Ready to give LWN a try?With a subscription to LWN, you can stay current with what is happening in the Linux and free-software community and take advantage of subscriber-only site features. We are pleased to offer you a free trial subscription, no credit card required, so that you can see for yourself. Please, join us!
The Software Freedom Conservancy (SFC) is suing VIZIO over smart TVs that include software licensed under the GPL and LGPL (including the Linux kernel, FFmpeg, systemd, and others). VIZIO didn't provide the source code along with the device, and on request they only provided some of it. Unlike a typical lawsuit about enforcing the GPL, the SFC isn't suing as a copyright holder; it's suing as a normal owner of the TV in question. This approach opens some important legal questions, and after years of pre-trial maneuvering (most recently resulting in a ruling related to signing keys that is the subject of a separate article), we might finally obtain some answers when the case goes to trial on January 12. As things stand, it seems likely that the judge in the case will rule that that the GPL-enforcement lawsuits can be a matter of contract law, not just copyright law, which would be a major change to how GPL enforcement works.
The primary question at the heart of the case is: who has the right to enforce the GPL? There are plenty of things that are illegal, but that nobody can (or cares to) enforce — for example, in my home state of New Hampshire, it is illegal for a restaurant to serve sugar in a container with holes wider than 3/8ths of an inch, but I would be incredibly surprised if the police actually charged someone under that law.
Enforcement is the mechanism that binds the words written in the law (which are, after all, just ink on paper) to the actions that people actually take in the real world. The difference between criminal law and civil law lies in who is supposed to point out violations and do something about them. In the case of criminal law, it is generally up to the government to choose which violations of law warrant taking action. In the case of civil law, it's mostly up to everyone else — although there are exceptions to this general trend in both directions.
In the US, anyone can sue anyone for anything — for a loose definition of "can". Anyone is allowed to file a lawsuit against anyone else, but in order for the lawsuit to actually be adjudicated by the court, the person suing must have "standing to sue". Exactly who does and does not have standing can be complicated, but generally a person must show that they were actually harmed by someone else's action, and that there was some law or agreement in place that was violated. In the typical GPL-enforcement case, this involves having the copyright holder show that someone broke the terms of the GPL, and argue that they were harmed thereby because now someone is distributing their copyrighted code without a license.
Whether anyone other than the copyright holder has standing to sue under the GPL has been a matter of debate for years. The problem is that if the GPL is only a copyright license and nothing more, then the only person harmed by violating the license is the copyright holder. On the other hand, if the GPL is enforceable under contract law, other people who benefit from the GPL potentially have standing to sue for breach of contract.
VIZIO makes and sells TVs that include copies of the
Linux kernel (two different versions of the kernel, actually, with one running
as a guest of the other) and other software which is covered under the terms of
version 2 of the GPL or the LGPL. The lawsuit lists 25 different pieces of
open-source software.
When the SFC bought a TV from VIZIO, they asked for "the complete and corresponding
source code
" of the version of all of this software on the TV, which the GPL says must be
included with the product or
provided upon request. VIZIO provided some code, but it was not complete and did
not compile, ultimately leading to SFC filing a lawsuit against the company.
Unlike a typical GPL-enforcement lawsuit (which the SFC has tried previously), however, this one is not a copyright-infringement case. This lawsuit is new and unique in the US because the SFC isn't suing on behalf of a copyright holder; it's suing as a recipient of the software. Its argument is that the GPL is intended to benefit users (specifically, by ensuring that they can obtain the source code for programs that they buy), so the SFC is a "third-party beneficiary" of the GPL: it isn't the original author, and it didn't adapt the kernel, but it was still intended to benefit, so it is harmed by VIZIO not complying with the GPL's requirements. (Technically, the SFC does hold some relevant copyrights, but in this case it chose not to assert them, so they don't matter to the case.)
155. Permitting Plaintiff to bring this cause of action is consistent with the objectives of the GPLv2 and LGPLv2.1 and the reasonable expectations of VIZIO and the developers of the SmartCast Works at Issue.
