Unlicensed Software Use: Legal Risks for Businesses

What counts as unlicensed software use in a business?

Unlicensed software use is any copy or use of a program that its license does not permit. In a company, it can take several forms:

• installing a program on more computers, or for more users, than the purchased licenses cover;
• using a personal, home, student, or trial license for company work when its terms exclude that use;
• continuing to run software after a subscription or term license ends;
• running a cracked copy, or one activated with a key generator;
• using a license key bought from a seller that had no right to transfer it; and
• using open source code without meeting the conditions of its license.

A computer program can be a copyrighted work. Under 17 U.S.C. § 101, a “computer program” is “a set of statements or instructions to be used directly or indirectly in a computer in order to bring about a certain result.” Under 17 U.S.C. § 106, the copyright owner holds “the exclusive rights to do and to authorize” a list of acts, subject to exceptions in sections 107 through 122. The first is the right “to reproduce the copyrighted work in copies or phonorecords.”

Installing a program makes a copy. In Vernor v. Autodesk, Inc., 621 F.3d 1102 (9th Cir. 2010), a case about resold copies of design software, the court held that buyers who did not own their copies infringed because “when they install Release 14 on their computers, the copies of the software that they make during installation infringe Autodesk’s exclusive reproduction right because they too are not entitled to the benefit of the essential step defense.”

Federal law gives a narrow safe harbor to owners. Under 17 U.S.C. § 117(a), “it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program” when the new copy “is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner.” That protection belongs to an owner of a copy. In Vernor, the Ninth Circuit held that “a software user is a licensee rather than an owner of a copy where the copyright owner (1) specifies that the user is granted a license; (2) significantly restricts the user’s ability to transfer the software; and (3) imposes notable use restrictions.” A federal court in Minnesota follows the Eighth Circuit and the U.S. Supreme Court, not the Ninth Circuit. The three features Vernor weighed are still the terms to look for in your own licenses.

When does exceeding a license become infringement instead of a contract breach?

Exceeding a license is copyright infringement when the company does something copyright reserves to the owner, such as making copies, outside what the license grants. When the overuse involves no such act, the owner’s claim is for breach of the license contract.

The Eighth Circuit drew that line in National Car Rental System, Inc. v. Computer Associates International, Inc., 991 F.2d 426 (8th Cir. 1993). The software owner had licensed programs “to process National’s data on National’s hardware in Bloomington, Minnesota,” limited to the licensee’s internal operations. It alleged that the licensee processed data for other companies. Reviewing a dismissal on the pleadings, where no distribution of copies was alleged, the court explained: “Rather than stating a rule that any use exceeding the license is infringing, these cases establish that engaging in one of the acts reserved to the copyright holder under § 106, without a license to do so, is infringing.” It held the contract claim could proceed: “We conclude that the alleged contractual restriction on National’s use of the licensed programs constitutes an extra element in addition to the copyright rights making this cause of action qualitatively different from an action for copyright.” The court left open whether a contract claim based on copying itself would be preempted.

When copying is involved, the question becomes whether the broken term limits the license’s scope (a condition) or is only a promise (a covenant). In Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008), the court, applying Ninth Circuit and California law on an appeal from a denied preliminary injunction, stated: “If, however, a license is limited in scope and the licensee acts outside the scope, the licensor can bring an action for copyright infringement.” It also noted that “Under California contract law, “provided that” typically denotes a condition.”

The starting presumption treats license terms as promises. In Bitmanagement Software GmbH v. United States, 989 F.3d 938 (Fed. Cir. 2021), license terms were “presumed to be covenants, rather than conditions,” “unless it is clear that a condition precedent was intended.” The court added: “Unlike payment, which is typically considered a covenant.” There, the Navy installed licensed software across its network under an implied license that depended on license-tracking software, and the tracking did not work. The court held: “The Navy’s failure to comply creates liability for infringement.” The case was a claim against the United States under 28 U.S.C. § 1498(b), which makes “an action by the copyright owner against the United States in the Court of Federal Claims” the exclusive remedy. On remand, the trial court valued the license the parties would have negotiated at $154,400. In 2025 the Federal Circuit affirmed that award and rejected a per-copy demand of more than $85 million.

Accepting a license by clicking, rather than by signing, is not by itself a ground to deny the license effect. Under Minn. Stat. § 325L.07, “A contract may not be denied legal effect or enforceability solely because an electronic record was used in its formation.”

