Licensing Working Group/Minutes/2026-08-17
OpenStreetMap Foundation, Licensing Working Group (LWG) - Agenda & Minutes
17 August 2026, 17:00 UTC
Approved during the 2026-09-14 LWG meeting.
Participants
- Kathleen Lu (Chairing)
- Dermot McNally
Absent
- Simon Hughes
- Tom Lee
Administrative
Adoption of past minutes
- 2026-06-08 Pending, as Tom Lee is absent
Minutes by Dorothea Kazazi.
Any updates on reported attribution cases?
Reports in OTRS:
- Ticket#2021081210000057 printed maps with false copyright
- Ticket#2022011910000082 interparcel.com: Dermot emailed them on 10th Nov, no reply
- Ticket#2022012610000149 poster.printmijnstad.nl/editor/city
- Ticket#2022033010000217
- complaint that Aberdeen city council may not be attributing correctly – Aberdeen city council consultation
- Note that Aberdeen credits Ordnance Survey, so possible OS is using OSM as one of many sources and the full attribution is not getting carried through
- Ticket#2022032710000125 - Evri parcelshop finder
- Hermes UK changed name to evri. So this is an old issue.
- Ticket#2022062610000078 -
- Härryda, Sweden, uses OpenStreetMap for an app they developed. Inside the app there are no license references to OSM.
- You can see the app on the Google Apps store here: Google Play Store app listing
- Ticket#2021120810000146 mondialrelay.fr not attributing correctly
- Ticket#2022120510000177 — Club Vosgien complaint – any reply?
Board items
Hotelmap.com
| Email shared by the LWG |
|---|
| Dear LWG, We sent this notice to Hotelmap.com a couple of weeks ago. We got no notice from them. I see this case as specifically problematic, as Hotelmap.com is deliberately changing Mapbox's attribution to hide OSM and add their own. I noticed the issue, as it's the official booking site for the Geospatial World Forum. Best, Héctor Dear team at Hotelmap.com, We have noticed you are using OpenStreetMap-based tiles for the map background. Based on your page, it appears you are using Mapbox (I have checked this page https://hotelmap.com/MG968). We are happy that you use OpenStreetMap-based tiles in your application and welcome your use of them through a third-party service like Mapbox. However, using OSM data through a third party still requires citing the source of the map style and map data. We have noticed that this attribution is not present in Hotelmap.com. Mapbox provides guidance on its website (https://docs.mapbox.com/help/dive-deeper/attribution/) on how to attribute a map using its libraries and styles, including OSM-based ones. In addition, OpenStreetMap has a copyright page with more information on how to cite OSM data-based maps: https://www.openstreetmap.org/copyright. If you require any clarification, we would be happy to assist. Héctor Ochoa Ortiz¹ |
| Previous LWG updates: Tom Lee has reached out March 6 - no reply. |
No update as Tom Lee is absent.
Redacted topic. From DWG via legal@
Related to Ticket#2026062110000187.
Discussed for 2 minutes.
Any followup to the ChatGPT issue?
| Email shared by the LWG |
|---|
| Dear LWG,
I got sent this Mastodon toot (Mastodon post), warning that ChatGPT uses Mapbox basemaps (which then use OSM data) without attribution. I have tried this myself with this query ChatGPT query, checked areas I usually map for confirmation that the basemap matches (it does), and also checked through the network requests that indeed, the tiles are fetched from Mapbox. [screenshot attached] Given that ChatGPT is widely used nowadays, I believe we have to try extra hard to ensure they cite its basemap correctly. I found this form: Copyright dispute form Should I fill it out, or should we contact them another way? I wanted to contact you as LWG before going ahead myself. If there is no complaint from your side in a week's time, I will send myself. Mapbox has an attribution guide we can point to in the request: Mapbox attribution guide [screenshot attached] |
No update as Tom Lee is absent.
Queries to legal-questions
Large copyright infringement (Dopper - water taps) - Ticket#2025040310000645
| Email shared by the LWG | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| I am a long-time french OSM contributor, and I've been using Google Maps lately (I know, it's bad) for a hiking trip. I found out that a brand named "Dopper" (Dopper website) has imported 130.000+ water tap POI from OpenStreetMap on Google Maps in Europe, in order to promote their water bottles.
