Attribution

Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.

Overview

Attribution is a legal obligation that arises from many sources — open-source licenses, Creative Commons media, font licenses, API terms of service, data provider agreements, and more. Failing to provide required attribution can constitute license violation (risking license termination and copyright infringement claims), breach of contract, or regulatory non-compliance. Many companies underestimate attribution requirements because the obligation is spread across dozens of different asset types, each with its own rules.

Attribution by Asset Type

Open-Source Attribution

Open-source attribution is the most common and most frequently violated attribution requirement in software.

What Most OSS Licenses Require

NOTICE File Structure

The standard approach for bundling attribution in a distributable product:

NOTICE

This product includes software developed by third parties.

================================================================================
Library: react
Version: 18.2.0
License: MIT
Copyright (c) Meta Platforms, Inc. and affiliates.
================================================================================

================================================================================
Library: lodash
Version: 4.17.21
License: MIT
Copyright JS Foundation and other contributors
================================================================================

================================================================================
Library: express
Version: 4.18.2
License: MIT
Copyright (c) 2009-2014 TJ Holowaychuk
Copyright (c) 2013-2014 Roman Shtylman
Copyright (c) 2014-2015 Douglas Christopher Wilson
================================================================================

Automation Tools

Where to Display OSS Attribution

Creative Commons Attribution

Creative Commons licenses are common for media, data, and documentation.

Proper CC BY Attribution (TASL)

Creative Commons specifies the TASL format:

• •Title — name of the work
• •Author — creator name (linked to profile if available)
• •Source — URL where the work was found
• •License — license name linked to the license deed

Example:

"Sunset Over Mountains" by Jane Smith (https://example.com/photo/123)
is licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)

Font Licensing

Fonts carry their own licensing terms that are frequently overlooked.

Font Attribution Pitfalls

• •Web fonts loaded via Google Fonts CDN do not require separate attribution (Google's ToS handles it), but self-hosted Google Fonts do require including the license file.
• •Icon fonts (Font Awesome, Material Icons) have separate licenses for the font file vs the CSS/SVG — check both.
• •Custom font subsets may trigger modification clauses — OFL requires renaming modified fonts.

API and Service Attribution

Many APIs and services require visible attribution as a condition of use.

Always check the current Terms of Service. API attribution requirements change with ToS updates. What was optional last year may be mandatory now.

Data Source Attribution

Compliance Checklist

Best Practices

• •Always consult legal counsel when unsure about attribution requirements — getting it wrong can terminate your license to use the software.
• •Automate NOTICE file generation as part of your CI/CD pipeline — tools like license-checker, FOSSA, and go-licenses catch new dependencies automatically.
• •Maintain a central attribution register that tracks every third-party component, its license, and where attribution is displayed.
• •Include attribution in your release checklist — it is easy to add a dependency and forget to update the NOTICE file.
• •Check API Terms of Service on a scheduled basis — attribution requirements change with ToS updates without notice.
• •Do not strip copyright notices or license headers from source files — many licenses explicitly require preserving them.
• •Display attribution accessibly — a legal/licenses page that users can actually find, not buried in an invisible footer.
• •Treat font licenses as seriously as code licenses — font piracy lawsuits are common and penalties can be per-seat or per-pageview.