Open is a word that survives contact with a procurement questionnaire badly. It gets applied to data usable for any purpose with no conditions, to data usable provided the source is credited, to data usable provided anything built from it is released under the same terms, and to data merely visible on a public website with no license at all. Only the first of those is unconditional.
Teams building on geographic data discover the difference late, and the sequence is consistent. A source gets added because it has the coverage the product needs. The terms page is skimmed, or opened once and never read again. The records land in a table that already holds three other sources. A year later a customer's counsel asks which licenses apply to the output, and whether any would oblige the customer to publish their own database. Nobody can answer.
What follows is about the obligations themselves, and none of it is legal advice.
Three families, and one thing that is not a license
Almost every open dataset a builder meets falls into one of three families, distinguished by what the license asks in return.
The first is public domain and dedications that behave like it. CC0 is the common instrument: no conditions on use, no restriction on what may be built. Some government output sits here by statute rather than by choice. This is the only family that mixes into anything without a downstream consequence.
The second is permissive with attribution: CC-BY, CDLA-Permissive, and many national equivalents saying the same thing in local legal language. Use it for anything, commercially and inside a closed product, provided the source is credited adequately. A permissive source costs a line of credit, not a constraint on your architecture or your business model.
The third is share-alike. The Open Database License governs OpenStreetMap and is the instrument most geospatial work meets; CC-BY-SA and CDLA-Sharing occupy similar ground with different scope. The bargain is reciprocity: use it freely, credit it, and if you distribute a database built from it, distribute that database under the same terms.
The thing that is not a license is a terms of service document. An API access agreement or a portal usage policy is a contract, not a grant: it can forbid bulk extraction, can be changed unilaterally, and binds whoever accepted it rather than traveling with the data. Non-commercial and no-derivatives conditions sit outside the open families too.
What share-alike actually triggers
Reciprocity does not fire on use. It fires on distribution, and only on the distribution of certain things. Getting this right means holding three categories apart.
A derived database is a database made from the licensed one. Filtering, correcting geometry, adding computed fields, joining against another table, deduplicating, reprojecting: all derivation, and a substantial extract is treated like the whole. Distributing one obliges you to offer it under the same license, which means publishing that database, not merely acknowledging it exists.
A produced work is something made using the database that is not itself a database: a rendered map image, a report, a chart, a score shown to a user. Share-alike licenses in this family treat these differently. Credit the source and state its license, but there is no obligation to release the produced work under that license. A tile served from OpenStreetMap data is a produced work. The database behind it, if you hand that over, is not.
A collective database is the third category and the one most often forgotten. Placing an independent database beside a licensed one without merging them is assembly, not derivation. Two tables in one warehouse, joined only at read time for display, are not automatically a single database. That lets a product hold share-alike data alongside proprietary data without drawing the proprietary side in, and it is easy to lose: once a nightly job persists the two together, the argument that they were merely collected gets harder to make.
One point deserves emphasis because it causes unnecessary fear. Share-alike data licensing does not reach your application code. It governs the database and what is made from it, not the service that queries it. A company can build an entirely closed product on share-alike geographic data. What it cannot do is distribute an improved version of that database while keeping the improvements private.
The mixing trap, and the metadata that prevents it
Nearly every serious licensing incident traces back to one operation, and it is not a decision anyone remembers making. It is a join.
Take a table of points assembled from an attribution-only national register and a share-alike community source. At ingestion each row knew its origin. The pipeline deduplicates, keeps whichever record has the better address, writes a unified table, and drops the source column because it was noisy and nothing read it. That table is now unrecoverable as a matter of provenance: some rows carry reciprocity obligations and some do not, and there is no way to say which. The only defensible position is that the whole table carries the strictest terms present in it.
Since obligations attach to individual records, license information has to live at that level: a source identifier, a license identifier, and the acquisition date, on the row rather than in a wiki. The date matters because terms change. That metadata then has to survive four places it is usually lost. Storage, where share-alike and permissive sources stay in separately identifiable tables. Joins, where the output row carries the union of its inputs' licenses. Caches, where a key ignoring license composition serves a share-alike result to a request meant to be clean. And API responses, where composition is stated so the recipient knows what obligations arrived with the payload.
The sources you meet, described structurally
Recognizing the shapes is more useful than memorizing a catalog, because terms change and lists go stale.
- Community-contributed vector data. Broad, current, uneven in coverage, typically share-alike. The largest source of open roads, buildings and points of interest.
- Civil space agency archives. Public earth observation imagery is generally free for commercial use, with no conditions or an attribution requirement. Derived layers such as elevation models usually inherit those terms, but not always.
- National statistical and cadastral agencies. Highly variable, and some publish files with no license statement at all, which is legally the worst case even though it feels like the most official one.
- Multi-source open distributions. The license belongs to the parts, not the distribution: where community-contributed content is included, its share-alike terms come with it.
- Public APIs and portals. Often no license, only terms of service. Permission to call an endpoint is not permission to store, redistribute, or build a product on the responses.
- Observed and aggregated feeds. Aircraft and vessel broadcasts, sensor networks, volunteer receivers. The signal may be unowned while the aggregated feed is not, and the compilation is what you take.
Three scenarios, worked
A property portal renders a map. Base map tiles come from share-alike vector data; the listings are the company's own. The tiles are produced works, so no reciprocity attaches and the listings database is untouched. The obligation is attribution on the map. If the portal precomputes a table joining each listing to nearby amenities from the same source and keeps it internal, nothing is triggered, because reciprocity fires on distribution. If it then sells or publishes that enriched table, the condition applies.
