On 29 October 2026 I gave a talk at JSMonthly London about copyright and licenses in the AI era. It's the successor to a talk I gave at meetups and conferences around 2016 to 2018, and the research for the new one produced a lot more than fits in 40 minutes. This is where the rest went.

Same disclaimer as the talk: I am not a lawyer, and this is not legal advice. I checked everything here against primary sources in October 2026 where I could, and I say so where I couldn't. Some of it will be out of date by Christmas.

Public domain depends on where you're standing

In February 2018 a court in Frankfurt ordered Project Gutenberg to stop serving 18 books by Thomas Mann, Heinrich Mann and Alfred Döblin to Germany. The publisher, S. Fischer, had sued. The court said it was enough to make them "no longer accessible to German Internet (IP) addresses". Project Gutenberg's answer was to block the whole site for the whole country, from 28 February 2018 until a settlement in October 2021. Only the three authors' books stay blocked, "until their German copyright expires".

How can a book be public domain in one country and not in another? The US counts copyright on older works from publication. In 2018 anything published before 1923 was free, no matter when the author died. Germany counts from the author's death: life plus 70. Thomas Mann died in 1955, so Buddenbrooks (1901) had been public domain in the US for decades and was still protected in Germany until the end of 2025. Cornell has a good chart of the US rules, and they are not simple.

The 1923 cutoff is the Mickey Mouse Protection Act at work. The 1998 extension froze the US public domain for 20 years: nothing new came out of copyright between 1999 and 2018.

For code written at work, the US gives the company 95 years from publication. In most of Europe the programmer stays the author even though the company owns the rights, so the clock is the programmer's life plus 70. MS-DOS came out in 1981, so in the US it goes public domain in 2077. Microsoft did publish the source of versions 1.25 and 2.0, first through the Computer History Museum in 2014 under a non-commercial license, then on GitHub under MIT in 2018. Version 4.0 followed in 2024. That's licensed, not public domain.

No software has gone public domain by the clock running out yet. What is public domain got there another way: published without a copyright notice back when the US required one, written by the US federal government, or given away on purpose, like SQLite.

Moral rights, the long version

In the talk I said the US only has moral rights for visual art. That's the federal statute, VARA, and its definition of a "work of visual art" excludes works made for hire and anything published electronically. So no code.

When the US joined the Berne Convention in 1989, it said its existing laws were enough: contracts, trademark law, state laws. The Copyright Office looked at it again in 2019 and wrote a whole report about this patchwork. The closest thing to a moral right for code is DMCA section 1202, which makes it illegal to strip author names and license notices. That was the claim in the Copilot case, and in September 2026 the Ninth Circuit rejected it because Copilot writes new code rather than removing anything from a copy.

Putting something in the public domain is harder than it sounds, and in Germany it's not really moral rights that stop you. German law says copyright can't be transferred at all, only licensed. It does give you a way out, sometimes called the Linux clause: "Der Urheber kann aber unentgeltlich ein einfaches Nutzungsrecht für jedermann einräumen" (§32). You can give everyone a free license, but you can't make the work public domain.

That's why CC0 is built in layers. First it waives everything it can, moral rights included. If a court says the waiver doesn't work, a fallback license kicks in: "royalty-free, non transferable, non sublicensable, non exclusive, irrevocable and unconditional". Whatever can't be waived simply stays with you.

Dying doesn't help either. The copyright passes to your heirs, and an irrevocable license you gave binds them, but they can't finish the job for you. When the copyright finally expires, the economic rights are gone everywhere. In France the moral rights never expire. Victor Hugo's descendant took the publisher of two Les Misérables sequels all the way to the Cour de cassation, which ruled in 2007 that a sequel isn't automatically a violation but sent the case back to check whether Hugo's work had been distorted. (There's a summary. I haven't read the judgment itself.)