The Eighth Circuit applied a click-through license in Davidson & Associates v. Jung, 422 F.3d 630 (8th Cir. 2005). There, installation required a user to select a button with the text “I Agree.” The Eighth Circuit affirmed judgment for the software owner, writing that “By signing the TOUs and EULAs, Appellants expressly relinquished their rights to reverse engineer,” though on appeal the defendants pressed only a preemption argument against the contract claims. More on how these agreements are built is in end-user license agreement terms.

How much can a software company recover for unlicensed copies?

A software owner that proves infringement in court can recover either its actual damages plus the infringer’s additional profits, or, if the program was registered in time, statutory damages within a range the statute sets. A court may also order the use to stop, and with timely registration it may award attorney fees.

Under 17 U.S.C. § 504, the infringer is liable for “actual damages and any additional profits of the infringer,” or, at the owner’s election, statutory damages. The statutory award is “for all infringements involved in the action, with respect to any one work,” “in a sum of not less than $750 or more than $30,000 as the court considers just.” That range counts works, not copies. Fifty unauthorized installations of one program are infringements of one work for statutory damages, though the number of copies can still drive actual damages.

The range moves with the infringer’s state of mind:

• Willful infringement. If the owner proves it, “the court in its discretion may increase the award of statutory damages to a sum of not more than $150,000.”
• Innocent infringement. If the infringer proves it “was not aware and had no reason to believe that his or her acts constituted an infringement of copyright, the court in its discretion may reduce the award of statutory damages to a sum of not less than $200.”
• Copyright notice. Under 17 U.S.C. § 401(d), if a notice in the statutory form appeared on published copies the company had access to, “then no weight shall be given to such a defendant’s interposition of a defense based on innocent infringement in mitigation of actual or statutory damages.” I suggest checking the program’s installer and About screen for a © notice, because it can remove the innocent-infringement reduction.

Registration timing limits two remedies. Under 17 U.S.C. § 412, “no award of statutory damages or of attorney’s fees, as provided by sections 504 and 505, shall be made for” “any infringement of copyright commenced after first publication of the work and before the effective date of its registration, unless such registration is made within three months after the first publication of the work.” The statute’s opening clause excepts “an action for infringement of the copyright of a work that has been preregistered under section 408(f) before the commencement of the infringement and that has an effective date of registration not later than the earlier of 3 months after the first publication of the work or 1 month after the copyright owner has learned of the infringement,” and 37 C.F.R. § 202.16 lists “Computer programs (including videogames)” among the classes eligible for preregistration. I suggest checking the current text of § 412 before relying on that window, because the statute controls over any summary. Under 17 U.S.C. § 505, “the court may also award a reasonable attorney’s fee to the prevailing party as part of the costs,” which can run in either direction. Under 17 U.S.C. § 502(a), a court may “grant temporary and final injunctions on such terms as it may deem reasonable to prevent or restrain infringement of a copyright.” The same remedies apply to other copied material, as covered in using copyrighted content without permission.

Why do cracks and license-key workarounds create separate liability?

Bypassing a license key or activation check can violate the federal anti-circumvention law even apart from any copying. Under 17 U.S.C. § 1201(a)(1)(A), “No person shall circumvent a technological measure that effectively controls access to a work protected under this title.” That rule is subject to the statute’s exemptions, discussed below.

To “circumvent” includes acts that “avoid, bypass, remove, deactivate, or impair a technological measure, without the authority of the copyright owner.” A key generator or a patched executable that skips activation is the kind of tool that question reaches. In Davidson, the Eighth Circuit found that “Blizzard games, through Battle.net, employed a technological measure, a software “secret handshake” (CD key), to control access to its copyrighted games.” The emulator the defendants there developed and distributed “allowed the Blizzard game to access Battle.net mode features without a valid or unique CD key,” and the court affirmed summary judgment against them on the circumvention claims.

The civil remedy is separate from infringement damages. Under 17 U.S.C. § 1203, “Any person injured by a violation of section 1201 or 1202 may bring a civil action in an appropriate United States district court for such violation.” The owner “may elect to recover an award of statutory damages for each violation of section 1201 in the sum of not less than $200 or more than $2,500 per act of circumvention, device, product, component, offer, or performance of service, as the court considers just,” instead of its actual damages and the violator’s profits. The court “may reduce or remit the total award” where the violator proves it “was not aware and had no reason to believe that its acts constituted a violation.” The statute also has exemptions, including classes of works the Librarian of Congress designates and an interoperability exception, but they are narrow and each has its own conditions.

I suggest removing cracked copies and key generators from company machines once you have recorded what was installed, because each act of circumvention is a separate violation under § 1203.

When can unlicensed software use become a crime?

Willful copyright infringement that meets one of the statute’s conditions is a federal crime, and willful circumvention of a license check for gain is a separate one. Minnesota’s computer crime law separately reaches anyone who “intentionally and without authorization or claim of right accesses or copies any computer software or electronic data and uses, alters, transfers, retains, or publishes” it. It also reaches anyone who “intentionally retains copies of any computer software or electronic data beyond the individual’s authority.”

Under 17 U.S.C. § 506(a), “Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18” if the infringement was committed in one of three ways. Two of them fit a business setting:

• “for purposes of commercial advantage or private financial gain”; or
• “by the reproduction or distribution, including by electronic means, during any 180–day period, of 1 or more copies or phonorecords of 1 or more copyrighted works, which have a total retail value of more than $1,000.”

Under § 101, “financial gain” “includes receipt, or expectation of receipt, of anything of value.” Willfulness takes more than copying: “evidence of reproduction or distribution of a copyrighted work, by itself, shall not be sufficient to establish willful infringement of a copyright.” For a first offense under § 506(a)(1)(A), 18 U.S.C. § 2319(b)(1) allows imprisonment of “not more than 5 years” or a fine where the offense involves, “during any 180-day period, of at least 10 copies or phonorecords, of 1 or more copyrighted works, which have a total retail value of more than $2,500.”

Circumvention carries its own criminal provision: under 17 U.S.C. § 1204(a), “Any person who violates section 1201 or 1202 willfully and for purposes of commercial advantage or private financial gain” “shall be fined not more than $500,000 or imprisoned for not more than 5 years, or both, for the first offense.”

Minnesota’s statute is Minn. Stat. § 609.89, titled computer or electronic data theft. Under subd. 1, a person is guilty who:

• “intentionally and without authorization or claim of right accesses or copies any computer software or electronic data and uses, alters, transfers, retains, or publishes the computer software or electronic data”; or
• “intentionally retains copies of any computer software or electronic data beyond the individual’s authority.”

Under Minn. Stat. § 609.87, subd. 9, “computer software” means “a computer program or procedures, or associated documentation concerned with the operation of a computer,” and under subd. 2a, authorization means acting “with the permission of the owner of the computer, computer system, computer network, computer software, or other property.” Penalties under § 609.89, subd. 2, depend on the owner’s loss. They run from “not more than 90 days” or a fine of “not more than $1,000” up to “not more than ten years” or a fine of “not more than $50,000” where the loss is “in excess of $2,500.”

Federal preemption may limit how far § 609.89 reaches copying alone. In Rosciszewski v. Arete Associates, Inc., 1 F.3d 225 (4th Cir. 1993), a civil claim under Virginia’s computer crimes act for copying a program was “preempted to the extent that it is based on reproduction of the copyrighted computer program.” I have not located a Minnesota appellate decision applying § 301(a) to § 609.89.

Why is the company liable when an employee installed the software?

A claim over unlicensed software can run against the company, whoever clicked install, either as an infringer or as one liable for another’s infringement. Under 17 U.S.C. § 501(a), “Anyone who violates any of the exclusive rights of the copyright owner as provided by sections 106 through 122” “is an infringer of the copyright.”

Copyright law also recognizes liability for another’s infringement. Metro-Goldwyn-Mayer Studios Inc. v. Grokster, Ltd., 545 U.S. 913 (2005) was a case against distributors of file-sharing software. In it, the U.S. Supreme Court said that one “infringes vicariously by profiting from direct infringement while declining to exercise a right to stop or limit it.” The two elements are a benefit from the infringement and a right to stop or limit it, and both turn on facts such as who owns the computers and who sets the rules for what runs on them.

Two patterns deserve attention. The first is the employee’s personal account. In a video for business owners, I explained that software an employee uses for work may be licensed to the employee, which leaves the question whether that license covers the company and whether the company can keep using it after the employee leaves. That video, on employees using their own software accounts, covers the access problems as well. The second is buying from the wrong seller. I have seen companies pay for an image license from a seller that had no right to grant it, and merely paying for a license is not enough. A cheap license key from an unknown seller carries the same risk.

