Which license attaches to each Oracle binary you run, what Oracle already knows about your estate, which use is already covered by something you own, and the entitlement file that decides the band you settle in.
It means you can name the license document that attaches to every Oracle Java binary running in your estate, and show that your use sits inside that document. Nothing else counts as a position.
Most enterprises answer at the wrong level. They say they are on Java 17, or that they never bought anything from Oracle, or that their developers only use OpenJDK. None of those statements is a licensing position, because none of them names a document.
Answer those three for every installation and you have a position. Answer them for none of them and Oracle's account team gets to write your position for you.
The OTN License Agreement for Oracle Java SE does not say the software costs money. It says you may use it for four defined purposes and no others, and the four are narrower than most engineers assume.
Read the current text yourself before relying on any summary, including this one. Oracle publishes it at the OTN License Agreement for Oracle Java SE and revises it from time to time.
Java version numbers describe a specification level. Licenses attach to builds, and builds are published by different organizations under different terms.
An Eclipse Temurin 17 build, an Amazon Corretto 17 build, and an Oracle JDK 17 build all run the same bytecode. Only one of them can generate an Oracle invoice, and telling them apart requires opening the installation directory.
The four documents that decide Oracle Java exposure
| Document | What it covers | Production use at no charge |
|---|---|---|
| Binary Code License (BCL) | Oracle JDK 8 up to update 202, and earlier families | Yes, general purpose |
| Oracle Technology Network License Agreement for Oracle Java SE | Oracle JDK 8u211 and later, Oracle JDK 11, and Oracle JDK 17 updates after the cut over | No. Personal, development, and a listed set of approved uses only |
| No Fee Terms and Conditions (NFTC) | Oracle JDK 17 through 20 at release, and later LTS families at release | Yes, but only until Oracle moves that family off the terms |
| Java SE Universal Subscription ordering document | Everything you pay for, priced per employee | Not applicable. This is the paid path |
A fifth document sits outside Oracle's control. Third party OpenJDK builds ship under GPL version 2 with the Classpath Exception, which permits production use with no Oracle relationship at all.
The license is printed in the installation directory of the build itself, and it was fixed on the day Oracle published that build. Read the LICENSE file and the legal folder at the root of the JDK before you form any view.
The table below is the map most estates need. Treat the last row as the one that ends the argument permanently, because it removes Oracle from the transaction entirely.
| Build family | License at publication | Free for commercial production | What changes it |
|---|---|---|---|
| Oracle JDK 8u202 and earlier | Binary Code License | Yes, general purpose use permitted | Nothing. The license you accepted does not change retroactively. Applying any later Oracle 8 update does change it |
| Oracle JDK 8u211 and later Oracle 8 updates | OTN License Agreement for Oracle Java SE | No | Requires a Java SE Universal Subscription for general commercial use |
| