Attribution
Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.
Overview
Attribution is a legal obligation that arises from many sources — open-source licenses, Creative Commons media, font licenses, API terms of service, data provider agreements, and more. Failing to provide required attribution can constitute license violation (risking license termination and copyright infringement claims), breach of contract, or regulatory non-compliance. Many companies underestimate attribution requirements because the obligation is spread across dozens of different asset types, each with its own rules.
Attribution by Asset Type
| Asset Type |
Common Licenses/Terms |
Attribution Required |
Where to Attribute |
| Open-source libraries |
MIT, Apache 2.0, BSD, GPL, LGPL, MPL |
Yes (nearly all OSS licenses) |
NOTICE file, about/legal screen, documentation |
| Fonts |
OFL (SIL Open Font License), proprietary EULA |
OFL: yes; Proprietary: per EULA |
Font credits page, CSS comments, documentation |
| Images / Icons |
Creative Commons, stock photo licenses, proprietary |
CC BY: yes; Stock: per license; Proprietary: per contract |
Image credits, about page, metadata |
| Audio / Video |
Creative Commons, royalty-free licenses, sync licenses |
CC BY: yes; Royalty-free: per license |
Credits section, end cards, metadata |
| Datasets |
CC BY, ODC-BY, government open data licenses |
CC BY/ODC-BY: yes; Some government: yes |
Data source citations, documentation |
| APIs |
Terms of service, developer agreements |
Many require "powered by" branding |
UI badge/logo, documentation, per ToS |
| Maps |
Google Maps Platform, Mapbox, OpenStreetMap |
Yes (all major providers) |
Map overlay attribution, per ToS |
| AI/ML models |
Model cards, Hugging Face licenses, proprietary |
Varies — many require model credit |
Documentation, about page, per license |
Open-Source Attribution
Open-source attribution is the most common and most frequently violated attribution requirement in software.
What Most OSS Licenses Require
| License |
Requirements |
NOTICE File |
License Text |
Copyright Notice |
| MIT |
Include copyright notice + license text in copies |
Recommended |
Required |
Required |
| Apache 2.0 |
Include NOTICE file + license text; state changes |
Required |
Required |
Required |
| BSD 2-Clause |
Include copyright notice + license text |
Recommended |
Required |
Required |
| BSD 3-Clause |
Same as 2-Clause + no endorsement clause |
Recommended |
Required |
Required |
| ISC |
Include copyright notice + license text |
Recommended |
Required |
Required |
| MPL 2.0 |
License text in source files; larger work can be proprietary |
Per-file |
Required (per file) |
Required |
| LGPL 2.1/3.0 |
License text + copyright + link to source for modifications |
Required |
Required |
Required |
| GPL 2.0/3.0 |
Full license + copyright + source offer for binaries |
Required |
Required |
Required |
| AGPL 3.0 |
Same as GPL + network interaction triggers |
Required |
Required |
Required |
NOTICE File Structure
The standard approach for bundling attribution in a distributable product:
NOTICE
This product includes software developed by third parties.
================================================================================
Library: react
Version: 18.2.0
License: MIT
Copyright (c) Meta Platforms, Inc. and affiliates.
================================================================================
================================================================================
Library: lodash
Version: 4.17.21
License: MIT
Copyright JS Foundation and other contributors
================================================================================
================================================================================
Library: express
Version: 4.18.2
License: MIT
Copyright (c) 2009-2014 TJ Holowaychuk
Copyright (c) 2013-2014 Roman Shtylman
Copyright (c) 2014-2015 Douglas Christopher Wilson
================================================================================
Automation Tools
| Tool |
Ecosystem |
Output |
| license-checker |
npm |
JSON/CSV/Markdown of all dependency licenses |
| license-report |
npm |
Detailed license report with texts |
| pip-licenses |
Python |
Tabular license output for pip packages |
| go-licenses |
Go |
License detection and NOTICE file generation |
| dotnet-project-licenses |
.NET |
NuGet package license report |
| FOSSA |
Multi-language |
Full compliance management platform |
| Snyk |
Multi-language |
License auditing as part of SCA |
| licenseFinder |
Multi-language (Ruby-based) |
Approve/deny license policies |
Where to Display OSS Attribution
| Distribution Method |
Where to Show Attribution |
| Web application (SaaS) |
"Legal" or "Open Source Licenses" page linked from footer |
| Desktop application |
About dialog → "Third-Party Licenses" section |
| Mobile app (iOS) |
Settings → Licenses (use Settings.bundle or acknowledgements plist) |
| Mobile app (Android) |
About → Open Source Licenses (use oss-licenses-plugin for Gradle) |
| CLI tool |
--licenses flag or THIRD-PARTY-NOTICES.txt bundled in distribution |
| Library / SDK |
NOTICE or THIRD-PARTY-NOTICES file in package root |
| Container image |
/licenses/ directory or NOTICE file in image root |
| Documentation |
Acknowledgements section in README or docs site |
Creative Commons Attribution
Creative Commons licenses are common for media, data, and documentation.
