The sentence in question
The recommended notice for GNU licenses contains the following sentence.
either version 3 of the License, or (at your option) any later version.With this sentence, recipients may choose to follow the terms of the specified version or any version the FSF publishes later. This is "or later" (SPDX GPL-3.0-or-later). If you remove the "or later" part and state only a specific version, it becomes "only" (GPL-3.0-only).
Section 14 of GPL-3.0 and Section 9 of GPL-2.0 define this structure. In particular, Section 9 of GPL-2.0 says that if a program does not specify a version number at all, any version ever published by the FSF may be chosen. So if you only include a LICENSE file without stating the version clause, it may be interpreted differently from what you intended.
Why use "or later"
The FSF recommends "or later". The reason is future compatibility. When a new GPL is released because law and technology have changed, "or later" code can naturally be combined with the new version. In practice, GPL-2.0-or-later code could go straight into GPL-3.0 projects, while GPL-2.0-only code could not.
Section 14 of GPL-3.0 goes a step further and lets you designate a "proxy". If a person designated by the copyright holder publicly decides whether to accept a later version, that decision takes effect.
Why choose "only"
"Or later" also means agreeing in advance to licenses that have not been written yet. If the FSF later publishes a new version with terms you disagree with, recipients can choose that version to use your code.
The Linux kernel is the best-known example. The kernel is GPL-2.0-only. Linus Torvalds has publicly stated his opposition to GPL-3.0's installation information clause (so-called anti-tivoization), and because the kernel mixes the copyrights of thousands of contributors, changing its license is practically impossible anyway.
Impact on compatibility
Summarizing the compatibility matrix in the GNU license FAQ gives the following.
| Imported code → my project | GPL-2.0-only | GPL-2.0-or-later | GPL-3.0 |
|---|---|---|---|
| GPL-2.0-only | Yes | Yes (combined work is 2.0-only) | No |
| GPL-2.0-or-later | Yes | Yes | Yes |
| GPL-3.0 | No | Yes (combined work is 3.0) | Yes |
| LGPL-3.0 | No | Yes (combined work is 3.0) | Yes |
The key point is that GPL-2.0-only and GPL-3.0 cannot accept each other. Each license requires that no further restrictions be added, and each one's additional terms (such as 3.0's patent and installation information clauses) count as further restrictions from the other's perspective. You can check more combinations in the compatibility checker.
How to choose
- Follow the ecosystem: Code destined for the Linux kernel must be GPL-2.0-only (or compatible GPL-2.0-or-later or permissive).
- Future compatibility matters: If you are likely to exchange code with many GPL projects, or-later is more flexible.
- Control matters: If you don't want to leave it to the FSF's future decisions, use only, or designate a decision-maker as a proxy under GPL-3.0 Section 14.
How to state it
- Keep the text of the relevant version unchanged in
LICENSE(orCOPYING). The text itself does not distinguish only from or-later. - State the version clause in each file's notice and SPDX identifier. Choosing "only" or "or-later" in the generator's File header tab produces the official GNU notice together with the SPDX line.
- Also mention it in one line in the README (e.g. "Licensed under GPL-3.0-or-later").
This article is general information, not legal advice. Consult a professional for important decisions.
Sources
- GNU license FAQ, VersionThreeOrLater · AllCompatibility — https://www.gnu.org/licenses/gpl-faq.html
- GNU, How to Use GNU Licenses for Your Own Software — https://www.gnu.org/licenses/gpl-howto.html
- Linux kernel licensing rules — https://www.kernel.org/doc/html/latest/process/license-rules.html
- SPDX License List — https://spdx.org/licenses/