156. Therefore, Plaintiff is an intended third-party beneficiary of the GPLv2 and LGPLv2.1 between VIZIO and the developers of the SmartCast Works at Issue and, because of this, may seek to enforce the Source Code Provision against VIZIO.
The main benefit of the lawsuit is that if the SFC wins, VIZIO will be required
to share the code for its modified kernels, systemd daemon, GNU C library, etc.
But an important secondary
benefit is establishing the precedent that owners of products including
GPL-licensed code are third-party beneficiaries
to the GPL, and have standing to sue when companies don't comply with the
license. The US uses a
common law system, inherited from the UK England. Under that
system, judges are required to take prior rulings on related cases into account
when making a judgment. Once the SFC v. VIZIO lawsuit concludes (and at least
one appeal has been made), other
GPL-enforcement lawsuits will be able to point to it as evidence one way or the
other about whether people have standing to sue.
This is important because the authors of GPL software are not always available — or willing — to kick off a lawsuit to enforce the terms of the license. Any of the many contributors to the kernel could theoretically have sued VIZIO (and might have had a better chance of winning), but lawsuits are time-consuming and expensive, and nobody did sue VIZIO over this until the SFC did. If owners of products are allowed to file GPL-enforcement lawsuits, it becomes much easier to hold people who adapt GPL-licensed code accountable.
The case so far
The most visible part of a lawsuit is the trial, but there's a lot that goes on behind the scenes before a trial is possible. The whole process started with the SFC explicitly asking VIZIO for the source code in August 2018. In January 2019, VIZIO responded with what it claimed was the complete source code for the GPL-licensed software included in its smart TVs. The code included in the response, however, did not even compile.
The GPL requires anyone who modifies GPL-licensed programs to provide recipients of the software with the complete source code, which it defines like this:
For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
Since the provided code did not compile, it was definitely not the complete source code. The SFC wrote to VIZIO explaining that it was missing part of the complete source code; VIZIO responded with an amended version. This repeated six times throughout 2019, but never resulted in a set of source code that the SFC was happy with. Throughout this time period, the SFC continued buying and checking new VIZIO products for compliance, eventually finding one which contained an offer to provide the source code buried deep in a submenu. (This had previously gone undetected by the SFC because the offer only appeared when the TV was connected to the internet.)
Finally, in 2021, the SFC filed a lawsuit against VIZIO, asking the court to order VIZIO to produce the missing files. (Later in the process, the SFC amended that complaint to be more specific about what the problem with VIZIO's provided code was.) Specifically, the SFC asked for:
a. An order directing Defendants to produce to Plaintiff the complete source code corresponding to whatever versions of the SmartCast Works at Issue, and any other program subject to the GPLv2 or LGPLv2.1 that are resident on VIZIO smart TVs having model numbers V435-J01, D32h-J09, and M50Q7-J01, including the Linux kernel used with VIZIO's SmartCast operating system, in a format that may be compiled and installed without undue difficulty. For purposes of this prayer for relief, "complete source code" means all source code for all modules contained in such version or versions of the SmartCast Works at Issue, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.
b. An order directing Defendants to produce to Plaintiff the complete source code or object code for any program resident on VIZIO smart TVs having model numbers V435-J01, D32h-J09, or M50Q7-J01 that links with any of the SmartCast Libraries at Issue, or any other library subject to the LGPLv2.1, so that the Plaintiff can modify the library and then relink to produce a modified executable;
VIZIO replied by filing
a motion to move the lawsuit from California's state
court (where the SFC originally filed the lawsuit) to federal court, on the grounds
that this was fundamentally a copyright dispute, which is a matter of federal
law. Its argument was that the SFC's "claims are completely preempted by
the laws of the United States, specifically, the federal Copyright Act
".
The act in question
(17 U.S.C. §
106) pertains specifically to the rights of copyright holders — which means
that if the case had been transferred to federal court, VIZIO could have claimed
that the SFC, which is not a copyright holder, did not have standing to sue. The
SFC said that the case wasn't eligible to go to the federal court because the
GPL introduced an extra contractual obligation to provide source code, and that
this contractual obligation goes beyond what federal copyright law requires.