Although I can't confirm that the 130 000 POIs have been "stolen" from OSM, 100% of those that I have checked have the exact same coordinates (even when the water tap doesn't exist anymore) on Google Maps and OSM. Here are a few examples:
Of course, they also use an OSM-based map on their website without attribution (Dopper tap map), which reference all the water taps (same coordinates than OSM). Even if I can't prove that Dopper has been adding all of these water taps to the map, every Google Maps POI has a link to their website, and they have communicated on this marketing campaign on internet : Localyse case study / Le Vie article / La Poste Hub article.. Were you aware of this Thank you in advance for your help, 15 June - Dermot sent letter to Dopper 11 August: Dermot's draft letter for Google (version 2): Our contributor is concerned that many of the locations in question have been sourced from OpenStreetMap, citing identical geographical co-ordinates to many decimal places. This would represent a breach of OpenStreetMap's Open Database Licence (ODbL), which requires attribution of source and sharealike. We assume that the import of such data into Google Maps would additionally violate your own requirements in terms of permitted data sources. We have made a good faith attempt to contact Dopper so that they can address these issues, but the available communications channels have not resulted in a response. We therefore feel that it is appropriate to make you aware of the issue so that you can act appropriately to ensure that both your terms and ours are being upheld. To illustrate the apparent OSM-sourcing, our contributor provided some examples of locations with matching co-ordinates:
We would be happy to be of any assistance possible in this matter. Kathleen emailed Eric Dickinson (product counsel for Google Maps), who replied that he would look into it. Previous action item: Dermot to check with original mapper on providing additional examples, if possible. Previous action item: Kathleen to provide copy of analysis to Google.' Done on 25 January 2026. Dermot had replied to the original correspondent asking for additional examples of problematic data. Dermot tried to find Dopper's contact information - they have not responded to his message via their webform. Dermot might have emailed service@dopper.nl or info@dopper.nl and got redirected to the webform. Will check.
Other points mentioned during discussion
Previous action items
Google seems to have removed Dopper as a source | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| LWG internal reference: View ticket #65356 |
Update: No reply to Dermot's email to CEO.
Suggestion: Send a paper letter.
EVRI delivery company using OSM without attribution? - Ticket#2026010610000189
| Email shared by the LWG |
|---|
| is this substantial or not
(Screenshot attached) Their main map is missing attribution: Evri parcelshop finder They are using these service: Vectorine Previous LWG updates: Previous action item: Tom Lee to reach out to Vectorine regarding compliance to ODbL, and if that doesn't work, to Evri. Tom Lee reached out March 31, received word that EVRI acknowledged need for attribution Note: Also related to Ticket#2022032710000125 - Evri parcelshop finder – attribution problems in multiple places Tom in conversation with Vectorine dev... |
| LWG internal reference: View ticket #77004 |
Not discussed.
Any other business
Attribution missing - Steam game: subwaybuilder
| Email shared by the LWG |
|---|
| https://store.steampowered.com/app/4039140
I have not played this game, I'm sending this e-mail based on what I read online. The community reception of the game hasn't been very good. People have complained it is a buggy mess, and some reviews even claim the developer(s) used Claude AI to vibe-code the game live on stream. But, to make it worse, I think it is a violation of the OSM license. The developer clearly admits using OSM data: https://steamcommunity.com/app/4039140/discussions/0/574921459914480052/#c574921459914521359 And yet, I don't see any mention to OSM in the Steam store description. Also no mention in the official website. They even have a "Credits" page, but that also doesn't mention OSM: https://www.subwaybuilder.com/credits The screenshots also don't show anything about the source data. According to https://osmfoundation.org/wiki/Licence/Attribution_Guidelines#Requirements_to_fit_within_OSMF’s_safe_harbour: "The attribution format should not require individuals to interact with the map or produced work to see the attribution." Well, I'm not interacting with the product (and I'm not buying yet), and I'm still unable to see any attribution. And, as a final comment, I have not tried to contact the developers. Frankly, I don't want to contact them at all, and that's why I decided to contact OSM Foundation to inform you about this (probable) violation. Thank you for looking at this subject! |
Attribution and licensing of OSM derived routing results within NeTEx and GTFS - Ticket#2026080710000307
| Email shared by the LWG |
|---|
| As you may be aware, OpenStreetMap data is currently shipped in many transit related authoring software suites. I am not talking about a basemap, but the pbf files are transformed in some way or the other so they become routable, replacing historic vendors like TomTom and Here. The result is either exported in NeTEx (Europe) as RouteLinks or ServiceLinks, or in GTFS (worldwide) via shapes.txt. That result is either presented on a map as an extra layer, or used as input for map matching to an internal dataset. In both use cases the coordinates (not attributes) are distributed without any attribution, in a different format, maybe even geospatial projection as the original.
