GPL Contamination and Copyleft Risks: Conducting Software Audits in Indian M&A

In modern software development, up to 90% of a modern enterprise codebase consists of third-party open-source components. While open-source accelerates time to market, the failure of target companies to track software licensing creates acute transactional hazards during technology acquisitions.

Strong copyleft licences—notably the GNU General Public License (GPL v2 and v3)—stipulate that if proprietary code is statically linked to or derived from GPL-licensed software, the entire resulting codebase must be made available under the same open-source terms. In an acquisition context, this can destroy the proprietary exclusivity underpinning the transaction's valuation.

Buyers should insist on automated Software Bill of Materials (SBOM) code scans prior to closing and establish targeted escrow holdbacks allowing the target engineering team 60 to 90 days to refactor contaminated modules.