For most web developers, there is no practical difference between using GPL’d code (version 2) and code with a more permissive license such as Apache or BSD. For some reason, a lot of people don’t seem to get this. (One situation in which there is difference: if you’re distributing the actual code itself—if people download your code and run it on their own servers, for example—in this case you need to make the source code available. Another is where your code is “distributed” by being embedded on a hardware device, such as a phone.)
If the code runs on your servers only, you do not need to publicly release your changes. If you’ve written the code for a customer, you need to give them the source code, but there’s no legal obligation for the customer to make the code publicly available to anyone else. (As an example, Google has written a lot of patches to MySQL and Linux, which have been deployed onto their machines. They haven’t had to make any of these patches publicly available—although at least in the case of MySQL, they’ve subsequently made some of these changes public.)
This is more or less a loophole in the GPL—it was written at a time when interactions with software were mostly conducted with software running on your own machine, and the loophole is the reason the AGPL exists. The AGPL has the properties many people seem to think the GPL has: in the case of AGPL-licensed code, if you make modifications and run the modified code on your server, you do need to make the modifications public. (MongoDB is perhaps the most prominent example of software licensed in this way; they have a helpful licensing page describing the circumstances under which you do and don’t have to release any changes you might make.)
A few useful entries from the FSF’s GPL 2 FAQ:
- A company is running a modified version of a GPL’ed program on a web site. Does the GPL say they must release their modified sources? – No
- Does the GPL allow me to develop a modified version under a nondisclosure agreement? – Yes
- What license should I use for CMS templates? – “Templates are minor enough that it is not worth using copyleft to protect them.” Also, calling GPL’d JavaScript code from HTML does not “infect” the HTML with the GPL, but you might want to add a comment making it clear that it does not.
(In reading the FAQ entries, note that “distribution” is not what you’re doing if you deploy software to web servers, or your customers’ web servers. Distribution is where customers get a copy of your software to run on their servers.)