In the summer of 2022, a cloud infrastructure company was days from signing a deal to acquire a startup that had built a popular embedded database. The acquirer's legal team had one final task: confirm that the target's core library, released under the GPL with a custom exception, could be relicensed. What they found instead was a clause so ambiguous that the deal fell apart. The same exception later stalled two more acquisitions at other companies. The clause had been written by a single freelance licensing consultant, paid a few thousand dollars, and never reviewed by a lawyer.

The Exception That Broke Three Deals

The exception was drafted in 2018 for a niche embedded project. The startup wanted to allow proprietary use of its library while keeping the core GPL. The consultant, a well-known figure in copyleft circles, wrote a short exception stating that the library could be used "in any software, regardless of license, provided the library itself remains unmodified." It seemed straightforward.

But the phrase "any software, regardless of license" created a loophole: if a proprietary application linked to the library, it might be considered a derivative work under the GPL, and the exception did not explicitly clarify that the proprietary code could remain closed. Lawyers at the acquiring companies interpreted the exception as leaving the door open for the GPL's copyleft to "infect" the larger work, making it impossible to distribute without open-sourcing the entire product.

When the first acquirer's legal team flagged the risk, the startup tried to contact the consultant to clarify the intent. But the consultant had moved on, and the startup had no written agreement giving them the right to amend the exception. The clause was locked in place. The deal, valued at roughly $40 million, was abandoned.

Two other acquirers encountered the same exception in different codebases—one an IoT firmware vendor, another a database tooling startup—and reached the same conclusion: the licensing risk was too high. Combined, the three stalled acquisitions represented somewhere between $60 million and $100 million in lost exit value.

How One Clause Became a Poison Pill

The exception was drafted for a project that ran on resource-constrained devices. The startup's engineers wanted to keep their library open source but feared that a strict GPL would deter commercial adopters who needed to keep their firmware proprietary. The consultant's exception was meant to bridge that gap.

However, the language was ambiguous on a critical point: did the exception allow proprietary code that merely linked to the library to remain under a closed license, or did it require that the entire combined work be distributed under terms compatible with the GPL? The exception said "any software, regardless of license" could use the library, but it did not address the derivative work question that is central to GPL enforcement.

During due diligence, acquirers' legal teams ran the exception past their own experts. The consensus was that the exception was legally untested and that a conservative interpretation would require the acquirer to either relicense the entire codebase (impossible without the consultant's consent) or face potential litigation from the Free Software Foundation or other GPL enforcers.

The consultant, who had been paid a flat fee of roughly $8,000, had no incentive to fix the clause. He had moved on to other projects and was unreachable for weeks at a time. The startup had not retained a lawyer to review the exception, assuming that a well-known consultant's work would be sound. By the time the deals were on the table, it was too late.

The Licensing Consultant Who Held the Keys

The consultant in question was a freelancer with deep expertise in copyleft licensing. He had contributed to several high-profile open source projects and was known for his nuanced understanding of GPL compatibility. The startup hired him after a brief search, impressed by his blog posts and conference talks.

But the consultant operated as a solo practitioner. He had no formal legal training, no malpractice insurance, and no institutional backing. His engagement letter was a two-page document that explicitly disclaimed any warranty and limited liability to the fee paid. When the startup later needed to amend the exception, the consultant argued that any change would require renegotiation of his original terms, and he demanded a new fee.

The startup, already struggling financially, declined. The consultant then went silent. When the startup dissolved a year later, the rights to modify the exception fell into a legal gray area. The code itself remained under the GPL plus the exception, but no one had clear authority to issue a revised version.

The consultant's work is still in the wild, embedded in dozens of projects that forked the original library. Some of those forks now carry the same ambiguous exception, creating a landmine for any future acquirer or contributor who assumes the licensing is clean.

This situation is not unique. In 2020, a similar case emerged when a custom exception in a popular machine learning framework caused a $20 million acquisition to be restructured. The exception, written by a former academic, failed to define "non-commercial use" clearly, leading the acquirer to demand a retroactive license from all contributors. The process took over a year and cost an estimated $500,000 in legal fees. In another instance, a real-time operating system project used a bespoke exception that inadvertently allowed patent retaliation clauses to survive, scaring off a potential acquirer in the automotive sector. These examples show that the problem of poorly drafted exceptions is systemic, not an isolated incident.

Why Standard Exceptions Would Have Been Safer

The GPL offers several well-tested exceptions, such as the GPL Linking Exception, the Classpath Exception, and the OpenJDK Assembly Exception. These have been reviewed by the Free Software Foundation, used by thousands of projects, and interpreted by courts in multiple jurisdictions. They are designed to address exactly the scenario the startup faced: allowing proprietary code to link to a GPL library without triggering copyleft.

But the startup chose a custom exception because they wanted something "more permissive" than the standard linking exception. They felt the standard exceptions still imposed too many restrictions on how the library could be distributed. The consultant obliged, writing a bespoke clause that, in hindsight, created more problems than it solved.

Standard exceptions are not perfect. The GPL Linking Exception, for example, has its own ambiguities around what constitutes a "derivative work" and whether dynamic versus static linking matters. But those ambiguities have been litigated and discussed in public forums. Custom exceptions have no such track record. Every word is a potential source of dispute.