| License |
Attribution Required |
Share Alike |
Commercial Use |
| CC0 |
No |
No |
Yes |
| CC BY 4.0 |
Yes |
No |
Yes |
| CC BY-SA 4.0 |
Yes |
Yes (derivatives same license) |
Yes |
| CC BY-NC 4.0 |
Yes |
No |
No |
| CC BY-NC-SA 4.0 |
Yes |
Yes |
No |
| CC BY-ND 4.0 |
Yes |
No (no derivatives) |
Yes |
Proper CC BY Attribution (TASL)
Creative Commons specifies the TASL format:
- Title — name of the work
- Author — creator name (linked to profile if available)
- Source — URL where the work was found
- License — license name linked to the license deed
Example:
"Sunset Over Mountains" by Jane Smith (https://example.com/photo/123)
is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
Font Licensing
Fonts carry their own licensing terms that are frequently overlooked.
| License |
Attribution |
Embedding |
Modification |
| SIL Open Font License (OFL) |
Required (original name + copyright) |
Web/app/document embedding allowed |
Allowed (must rename modified version) |
| Apache 2.0 (some Google Fonts) |
Required (copyright + license) |
Allowed |
Allowed |
| Proprietary (Adobe, Monotype, etc.) |
Per EULA |
Per EULA (often limited seats/pageviews) |
Typically prohibited |
| Desktop-only licenses |
Per EULA |
Web embedding NOT allowed |
Per EULA |
Font Attribution Pitfalls
- Web fonts loaded via Google Fonts CDN do not require separate attribution (Google's ToS handles it), but self-hosted Google Fonts do require including the license file.
- Icon fonts (Font Awesome, Material Icons) have separate licenses for the font file vs the CSS/SVG — check both.
- Custom font subsets may trigger modification clauses — OFL requires renaming modified fonts.
API and Service Attribution
Many APIs and services require visible attribution as a condition of use.
| Service |
Attribution Requirement |
| Google Maps |
"Google" logo on map + "Map data ©20XX Google" + Terms link |
| Mapbox |
"© Mapbox" + "© OpenStreetMap" on map display |
| OpenStreetMap |
"© OpenStreetMap contributors" with link to copyright page |
| Twilio |
No visible attribution required (per current ToS) |
| Stripe |
"Powered by Stripe" badge on checkout (optional but encouraged) |
| OpenAI API |
No required attribution (per current ToS), but must not claim AI output is human-generated |
| GitHub API |
Must comply with ToS; no mandatory badge |
| Unsplash |
Attribution appreciated but not required (Unsplash License) |
Always check the current Terms of Service. API attribution requirements change with ToS updates. What was optional last year may be mandatory now.