From a legal framework the question arises if a result of a routing engine using OpenStreetMap requires attribution and/or the same ODbL license, for at least that subset of the published dataset. From the Attribution Guidelines the following quote can be obtained: Routing instructions generated by such a routing engine need not maintain attribution attached to the instructions, as long as they do not form a Derivative Database. From any understanding: a NeTEx or GTFS does form a new database, but I could also argue a GeoJSON file would also fulfill that, which makes the "instruction argument" vague, because the presentation format should to change legal outcomes. While for the Dutch use case, we do have government alternative CC-0 sources, and the ability to generate geospatial data directly from GPS traces from automatic vehicle location systems, having a discussion on the matter would make sense. There is currently an opportunity to define the impact. |
| LWG internal link: View ticket #89275 |
A service using OSM for routing has the obligation of attributing OpenStreetMap - they have to inform people who are using their service about OSM, like geocoders. If the map is a different provider, they need to provide separate attribution. The enquirer's questions seems to be answered directly by the quote of attribution guideline. Topic similar to past question about using OSM for routing.
Suggestions
- Review the GitHub pull request in full.
- Dermot to reply to the sender, with clarifying questions.
Specific cases discussed
- If you are McDonald's and you have a truck going to all the McDonald's locations, then you can use an OSM router to figure out your route for your truck, and neither your truck route nor your restaurant locations are under share-alike.
- If the above data was in a PostGIS database, and everything was rendered, including the map, you could attribute different parts of the database separately, saying that all fields, except McDonald's restaurants, are OSM.
- A city transit authority taking OSM data such as bus stops and geometry and combining it with timetable data to generate routing information. Does the transformed output trigger OSM's share-alike?
- That may be covered by trivial transformations.
Unclear points
- What specific data points of the GTFS feed would come from OSM.
- Probably stop locations and some driven geometries.
Other points mentioned
The attribution guideline says it doesn't form a derivative database if it's just one route.
Action item
Dermot to investigate what is underlying question.
Lizensverstoß, Flyer without attribution - Ticket#2026062010000125
| Email shared by the LWG |
|---|
| Machine translation: Hello. Today, I received a flyer from what it claims to be a non-NGO that features a map based on OSM data. Unfortunately, there is no indication of the source or the license. See the attachment for images. Should I contact the copyright holder myself?
DE: Hallo. Mir wurde am heutigen Tag ein Flyer einer (nach eigenen Aussagen) Nicht-NGO zugetragen, auf der eine Karte aus OSM Daten verwendet wird. Leider fehlt jeglicher Hinweis auf die Herkunft und die Lizenz. Bilder siehe Anhang. Sollte ich selbst den Urheber darüber informieren? Perhaps someone can respond to him in German that since OSM was clearly attributed, enabling him to find us, it's sufficient? Tom Lee to follow up. Note: there was no attachment. |
| LWG internal link: View ticket #86157 |
Licence of the public GPS trace database, and the sanctioned access channel - Ticket#2026081410000419
| Email shared by the LWG |
|---|
| Dear Licensing Working Group,
I am an independent developer in Taiwan building a non-commercial-origin hiking safety system: a "watchkeeping" service that helps a person at home track whether a mountain party has returned on time, and a search-area estimation tool intended for use in mountain search and rescue. I have three narrow questions about the GPS trace database specifically, as distinct from the map data. I have read the Contributor Terms, the Licence and Legal FAQ, the copyright page, the Privacy Policy, the API Usage Policy and the Planet.gpx page before writing, and I could not resolve these from those documents. Background, briefly: Taiwan has no publicly citable dataset of realistic hiking travel times. The de facto standard is a copyrighted commercial map series that cannot be quoted, and official open data covers only a fraction of trails. Timestamped public GPS traces would allow aggregate statistics to be computed (for example the median and spread of descent times on a given trail segment), which would let a watchkeeper judge whether a party is genuinely overdue instead of relying on a threshold the hiker guessed at before departure. 