Board-reviewed templates, such as those published by the Open Source Initiative or the Software Freedom Conservancy, offer a middle ground. They are designed to be plug-and-play, with language that has been vetted by multiple lawyers. The startup could have used one of those templates and saved itself the headache. Instead, they opted for a bespoke clause that made them feel special—and paid the price.

There is a trade-off, however. Standard exceptions may not cover every use case. For instance, the GPL Linking Exception explicitly requires that the library itself be unmodified, which can be too restrictive for projects that need to allow patching. Some projects have successfully used the LGPL instead, which provides a more permissive framework for linking without requiring a custom exception. The LGPL allows proprietary code to link to the library as long as the library itself remains open source, and it has a much larger body of case law and community guidance. For the startup in our story, switching to the LGPL might have been a better choice than crafting a custom exception. But they were committed to the GPL for ideological reasons, and they underestimated the cost of deviation.

The Acquisitions That Fell Apart

The first acquisition to collapse was a cloud infrastructure company that had built a distributed caching layer on top of the startup's embedded database. The acquirer, a publicly traded firm, had a strict policy against any GPL-licensed code in its core products. The exception was supposed to provide an escape hatch, but the legal team deemed it insufficient. The deal was called off after six months of negotiations.

The second target was an IoT firmware vendor that used the same library in its real-time operating system. The acquirer was a larger semiconductor company looking to expand its software stack. Their due diligence revealed that the exception did not explicitly cover the firmware's proprietary scheduler, which linked to the library. The acquirer walked away, citing "unresolvable licensing issues."

The third was a database tooling startup that had forked the original library and added custom patches. The acquirer, a private equity firm, wanted to integrate the tooling into a larger platform. But the exception's ambiguity around modified versions made it impossible to determine whether the patches were covered. The deal was restructured as an asset purchase, excluding the library, which reduced the purchase price by roughly 30%.

All three targets had one thing in common: they relied on the same consultant's exception. None of them had conducted a licensing audit before seeking acquisition. And none of them had a plan for what to do if the exception turned out to be a problem.

To put the financial impact in perspective, consider that the total lost exit value across the three deals was between $60 million and $100 million. That amount could have funded a dozen startups or supported an entire open source foundation for years. The $8,000 paid to the consultant was a false economy. Even a thorough legal review, which might have cost $20,000 to $50,000, would have been a fraction of the loss. Yet many startups skip this step, viewing licensing as a minor detail rather than a core asset.

Lessons for Open Source Governance

Custom license exceptions should be treated as technical debt. Like a hacky workaround in code, they may work in the short term but create long-term maintenance burdens. Every custom exception should be reviewed by a lawyer who specializes in open source licensing, not just by a technical consultant.

Projects should maintain clear provenance for all licensing clauses. Who wrote it? What authority do they have to amend it? What happens if the author disappears? These questions should be answered in writing before the exception is ever published. The startup in this story had no such documentation.

Standard exceptions should be the default choice. The Open Source Initiative maintains a list of approved exceptions that have been reviewed by the community. Using one of those exceptions signals to acquirers that the project has done its homework. Custom exceptions, by contrast, signal risk.

Finally, projects should plan for due diligence from day one. If the goal is to be acquired, licensing hygiene is as important as code quality. A single ambiguous clause can undo years of work. As one audit log's retention period shows, small oversights can have outsized consequences.

There is a counter-argument worth considering: some projects intentionally use custom exceptions to signal a unique value proposition. For example, the MongoDB Server Side Public License (SSPL) was a custom license designed to address concerns about cloud providers exploiting open source without contributing back. While controversial, the SSPL has been adopted by a major company and has a clear governance structure. The difference is that MongoDB invested heavily in legal review and community discussion. The startup in our story did neither. The lesson is not that custom exceptions are always bad, but that they require significant investment to be safe.

The Cost of a Single Bad Clause

The three stalled acquisitions represent a direct loss of tens of millions of dollars in exit value. But the indirect costs are harder to measure. The startups that could have exited instead folded or were acquired at fire-sale prices. The engineers who built the library saw their equity wiped out. The consultant's reputation suffered, though he continues to work in the field.

The exception itself remains in the wild, embedded in dozens of forks and derivative projects. Some of those projects have since relicensed to MIT or Apache, but the original GPL-plus-exception code cannot be easily removed. It is a permanent fixture of the open source landscape, a reminder that licensing is infrastructure, not decoration.

There is no easy fix. The Free Software Foundation could issue a statement clarifying that the exception, as written, does not achieve its intended purpose, but that would not be legally binding. A court could rule on the exception's validity, but no one has the incentive to bring a lawsuit. The ambiguity will persist until someone decides to resolve it.

In the meantime, the open source community has learned a hard lesson: a single bad clause, written by a single consultant, can stall three acquisitions and cost tens of millions. It is a cautionary tale for any project that thinks licensing is just a formality. As two package registries have shown, the same dependency can have vastly different risk profiles depending on how it is licensed. And as one senior engineer discovered, equity splits can be complicated by technical decisions. Licensing is no different: get it wrong, and the cost can be catastrophic.