Data Source Attribution
| Data License |
Attribution Required |
Derivative Works |
| Open Data Commons Attribution (ODC-BY) |
Yes — credit source |
Yes |
| Open Data Commons ODbL |
Yes — credit source + share alike |
Yes (same license) |
| CC BY 4.0 (for datasets) |
Yes — TASL format |
Yes |
| Government open data (US) |
Generally no (public domain) |
Yes |
| Government open data (UK) |
OGL — yes, crown copyright |
Yes |
| Government open data (EU) |
Varies by member state |
Varies |
Compliance Checklist
| # |
Check |
Frequency |
| 1 |
Audit all dependencies for license types and attribution requirements |
Every release |
| 2 |
Generate NOTICE/THIRD-PARTY-NOTICES file from dependency metadata |
Every build (automate) |
| 3 |
Review media assets (images, icons, fonts, audio) for license terms |
When assets are added |
| 4 |
Check API ToS for attribution requirements |
When integrating new APIs and on ToS change notifications |
| 5 |
Verify data source licenses for attribution and share-alike terms |
When incorporating new data sources |
| 6 |
Display attribution in the correct location for your distribution type |
Every release |
| 7 |
Verify modified fonts are renamed per OFL requirements |
When customizing fonts |
| 8 |
Document attribution decisions in a central register |
Ongoing |
Best Practices
- Always consult legal counsel when unsure about attribution requirements — getting it wrong can terminate your license to use the software.
- Automate NOTICE file generation as part of your CI/CD pipeline — tools like
license-checker, FOSSA, and go-licenses catch new dependencies automatically.
- Maintain a central attribution register that tracks every third-party component, its license, and where attribution is displayed.
- Include attribution in your release checklist — it is easy to add a dependency and forget to update the NOTICE file.
- Check API Terms of Service on a scheduled basis — attribution requirements change with ToS updates without notice.
- Do not strip copyright notices or license headers from source files — many licenses explicitly require preserving them.
- Display attribution accessibly — a legal/licenses page that users can actually find, not buried in an invisible footer.
- Treat font licenses as seriously as code licenses — font piracy lawsuits are common and penalties can be per-seat or per-pageview.
1---2name: attribution3description: Use when identifying attribution requirements that apply to software products — open-source license notices, third-party asset credits, API usage attribution, font licensing, media licensing, and data source attribution. Covers what must be attributed, how, and where across different asset types and jurisdictions. USE FOR: attribution requirements, license notices, open-source attribution, Creative Commons, font licensing, image licensing, API attribution, data attribution, NOTICE files, third-party credits, attribution in UI, attribution in documentation DO NOT USE FOR: choosing open-source licenses (use open-source-licensing), IP ownership disputes (use intellectual-property), content moderation obligations (use content-moderation)4license: MIT5---67# Attribution89> **Disclaimer**: This skill provides general educational information about legal topics relevant to software development. It is **not legal advice**. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.1011## Overview1213Attribution is a legal obligation that arises from many sources — open-source licenses, Creative Commons media, font licenses, API terms of service, data provider agreements, and more. Failing to provide required attribution can constitute license violation (risking license termination and copyright infringement claims), breach of contract, or regulatory non-compliance. Many companies underestimate attribution requirements because the obligation is spread across dozens of different asset types, each with its own rules.1415## Attribution by Asset Type1617| Asset Type | Common Licenses/Terms | Attribution Required | Where to Attribute |18|-----------|----------------------|---------------------|-------------------|19| **Open-source libraries** | MIT, Apache 2.0, BSD, GPL, LGPL, MPL | Yes (nearly all OSS licenses) | NOTICE file, about/legal screen, documentation |20| **Fonts** | OFL (SIL Open Font License), proprietary EULA | OFL: yes; Proprietary: per EULA | Font credits page, CSS comments, documentation |21| **Images / Icons** | Creative Commons, stock photo licenses, proprietary | CC BY: yes; Stock: per license; Proprietary: per contract | Image credits, about page, metadata |22| **Audio / Video** | Creative Commons, royalty-free licenses, sync licenses | CC BY: yes; Royalty-free: per license | Credits section, end cards, metadata |23| **Datasets** | CC BY, ODC-BY, government open data licenses | CC BY/ODC-BY: yes; Some government: yes | Data source citations, documentation |24| **APIs** | Terms of service, developer agreements | Many