1. LICENCE The copyright page and the Legal FAQ state that "OSM data" is available under ODbL 1.0. I could not find any statement covering the GPS trace database specifically. The Contributor Terms describe contributions "to the geo-database of the OpenStreetMap project", and clause 3 states that OSMF may only use or sub-license Contents under ODbL 1.0 with DbCL 1.0, CC-BY-SA 2.0, or another free and open licence - but I could not find a record of which of these was actually adopted for traces. Could you confirm which licence applies to trace points obtained from OSM? And if aggregate statistics were derived from them (no individual track reconstructed, no coordinates republished), would that be treated as a Produced Work or as a Derivative Database? 2. ACCESS CHANNEL The API Usage Policy states that the editing API is "provided in order to edit the map data, not for read-only purposes or projects", and that large or frequent data users must use planet.osm. However, planet.gpx appears to have last been published in 2013, and its documentation describes it as coordinate pairs only, with no track structure or metadata - that is, without the timestamps this work requires. Overpass serves map data rather than traces. Is there a sanctioned way to obtain a bounded, region-limited extract of timestamped trace points? My reads so far have been small feasibility samples only (on the order of tens of thousands of points, sequential, no concurrency, no automation), and I have stopped pending your reply rather than proceed on an assumption. 3. TRACES NOT MARKED PUBLIC The Privacy Policy notes that GPS data downloaded via the API "will include points from traces which were not marked as public". What does OSMF expect data consumers to do about those points - are there filtering obligations or restrictions we should apply? I would rather build the constraint in from the start than discover it later. A SMALL OBSERVATION, offered only in case it is useful to you The Privacy Policy states that when GPS data for an area is downloaded via the API, "no indication is provided of which user uploaded a point or of the timestamp that is associated with the point". In my tests, responses from /api/0.6/trackpoints did include a per-point I appreciate that the group is run by volunteers and cannot provide legal advice or review business plans. A short pointer to existing policy would be entirely sufficient, and I am happy to be redirected if any of these belongs to another working group. With thanks for your time, and for the project. Yours sincerely, |
| LWG internal link: View ticket 89673 |
Interesting use case and app.
The sender is asking:
- the licence of GPX traces uploaded to osm.org
- whether he can use the GPX timestamps from the old (mappers') traces to estimate a realistic hiking time for a trail.
- about GPX traces uploaded to osm.org that were not marked "public".
Licence of GPX traces uploaded to osm.org
Dorothea pointed out that the GPX traces' licence was CC-BY-SA 2.0 until the licence change, and ODbL after, as https://osmfoundation.org/wiki/Licence/Historic/We_Are_Changing_The_License mentions: "What license is being changed? We are changing the current CC-BY-SA 2.0 to Open Database License (ODbL) 1.0. The license that covers the contributed geodata (nodes, ways, relations) and the GPX traces that you upload. That is, anything that is in the PostgreSQL database and which we explicitly publish, like planet.osm." Old LWG discussion about the licence of GPS traces: https://osmfoundation.org/wiki/Licensing_Working_Group/Minutes/2024-10-07#Licensing_of_OSM_GPS_traces_#56357
GPS traces uploaded to osm.org
- There is a partially obfuscated class of GPS traces available via osm.org which are a series of points without time-stamps and not associated with a specific OSM.org user, nor to each other.
- Some people pre-process GPS traces before uploading them to osm.org.
Using GPX timestamps from the old (mappers') traces to estimate a realistic hiking time for a trail
The mappers who created and uploaded the traces might be hiking slowly, in order to map - this would be a safe duration for a slow hike.
Dorothea pointed out the announcement about upcoming changes to GPX traces which may be uploaded to osm.org, by removal of two of the four GPX trace categories: https://community.openstreetmap.org/t/changes-coming-to-gps-trace-uploads/145728
Decision
Overall, fine, see https://osmfoundation.org/wiki/Licensing_Working_Group/Minutes/2024-10-07#Licensing_of_OSM_GPS_traces_#56357
For private traces, they are partially obfuscated and unordered - you can see the location points but they are not connected, so they are probably useless for your purpose. Note: https://community.openstreetmap.org/t/changes-coming-to-gps-trace-uploads/145728
Reply sent on 17th of August.
2026 LWG meeting times
Jan 12, at 18:00 UTC
Feb 09, at 18:00 UTC
Mar 09, at 18:00 UTC (US switch Mar 8, Europe switch Mar 29) (11am PDT/2pm EDT for US attendees)
Apr 20, at 17:00 UTC
May 11, at 17:00 UTC
Jun 08, at 17:00 UTC
Jul 13, at 17:00 UTC
Aug 17, at 17:00 UTC
Sep 14, at 17:00 UTC
Oct 19, at 17:00 UTC
Nov 16, at 18:00 UTC (same as normal hours for everyone)
Dec 14, at 18:00 UTC
Meeting adjourned 56 minutes after start.