An analytics company sells an extracted dataset: share-alike building footprints with computed roof area and estimated height, delivered as a file. This is the clearest case of a derived database. Selling it is permitted, but the buyer receives it under share-alike terms and may republish it. These licenses do not prohibit selling; they make exclusivity impossible. A business model requiring the customer to be unable to redistribute has three options: rebuild from permissive inputs, negotiate separate terms with the rightsholder, or turn the file into a service returning produced works.
A risk API returns scores and geometry. The score is computed from hazard layers, exposure data and share-alike footprints; the geometry is the footprint itself. The score reads as a produced work. The geometry is a piece of the licensed database handed to a third party, and returning it on every query resembles distributing a substantial extract, however small each response is. The resolutions are to omit it, to source it from a permissive dataset, or to publish that layer under matching terms.
Auditing a pipeline you inherited
Most engineers meet this in the middle: an existing system, existing customers, no license metadata anywhere. The audit runs backwards from the exits.
Enumerate everything that leaves the building: endpoints, exports, downloads, tile sets, reports, embedded widgets, model artifacts. That set is the entire compliance surface, because nothing staying inside triggers a distribution obligation. For each exit, trace backwards to its inputs, then to theirs, until reaching the point where data entered from outside. Some paths will be untraceable; record those as unknowns rather than assuming they are safe.
Then classify each exit as a produced work, a derived database, or a substantial extract handed over verbatim. Most turn out to be produced works, which is why inherited pipelines are usually less exposed than the initial panic suggests. The exceptions are bulk exports, customer data drops, and any endpoint whose job is returning source geometry.
For each source, establish the terms as they stood at acquisition rather than as they stand now; where the date is unrecoverable, the conservative reading is the only defensible one. Then fix the exits in order of exposure and add the tracking that would have made the audit unnecessary.
Attribution that actually satisfies the term
Attribution-carrying licenses usually ask for credit reasonable to the medium and reasonably visible. Neither phrase is precise, but practice has converged.
Reasonable to the medium means the credit takes a form the medium supports. On a map, a corner notice. In an API response, a field. In a report, a line near the figure. In a downloadable file, a companion file that travels with the data.
Reasonably visible means a user who wants to know where the data came from can find out without reading source code, opening developer tools, or leaving the product. A credit one click from the map satisfies this. A credit only in a terms page linked from a footer generally does not, because nothing connects it to the thing being credited. Text sized to be unreadable is a bad-faith reading of the same rule.
The credit must also name the source and, for share-alike sources, identify the license, since a recipient cannot comply with terms nobody told them about. And attribution is per source, not per product: six attributable sources owe six credits.
Imagery terms are not data terms
Imagery is the most common way a careful product acquires a problem, because it arrives through a different door. Nobody treats a base map or a satellite scene as a dataset acquisition, so it never enters the source registry and its terms are never recorded. Tiles, satellite scenes, aerial photography and street level imagery each carry distinct terms, routinely different from those on vector data from the same organization. Commercial imagery often permits display inside a licensed viewer while prohibiting extraction or derived vector products.
The unsettled question sits exactly there: the status of a measurement derived from imagery you may look at but not copy. If a model reads a licensed image and outputs a building outline, a roof area, or a count of parked vehicles, is that a copy, a derived work, or an independent factual observation that used the image as an instrument. Facts are generally not protectable in themselves, which supports the last reading. But imagery terms are contractual as well as copyright-based, and a contract can prohibit extraction regardless of whether the extracted facts would have been protectable. A product whose value depends on the answer should get that answer in writing from the provider first.
Choosing a license when you publish
The same taxonomy applies in reverse, and the choice is strategic rather than ideological. A public domain dedication is the right default for reference data and identifiers, where the aim is adoption and there is nothing to protect. Permissive with attribution suits publishers who want adoption and visibility, which is where most civic bodies land. Share-alike suits datasets whose value comes from contribution, and suits badly any data meant as an input to commercial products.
Two constraints override preference. You cannot license out more than you hold, so a dataset built on share-alike input cannot be published permissively. And where a dataset mixes sources, either the strictest terms govern the whole thing or the parts are published separately under their own terms, which is usually better for everyone.
The checklist, and the mistake that ships
The recurring errors are few and predictable. Treating open as one thing. Reading a project's headline license and missing that individual layers differ. Assuming reciprocity fires on use rather than distribution, then over-restricting internal work. Assuming it never fires because the product is a service, when the service returns raw geometry. Confusing terms of service with a license. Dropping the source column in a cleanup. Recording which license applies but not when the data arrived. Attributing the product rather than the sources.
Before shipping anything that leaves the building, four questions are usually enough. What sources are in this output, individually rather than as a general list. Is the output a produced work, a derived database, or a substantial extract. Which obligations does that classification create, and has each been discharged in this specific channel. And can the first question be answered by a query rather than by asking a person.
The failure that actually gets shipped is not a deliberate violation. It is a join written on a Tuesday by an engineer who had no reason to think about licensing, merging a share-alike source into a clean table because the coverage was better and the schemas lined up. Nobody notices for a year, and by then the mixture is in the cache, the tile set, and three customer deliveries. The license question is not hard. The provenance question is, and it becomes unanswerable through ordinary, competent, unremarkable work.