require "powered by" branding | UI badge/logo, documentation, per ToS |25| **Maps** | Google Maps Platform, Mapbox, OpenStreetMap | Yes (all major providers) | Map overlay attribution, per ToS |26| **AI/ML models** | Model cards, Hugging Face licenses, proprietary | Varies — many require model credit | Documentation, about page, per license |2728## Open-Source Attribution2930Open-source attribution is the most common and most frequently violated attribution requirement in software.3132### What Most OSS Licenses Require3334| License | Requirements | NOTICE File | License Text | Copyright Notice |35|---------|-------------|-------------|-------------|-----------------|36| **MIT** | Include copyright notice + license text in copies | Recommended | Required | Required |37| **Apache 2.0** | Include NOTICE file + license text; state changes | Required | Required | Required |38| **BSD 2-Clause** | Include copyright notice + license text | Recommended | Required | Required |39| **BSD 3-Clause** | Same as 2-Clause + no endorsement clause | Recommended | Required | Required |40| **ISC** | Include copyright notice + license text | Recommended | Required | Required |41| **MPL 2.0** | License text in source files; larger work can be proprietary | Per-file | Required (per file) | Required |42| **LGPL 2.1/3.0** | License text + copyright + link to source for modifications | Required | Required | Required |43| **GPL 2.0/3.0** | Full license + copyright + source offer for binaries | Required | Required | Required |44| **AGPL 3.0** | Same as GPL + network interaction triggers | Required | Required | Required |4546### NOTICE File Structure4748The standard approach for bundling attribution in a distributable product:4950```51NOTICE5253This product includes software developed by third parties.5455================================================================================56Library: react57Version: 18.2.058License: MIT59Copyright (c) Meta Platforms, Inc. and affiliates.60================================================================================6162================================================================================63Library: lodash64Version: 4.17.2165License: MIT66Copyright JS Foundation and other contributors67================================================================================6869================================================================================70Library: express71Version: 4.18.272License: MIT73Copyright (c) 2009-2014 TJ Holowaychuk74Copyright (c) 2013-2014 Roman Shtylman75Copyright (c) 2014-2015 Douglas Christopher Wilson76================================================================================77```7879### Automation Tools8081| Tool | Ecosystem | Output |82|------|-----------|--------|83| **license-checker** | npm | JSON/CSV/Markdown of all dependency licenses |84| **license-report** | npm | Detailed license report with texts |85| **pip-licenses** | Python | Tabular license output for pip packages |86| **go-licenses** | Go | License detection and NOTICE file generation |87| **dotnet-project-licenses** | .NET | NuGet package license report |88| **FOSSA** | Multi-language | Full compliance management platform |89| **Snyk** | Multi-language | License auditing as part of SCA |90| **licenseFinder** | Multi-language (Ruby-based) | Approve/deny license policies |9192### Where to Display OSS Attribution9394| Distribution Method | Where to Show Attribution |95|--------------------|--------------------------|96| **Web application (SaaS)** | "Legal" or "Open Source Licenses" page linked from footer |97| **Desktop application** | About dialog → "Third-Party Licenses" section |98| **Mobile app (iOS)** | Settings → Licenses (use `Settings.bundle` or acknowledgements plist) |99| **Mobile app (Android)** | About → Open Source Licenses (use `oss-licenses-plugin` for Gradle) |100| **CLI tool** | `--licenses` flag or `THIRD-PARTY-NOTICES.txt` bundled in distribution |101| **Library / SDK** | `NOTICE` or `THIRD-PARTY-NOTICES` file in package root |102| **Container image** | `/licenses/` directory or `NOTICE` file in image root |103| **Documentation** | Acknowledgements section in README or docs site |104105## Creative Commons Attribution106107Creative Commons licenses are common for media, data, and documentation.108109| License | Attribution Required | Share Alike | Commercial Use |110|---------|---------------------|-------------|----------------|111| **CC0** | No | No | Yes |112| **CC BY 4.0** | Yes | No | Yes |113| **CC BY-SA 4.0** | Yes | Yes (derivatives same license) | Yes |114| **CC BY-NC 4.0** | Yes | No | No |115| **CC BY-NC-SA 4.0** | Yes | Yes | No |116| **CC BY-ND 4.0** | Yes | No (no derivatives) | Yes |117118### Proper CC BY Attribution (TASL)119120Creative Commons specifies the **TASL** format:121122- **T**itle — name of the work123- **A**uthor — creator name (linked to profile if available)124- **S**ource — URL where the work was found125- **L**icense — license name linked to the license deed126127Example:128```129"Sunset Over Mountains" by Jane Smith (https://example.com/photo/123)130is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)131```132133## Font Licensing134135Fonts carry their own licensing terms that are frequently overlooked.136137| License | Attribution | Embedding | Modification |138|---------|-------------|-----------|-------------|139| **SIL Open Font License (OFL)** | Required (original name + copyright) | Web/app/document embedding allowed | Allowed (must rename modified version) |140| **Apache 2.0** (some Google Fonts) | Required (copyright + license) | Allowed | Allowed |141| **Proprietary (Adobe, Monotype, etc.)