never conveyed to third parties, does not require source disclosure. Document the internal-only status.

Is dynamic linking to LGPL libraries safe for proprietary software?

That is LGPL's core purpose: dynamic linking generally does not extend copyleft to your application, provided users can replace the library. Static linking carries additional obligations.