How should a company respond to a software audit request or demand letter?

Start with the license, then measure the exposure on both the contract and the copyright side before you answer. The license decides what the vendor may inspect, and federal copyright law decides what a court could award if the matter is not resolved.

I suggest these steps, in this order:

1. The audit clause. A license may give the vendor a right to audit, with notice, timing, and cost terms, so the clause sets what you owe the vendor during the audit. The contract side is covered in audit rights.
2. A record of what is installed. Install counts, user counts, versions, and purchase records are what both sides will price. A record made before anything changes shows the facts as they stood.
3. The vendor’s registration. The U.S. Copyright Office Public Records System (publicrecords.copyright.gov) shows whether and when a program was registered. Under 17 U.S.C. § 411(a), “no civil action for infringement of the copyright in any United States work shall be instituted until preregistration or registration of the copyright claim has been made in accordance with this title.” The registration date, and any preregistration, also controls statutory damages and fees in a court action under § 412.
4. Both prices. The cost of licenses for the use you actually had is one number, and the § 504 ranges above are the other. Before the Copyright Claims Board, under § 1504(e)(1)(A)(ii)(II), for “works not timely registered under section 412, but eligible for an award of statutory damages under this section, statutory damages may not exceed $7,500 per work infringed, or a total of $15,000 in any 1 proceeding.” Statutory damages count works, not installations.
5. The deadline. Section 507(b) of the Copyright Act sets a limitations period for civil suits, and the license may set its own deadlines for disputes.
6. A written settlement. A settlement should include a release of past use, because without one the vendor keeps its claim over the copies already made. The terms to look for are covered in settling a copyright infringement claim.

The forum depends on the claim. Under § 1338(a), no state court has jurisdiction over a copyright claim. A copyright owner may also file an infringement claim with the Copyright Claims Board under 17 U.S.C. § 1504(c)(1). Under 17 U.S.C. § 1506(i), a properly served respondent that does not opt out in time “shall be bound by the determination in the proceeding to the extent provided under section 1507(a).” A claim that the company broke the license is a contract claim, and National Car Rental held such a claim over a use restriction was not preempted.

How do you bring a company’s software into compliance before a vendor asks?

Compliance means matching what is installed and used to what the company has the right to use, then closing the gap by buying licenses or removing copies. I suggest doing it on a schedule rather than waiting for a vendor letter, because buying licenses or removing copies for a gap you find yourself stops the unlicensed use before a vendor raises it.

1. Inventory. The starting point is a list of every program on company machines and every cloud account, with the number of installs and users.
2. Entitlements. Invoices, license certificates, and subscription records show what the company bought, and each license should be in the company’s name rather than an employee’s, because a personal license may not cover company use.
3. The gap. The company can buy what is short or remove the excess. Cracked copies and key generators should come off company machines, for the reasons in the circumvention section above.
4. Endings. When a license ends, the software should come off company machines unless its terms allow continued use. Minnesota’s § 609.89, subd. 1, reaches anyone who “intentionally retains copies of any computer software or electronic data beyond the individual’s authority.” Even an owner’s archival copy under § 117(a) is allowed only if “all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.”
5. Open source conditions. Code offered at no charge still comes with a license. In Jacobsen, the court held that “the terms of the Artistic License are enforceable copyright conditions.” For more on mixing open source into products, see open source licensing risk. For changes your developers make to licensed code, see derivative works in commercial software.
6. Company accounts. Licenses bought through company-owned accounts let the company keep access and proof of purchase when an employee leaves.

What should a Minnesota business do next about software licensing?

Commercial software comes with a license, and its terms set what copies and uses the company may make. Overuse that involves copying can bring federal copyright remedies, cracks add a separate circumvention claim, and Minnesota’s § 609.89 reaches intentional copying “without authorization or claim of right” when the copy is then used, altered, transferred, retained, or published, as well as intentional retention of copies beyond authority. A count of what you run against what you bought, done before a vendor asks, lets you buy or remove the difference on your own terms. Related questions on ownership, licensing, and enforcement are collected on the copyright practice page.

If you would like me to look at a vendor’s audit request or your license count and tell you where the exposure is, email [email protected] with a brief description of the software, the vendor, and what the vendor has asked for, and I can start an intake and conflict check before you send any confidential documents.