The Apache License 2.0, published by the Apache Software Foundation in 2004, is one of the most widely used permissive licenses in projects with a strong corporate presence. Like MIT or BSD, it allows code to be used, modified and redistributed even in proprietary products, but it is much longer and more precise. That length is not bureaucracy: it regulates aspects that short licenses leave vague, in particular patents and attribution.
What it allows
Anyone receiving code under Apache 2.0 may:
- use it for any purpose, including commercial ones;
- modify it and create derivative works;
- redistribute it in source or compiled form;
- include it in software under a different license, even a closed one.
There is no obligation to publish your changes. In this sense it remains fully permissive.
The patent grant
The feature that most distinguishes Apache 2.0 is section 3. Every contributor grants recipients of the software a license to their own patents, limited to the claims that their contribution necessarily infringes, alone or in combination with the work it was added to.
Why does this matter? With a license like MIT, copyright is granted explicitly, but the text says nothing about patents. A company could, in theory, contribute code to a project and then assert a patent against those who use it. With Apache 2.0, that possibility is ruled out for the patents involved in the contribution.
The termination clause
The same section contains a defence: if someone starts a lawsuit claiming that the software, or a contribution, infringes one of their patents, the patent licenses they received through that software terminate as of the date the lawsuit is filed. It is a deterrent: whoever attacks the project with patents loses the patent protection the project gave them.
Obligations when redistributing
Section 4 lists what to do when distributing the software or a derivative work:
- Provide a copy of the license to recipients.
- Flag changes: modified files must carry a prominent notice stating that they were changed.
- Keep the notices of copyright, patents, trademarks and attribution found in the source.
- Reproduce the contents of the NOTICE file, if the original project has one.
The NOTICE file
NOTICE is a text file containing the attributions the project asks you to carry forward. Distributors must include its contents in at least one of these places: a NOTICE file in the distribution, the documentation, or a screen displayed by the software, if the product has one for third-party notices. You may add your own attributions, but not remove existing ones.
A common mistake is copying the LICENSE file and forgetting NOTICE. Another is filling NOTICE with the full license text: that is unnecessary, as NOTICE contains only attribution notes.
Trademarks and warranty
Apache 2.0 makes clear that it grants no trademark rights. You can say your product includes a certain component, but you cannot use the project's name as if it were your own brand. Like all open source licenses, it disclaims warranties and liability, while allowing redistributors to offer additional warranties in their own name and at their own risk.
Compatibility with other licenses
| Combination | Possible? |
|---|---|
| Apache 2.0 code in an MIT project | yes, but the whole must also meet Apache obligations |
| Apache 2.0 code in a GPLv3 project | yes |
| Apache 2.0 code in a GPLv2-only project | no, because of the patent and termination clauses |
| MIT code in an Apache 2.0 project | yes, keeping the MIT notice |
The incompatibility with GPLv2 is recognised by the Free Software Foundation and is one of the reasons many projects adopted the "GPLv2 or later" wording.
Contributions and headers
An often overlooked detail is section 5: unless stated otherwise, any contribution intentionally submitted to the project is deemed to be licensed under the terms of the license itself. Many projects still pair it with a contributor agreement or commit sign-offs, to keep an explicit record.
The license appendix suggests a short header to place in every file. Today it can be replaced or supplemented with a standard identifier:
// SPDX-License-Identifier: Apache-2.0
A practical example
A startup integrates an Apache 2.0 HTTP client into a commercial app and changes its timeout handling. In the app's distribution it includes: the license text, the contents of the client's NOTICE file, and in the modified file it adds a comment such as "Modified by our company: configurable timeout handling". It does not have to publish its own code or the change. If one day it filed a patent suit claiming that client infringes one of its patents, it would lose the patent license received through the client.
In short
- Apache 2.0 is permissive: it allows commercial use and integration into closed software.
- It includes an explicit patent grant from contributors, terminated for anyone who files patent suits.
- Redistributors must include the license, flag changes and carry forward the NOTICE file.
- It grants no rights to the project's trademarks.
- It is compatible with GPLv3 but not with GPLv2 alone.
