In today’s digital age, the question isn’t whether there is open source software being used in a company’s products, but how it is being used and what license governs its use. Open source is ubiquitous. Despite its widespread use over the past decade, the provisions of open source licenses have been interpreted by only a handful of U.S. and foreign courts. Open source-related disputes do not usually reach court as open source advocacy groups that enforce open source license provisions often work out a resolution between the parties without litigation.
However, one recent open source dispute has reached the courthouse. As discussed below, a new case filed in California state court could test the enforcement of one of the most common family of open source licenses, the GNU General Public Licenses or “GPL.” If the plaintiff is successful, the case could have the effect of expanding enforcement of GPL licenses under the rubric of consumer protection and allow a broad range of parties to bring claims under the GPL as third party beneficiaries of those licenses.
Last week, the Software Freedom Conservancy, Inc. (“SFC”) filed a complaint against smart-TV manufacturer Vizio, Inc. (“Vizio”) alleging a failure to comply with the GNU General Public License Version 2 (“GPLv2”) and GNU Lesser General Public License Version 2.1 (“LGPL v2.1”) (collectively, the “GPL Licenses”). SFC alleges that, over the last four years, Vizio distributed smart TVs that included executable versions of Vizio’s “SmartCast code. The SmartCast code, it alleged, contained modifications to the Linux kernel and other code obtained by Vizio pursuant to the GPL Licenses. SFC asserts that Vizio did not release the corresponding modified source code (as enhanced, modified or otherwise altered by Vizio) or accompany their smart TVs with a written offer to supply such code upon demand, as is required under the GPL Licenses. (Software Freedom Conservancy, Inc. v. Vizio, Inc., No. 30-2021-01226723 (Cal. Super. Orange Cty Filed Oct. 19, 2021)).
As has been the custom in the past, it appears that SFC attempted to resolve this matter without litigation. The complaint details a channel of communication between SFC and Vizio going back to August 2018, in which SFC notified Vizio of its alleged failures to abide by the terms of the GPL Licenses. Ultimately, it appears from the complaint that Vizio did not remedy the alleged deficiencies (at least to SFC’s satisfaction) and, as a result, SFC filed this suit.
The lawsuit is particularly interesting because SFC brings this breach of contract case under the rubric of consumer protection as a purchaser of various Vizio smart TVs and an intended third party beneficiary of the GPL Licenses. This theory, if adopted, could expand the class of potential plaintiffs in open source litigation, as, in this case, SFC does not position itself as a party to the GPL Licenses or allege that Vizio infringed any SFC copyright in code licensed under the GPL licenses.
The complaint does not seek monetary damages (other than attorney’s fees and costs), but seeks certain equitable relief compelling Vizio to produce the “complete source code” (as defined in the complaint) corresponding to versions of the SmartCast programs and libraries at issue that are resident in the referenced Vizio smart TVs. This would include any alterations to the source code obtained by Vizio through the GPL Licenses. The complaint also seeks declaratory relief and a determination that the terms of the GPLv2 and LGPLv2.1 require that “Vizio provide the source code for the executables of the SmartCast Programs at Issue, and the source or object code for any Library Linking Programs, or a written offer for same inside the boxes of their smart TVs” and that such GPL Licenses require Vizio to do the same for smart TVs manufactured in the future with functionalities based on code licensed under the GPL Licenses.
Depending on the outcome, and if the third-party beneficiary status in this case is upheld, the case could encourage lawsuits by recipients of software or smart devices that include open source software governed by the GPL or other less permissive open source licenses. Indeed, there is currently scrutiny of the data collection and accessibility features of newer digital products and applications, as well as a growing “right to repair” movement that might see open source litigation as a plus to programmers, consumers and those concerned about consumer privacy.
Thus, this lawsuit should prompt organizations to refocus on their open source compliance programs. It is a reminder of the importance of an effective but practical open source software policy that can identify and approve inbound licensing of open source code and offer internal controls with respect to the ongoing modification of open source software for proprietary commercial products.