US district court judge Josephine Staton
did not agree with VIZIO, and returned the matter firmly to
California's state court.
In the US legal system, trials have two purposes: finding out the facts of what happened, and determining whether what happened broke the law or breached a contract. In cases where the first part is unnecessary (either because the people involved in the lawsuit agree on what happened, or where one side's argument is so clearly invalid that the specific details don't matter), the participants can ask the court for "summary adjudication", where the judge in the case decides the outcome of some or all of the arguments made so far without a trial, based only on what the law says. In 2023, VIZIO asked the state court to perform a summary adjudication in this case, on the grounds that this should be a copyright-infringement question (which the SFC can't sue over, not being a copyright holder), and that even if it weren't a copyright matter, the SFC still couldn't sue because it isn't an intended third-party beneficiary.
The judge in the case, Sandy Leal, wasn't convinced by VIZIO's argument, and denied its motion for summary adjudication. In that ruling, she determined that the matter was not purely a copyright issue, and the SFC could in principle have standing to sue. On the other hand, she did not address whether the SFC was a third-party beneficiary of the GPL, leaving that to be argued about during the trial.
In 2024, the SFC asked for summary adjudication the other way, hoping that the judge would agree that it definitely was a third-party beneficiary. Leal wasn't convinced of that either. With the lawsuit not obviously favoring one side or the other, the rest of 2024 saw both sides attempting to gather evidence and attempt mediation before going to trial. In 2025, the SFC asked for summary adjudication a second time for a slightly different set of reasons:
(1) The undisputed facts establish that VIZIO made an offer to provide the applicable source code subject to the GPLv2 and the LPGLv2.1 in connection with VIZIO's sale of its Smart TV Model No. D32h-J09 to SFC, which offer was accepted by SFC. Therefore, under general principles of contract law, VIZIO has a contractual duty to provide that source code to SFC; and (2) The plain language of the GPLv2 and the LGPLv2.1 compels the conclusion that purchasers of VIZIO Smart TVs such as SFC are third-party beneficiaries of the provision of the GPLv2 that entitles such purchasers to receive the source code for: (a) any software on VIZIO's Smart TVs that is licensed under the GPLv2; and (2) any library on VIZIO's SMART TVs that is licensed under the LGPLv2.l. Therefore, under the GPLv2 and the LGPLv2.1, VIZIO has a contractual duty to provide purchasers of VIZIO Smart TVs with that source code.
So, the SFC was arguing two separate things: that VIZIO had promised them the source code and had to follow through; and that even if VIZIO had not promised the source code, people who buy the TVs in question are still third-party beneficiaries, and therefore have standing to sue anyway. This attempt at summary adjudication has not yet resulted in a ruling, with VIZIO and the SFC going back and forth without garnering a response from the judge.
VIZIO then filed its own second attempt at summary adjudication, arguing that the SFC was asking for VIZIO to enable installing modified programs on the TVs without breaking anything, which the GPL doesn't require:
VIZIO moves on the grounds that the plain language of GPLv2 and LGPLv2.1 or, in the alternative, the undisputed extrinsic evidence, compels the conclusion that neither license imposes a duty on licensees to provide all information necessary to permit reinstallation of modified software back on the same device such that the device continues to function properly [Emphasis added].
In its first attempt at summary adjudication, VIZIO argued that this was a copyright problem, not a contract problem. In this second attempt, VIZIO argues that even if there is a contract, the contract doesn't actually require them to produce "working" source code — that the source code they provide can be considered complete even if it cannot actually be successfully installed onto the same device.
The SFC denied asking for that, saying that it only wanted access to the source code of the scripts to control installation, not a guarantee that those scripts would actually result in a working TV. That wasn't obvious to everyone, though, with many people feeling that the SFC had overreached; a companion LWN article explores this topic in more depth. The judge agreed with VIZIO that the GPL definitely doesn't require the company to ensure that recompiling and reinstalling the GPL-licensed software must result in a working TV — but, since the SFC had other demands that were covered by the GPL, the matter would have to proceed to trial.