** | Per EULA | Per EULA (often limited seats/pageviews) | Typically prohibited |142| **Desktop-only licenses** | Per EULA | Web embedding NOT allowed | Per EULA |143144### Font Attribution Pitfalls145146- **Web fonts** loaded via Google Fonts CDN do not require separate attribution (Google's ToS handles it), but self-hosted Google Fonts do require including the license file.147- **Icon fonts** (Font Awesome, Material Icons) have separate licenses for the font file vs the CSS/SVG — check both.148- **Custom font subsets** may trigger modification clauses — OFL requires renaming modified fonts.149150## API and Service Attribution151152Many APIs and services require visible attribution as a condition of use.153154| Service | Attribution Requirement |155|---------|----------------------|156| **Google Maps** | "Google" logo on map + "Map data ©20XX Google" + Terms link |157| **Mapbox** | "© Mapbox" + "© OpenStreetMap" on map display |158| **OpenStreetMap** | "© OpenStreetMap contributors" with link to copyright page |159| **Twilio** | No visible attribution required (per current ToS) |160| **Stripe** | "Powered by Stripe" badge on checkout (optional but encouraged) |161| **OpenAI API** | No required attribution (per current ToS), but must not claim AI output is human-generated |162| **GitHub API** | Must comply with ToS; no mandatory badge |163| **Unsplash** | Attribution appreciated but not required (Unsplash License) |164165> **Always check the current Terms of Service.** API attribution requirements change with ToS updates. What was optional last year may be mandatory now.166167## Data Source Attribution168169| Data License | Attribution Required | Derivative Works |170|-------------|---------------------|-----------------|171| **Open Data Commons Attribution (ODC-BY)** | Yes — credit source | Yes |172| **Open Data Commons ODbL** | Yes — credit source + share alike | Yes (same license) |173| **CC BY 4.0 (for datasets)** | Yes — TASL format | Yes |174| **Government open data (US)** | Generally no (public domain) | Yes |175| **Government open data (UK)** | OGL — yes, crown copyright | Yes |176| **Government open data (EU)** | Varies by member state | Varies |177178## Compliance Checklist179180| # | Check | Frequency |181|---|-------|-----------|182| 1 | **Audit all dependencies** for license types and attribution requirements | Every release |183| 2 | **Generate NOTICE/THIRD-PARTY-NOTICES file** from dependency metadata | Every build (automate) |184| 3 | **Review media assets** (images, icons, fonts, audio) for license terms | When assets are added |185| 4 | **Check API ToS** for attribution requirements | When integrating new APIs and on ToS change notifications |186| 5 | **Verify data source licenses** for attribution and share-alike terms | When incorporating new data sources |187| 6 | **Display attribution** in the correct location for your distribution type | Every release |188| 7 | **Verify modified fonts** are renamed per OFL requirements | When customizing fonts |189| 8 | **Document attribution decisions** in a central register | Ongoing |190191## Best Practices192193- **Always consult legal counsel** when unsure about attribution requirements — getting it wrong can terminate your license to use the software.194- **Automate NOTICE file generation** as part of your CI/CD pipeline — tools like `license-checker`, `FOSSA`, and `go-licenses` catch new dependencies automatically.195- **Maintain a central attribution register** that tracks every third-party component, its license, and where attribution is displayed.196- **Include attribution in your release checklist** — it is easy to add a dependency and forget to update the NOTICE file.197- **Check API Terms of Service** on a scheduled basis — attribution requirements change with ToS updates without notice.198- **Do not strip copyright notices or license headers** from source files — many licenses explicitly require preserving them.199- **Display attribution accessibly** — a legal/licenses page that users can actually find, not buried in an invisible footer.200- **Treat font licenses as seriously as code licenses** — font piracy lawsuits are common and penalties can be per-seat or per-pageview.
Tyler-R-Kendrick