Author and owner are different things

In Europe, if you write code as an employee, your employer automatically gets all the economic rights. That's the Software Directive, Article 2(3), and in Germany §69b. The company can sell the code, license it or relicense it without asking you. You're still the author, which matters for two things: when the copyright ends, and moral rights. For code written by several people, German law says copyright ends 70 years after the last co-author dies. Nobody can work that date out for a real codebase, but nobody needs to either.

The rule covers employees only. Freelancers are where it gets interesting. In Germany you can't buy copyright, only usage rights, and §31(5) reads vague contracts narrowly: you get the uses the contract's purpose needed. "Build us a website" might not include "sell the code as part of a product". The US has the same problem from the other side: software isn't one of the categories where commissioned work counts as work made for hire, so contractor code needs a written assignment. That's one of the first things a buyer's lawyers ask about.

Relicensing means asking everyone

In 2011 VideoLAN moved the VLC engine from the GPL to the LGPL, partly so it could go back on the iOS App Store. VideoLAN doesn't require copyright assignment, so every contributor still owned their patches and every one of them had to agree. Jean-Baptiste Kempf wrote up how he did it: about 230 agreements, plus sign-off from companies that had employed contributors, the BBC among them. The press release has my favourite line on the subject: "All the developers have agreed to the relicensing, but a famous one, who refused to answer. His code was therefore rewritten."

OpenSSL did the same in 2017, moving to Apache 2.0. It emailed every contributor and built a site to track them down. Saying that no reply would count as a yes did not go down well.

This is also why the Linux kernel will stay on GPLv2. There's no CLA and there are thousands of owners, some of them dead.

The GPL and JavaScript slides I cut

I had a few more slides on JavaScript-specific gotchas. They didn't make it, so here they are.

Your minifier deletes the MIT notice. MIT has one condition: keep the notice "in all copies or substantial portions". Terser, esbuild and Rolldown only keep comments that start with /*! or contain @license or @preserve. A plain /* Copyright ... */ header goes. Most packages keep their notice in a LICENSE file anyway, and no bundler copies that into dist/. Plugins like rollup-plugin-license and license-webpack-plugin collect them for you.

The "open source licenses" screen doesn't see npm. Google's Android oss-licenses plugin reads licenses "as declared in their POM files". CocoaPods does the same for iOS. In a React Native or Capacitor app, the npm packages in your JS bundle are invisible to both. Your web app has no such screen at all unless you build one. (Chrome has chrome://credits, which is a nice model: it's keyed on what ships, not on what's in the repo.)

Apache has a file you have to carry. If a dependency ships a NOTICE file, Apache 2.0 §4(d) says its contents travel with your build. No bundler does that. Apache 2.0 also mixes with GPLv3 but not with GPLv2, which matters if both end up in one bundle.

Fonts and icons have licenses too. The OFL FAQ says serving a web font with @font-face "is distribution", and that subsetting it is modification, which can trip the Reserved Font Name rule. Font Awesome Free uses three licenses for one package: CC BY 4.0 for the SVG and JS icons, OFL for the fonts and MIT for the code. Its attribution lives in comments, which your minifier strips.

The license belongs to the version, not the package. React went from BSD plus patents to MIT in 2017. Others went the other way: Handsontable from MIT to proprietary in 7.0.0 (2019), Kibana from Apache to SSPL and the Elastic License (2021), Grafana from Apache to AGPL (2021), n8n to its own Sustainable Use License (2022). Pin your versions and check licenses in CI.

One letter. In package.json, "UNLICENSED" means all rights reserved. "Unlicense" is a public domain dedication. And until npm 12, released in July 2026, npm init wrote "ISC" on everything by default. The commit that removed it says: "If not set, the license field will be omitted from new packages." A lot of packages are ISC because nobody changed the default.

devDependencies don't decide what ships. The bundler follows imports, not package.json. A UI library in devDependencies still ends up in the bundle. Generate your license list from the build output.