On December 4, Judge Leal did
issue a set of tentative rulings on her upcoming cases, including SFC v.
VIZIO. (That link goes to an excerpted PDF containing only the pages relevant to
SFC v. VIZIO.) Tentative rulings are not binding — the judge is free to change her mind
later — but they represent her current understanding and disposition going into
the trial. The tentative ruling considered several points, and deferred most of
them to the trial, but the judge did come down on one explicit facet of the
case: VIZIO does have a contractual duty to provide SFC with the complete source
code, as the GPL defines it, for the GPL-licensed programs on one particular kind of smart
TV. The smart TV includes an offer to "provide
applicable source code upon request for a processing fee covering the cost of
fulfilling the distribution
" buried in one of its menus. VIZIO made this
offer, and the SFC accepted it, so the SFC has shown that there really is a
contract to have a lawsuit over.
Judges often rule narrowly on individual parts of a case, to avoid being caught in unfortunate corner cases. So, her tentative ruling doesn't cover what would happen if a company didn't provide a source offer; such a company might be able to argue that if there is no offer to share the source code (which the GPL requires), then they may have broken the license, but not created a contract that can be violated. Since VIZIO isn't making that argument, however, whether it would stand up in court will be a matter for a different lawsuit. Judge Leal's tentative rulings didn't address whether recipients of modified GPL-licensed programs are third-party beneficiaries of the GPL in general, even before accepting a source offer.
Where things stand
Currently, that trial is scheduled for January 12. After years of legal back-and-forth, this is when VIZIO and the SFC will finally present their actual arguments to the judge. There are a few questions that will need to be resolved during the trial. The judge has already ruled that this is not purely a copyright matter, but is the SFC a third-party beneficiary to the GPL itself? If so, did VIZIO break the contract by not providing the complete source code in the first place? What about after the SFC accepted an offer for the source code?
Judge Leal could rule either way on any of those questions. If she does rule that the SFC has standing to sue (as her judgment of VIZIO's motion for summary adjudication said could be the case in principle), and that VIZIO is in breach of contract (as her tentative ruling indicates), she could order VIZIO to provide the complete source code. On the other hand, she could also rule that the SFC has standing to sue, but that VIZIO's behavior did not violate the GPL. That would be a loss for the SFC, but it would still establish the precedent that owners of GPL-licensed software can have standing to sue (if the company makes a source offer, and possibly at all times, depending on how the trial goes).
Even once Leal renders her decision, the whole process is not necessarily over: no matter who wins, the case could be appealed. In fact, VIZIO already filed an appeal, but the court of appeals chose not to consider it. Even if there are no appeals, we could still see more cases like this coming up in different states. If the case isn't appealed, it doesn't become binding precedent (in this case, only the court of appeals can make binding precedents, and only in published opinions), but it can still be "persuasive precedent", which judges often look at when considering a case, but are not required to take into account. Even if the case were appealed and became binding precedent, that would still only apply in the state of California. As a practical matter, having Californian precedent that owners of products incorporating GPL-licensed code are third-party beneficiaries of the GPL does make it easier to argue to companies that they should avoid an expensive losing legal battle by complying up front — but companies in other jurisdictions could still try to fight such attempts.
Summary
Overall, the question to be decided in the upcoming trial is: in California (and weakly throughout the rest of the US), can people sue companies for not providing the complete source code of GPL-licensed software used in products they buy? If the company makes a source offer, the answer, based on Judge Leal's tentative ruling, is almost certainly yes. If that is confirmed during the trial, it will herald many new opportunities to attempt GPL enforcement against companies that are currently flouting the license.
Trials typically take several days or weeks in complex cases such as this. Keep an eye on LWN's news feed for the outcome when it does conclude.
[ I would like to thank SFC executive director Karen Sandler and other non-SFC advisors for reviewing this article for factual mistakes. ]
| Index entries for this article | |
|---|---|
| Kernel | Copyright issues |