Minified isn't source. The GPL defines source as "the preferred form of the work for making modifications". The FSF calls minified JavaScript "a bogus, useless substitute for source code", and the Software Freedom Law Center's 2014 compliance guide puts "minimized" code in the non-source column too. I couldn't find anyone authoritative saying a source map counts. The FSF's own answer is web labels, a page that links each minified script to its license and its real source. The FSF runs one itself.

One small thing I tested myself: if you mark GPL code with LibreJS's // @license and // @license-end comments, esbuild --bundle --minify moves both comments to the end of the file. They no longer wrap the code. --legal-comments=inline fixes it.

App stores and the GPL. In 2010 the FSF complained that App Store terms conflict with GPLv2, and Apple removed GNU Go (the GNU project's program for playing the board game Go) rather than change them. In January 2011 VLC for iOS was pulled after a complaint from one of VLC's own developers. That's the background to the relicensing above.

If you register something with the US Copyright Office, you now have to disclaim AI-generated material that's more than trivial. The Zarya of the Dawn comic is the example everyone cites: the author got copyright for the text and the arrangement, not for the Midjourney images.

The Copyright Office report on training is still a "pre-publication version", 17 months on. The head of the Copyright Office was removed the day after it came out, and she's still in court about it. In September 2026 the US Department of Justice took a side for the first time, arguing that training is fair use.

The UK protects "computer-generated works" for 50 years from when they were made, not life plus 70. The government said in March 2026 that it wants to remove that protection. It hasn't yet.

China went the other way. In 2023 the Beijing Internet Court reportedly gave copyright to a Stable Diffusion image, to the user who picked and refined the prompts. A later decision said you have to be able to prove that creative work.

The robots.txt story has a German case behind it. A photographer, Robert Kneschke, sued LAION over its training dataset. The Hamburg courts said building the dataset was covered by the text and data mining exception, and that his opt-out, written in plain words in a website's terms, wasn't "machine-readable" (summary).

The EU's code of practice for model providers commits signatories to obey robots.txt, not get around paywalls, and handle complaints. Amazon, Anthropic, Google, IBM, Microsoft, Mistral and OpenAI signed it. Meta didn't.

On whether the GPL reaches the weights, the OSI's Open Source AI Definition doesn't require releasing the training data, which the FSF criticised. The Software Freedom Conservancy's position is "FOSS in, FOSS out, and FOSS throughout", and its 2026 recommendations are worth reading if you maintain anything.

How often do models copy?

GitHub's 2021 study is more interesting than the headline number. About 300 employees, Python only, 453,780 suggestions. After filtering and checking by hand, 41 genuine copies. None of them appeared in fewer than 10 files in the training data, and 35 appeared in more than 100. The author says the rate is probably a lower bound.

When researchers go looking on purpose, the numbers look different. Yang et al. pulled over 40,000 memorized snippets out of 20,000 outputs from a code model. Al-Kaswan et al. extracted 47% of the samples they targeted from a 16 billion parameter model. And Carlini et al. found memorization grows with model size, with how often something appears in the data, and with prompt length.

Open source projects and AI

The Linux kernel added an Assisted-by: tag in early 2026 and dropped it in October. Only 1,884 of 18,533 commits in 7.3 carried it, about 10%, while actual use was far more widespread. Tool use now goes in the cover letter. The rule that an agent never signs off stays.

curl ended its bug bounty in January 2026 because of AI-generated reports. Debian voted in August to neither endorse nor ban AI tools. GCC declines significant LLM-generated contributions, and says "An LLM may not commit code".

In JavaScript, TypeScript's CONTRIBUTING.md refuses "bulk, agent-driven contributions" and includes instructions addressed directly to coding agents. Deno rejects PRs where it suspects undisclosed AI use. And Node.js's guidelines suggest leaving brand names out of commit messages ("a closed-source coding agent"), and ban using AI to fix issues marked "good first issue". The 22,000 line pull request that started it is #61478.

Stack Overflow, continued

The license changes didn't stop with the MIT plan. In 2018 Stack Overflow quietly moved from CC BY-SA 3.0 to 4.0, and in 2019 it announced the change applied to everything ever posted. In 2020 it walked that back. Today it depends on the date: before April 2011 it's 2.5, until May 2018 it's 3.0, after that 4.0.

The data dumps used to go to the Internet Archive. In 2024 they moved behind a login, with a checkbox saying you won't use them to train an LLM, "an attempt to put commercial pressure on LLM manufacturers" (announcement). Users argued that conflicts with CC BY-SA. The full dump came back in October 2026.

The company side

The "Who's going to check?" section had a lot more behind it.

SOC 2 won't find GPL in your code. The AICPA's own criteria say practitioners "generally do not use the trust services criteria" to report on compliance with laws or contracts. It does care that your source code went to an AI service nobody vetted.

The standard for license compliance is ISO/IEC 5230, from OpenChain. You certify yourself. Its sibling, ISO/IEC 18974, covers vulnerabilities, not licenses.

The Black Duck report has more numbers than I used: conflicts per codebase have a median of 8 and a maximum of 2,675, 8% of components had no license at all, and 17% came in outside package managers, which covers copy-paste, vendor drops and AI. The whole thing is a free PDF. It's a vendor sample, so keep that in mind. The only quotable deal delay I found is old: a 2016 interview mentions a 12 week delay on one deal, with no names.

The investor paperwork is the NVCA model stock purchase agreement. The AI clause says the company hasn't put trade secrets into AI tools, "except in cases where such Generative AI Tools do not use such information ... to train". That carve-out is the consumer and business seat split, written into a contract.

If you ship software into the EU, the Cyber Resilience Act's reporting duties started in September 2026, and the SBOM requirement arrives in December 2027. An SBOM lists your dependencies, not the 40 lines an assistant pasted in. The US went the other way: in January 2026 a White House memo made SBOMs optional for federal agencies. CISA's 2026 minimum elements did add a license field, though.

Trade secrets. If an agent wrote most of your closed code, copyright may protect less of it, and what's left is trade secret. US law only treats something as a trade secret if the owner took "reasonable measures" to keep it secret, and UK and EU law say "reasonable steps". No court has said that pasting code into a tool that trains on it fails that test. I wouldn't want to be the first case.

Insurance. Trade press reports that optional generative AI exclusions became available for US general liability policies in January 2026 and are spreading. I couldn't read the forms themselves. Ask your broker.

"Nobody sees our code." Slack had private repos downloaded with stolen tokens in 2022. Twitter's source turned up on GitHub in 2023 (DMCA notice). A former Google engineer was convicted in January 2026 for taking confidential AI material with him. And Claude Code's DMCA notice initially hit 8,100 repositories before Anthropic narrowed it the next day.

GPL enforcement in court is still mostly about firmware. The Software Freedom Conservancy's case against Vizio over its TVs has been going since 2021, and the trial is listed for late 2026.

Anthropic's "Non-commercial use only" clause is in the UK and EEA consumer terms, not the US ones, as far as I could check. It sits in the liability section, so it's mostly there to stop Anthropic owing a business user anything. It's still a promise you make when you sign up.

Small things

The fast inverse square root isn't Carmack's. Beyond3D traced it in 2006 to Greg Walsh at Ardent Computer in the late 1980s, with Cleve Moler involved. Armin Ronacher's tweet with Copilot reproducing it is from 2 July 2021.

In the font case, the Copyright Office examiner had told Nicky Laatz that if the code "was merely generated by a font program and was not hand coded by a human author, it cannot be registered" (order). Matthew Butterick wrote about how it ended.

The Sun RPC story is on LWN: Sun's 2009 promise and Oracle's 2010 permission.

The GitHub numbers come from GitHub's search API, which only detects a LICENSE file in the root of the repo. A license that only lives in package.json counts as none. The 2015 comparison is Ben Balter's post on the GitHub blog.

Sources for the talk itself

If you spot something wrong, tell me. The law in this area changes every month, so something here is probably already out of date.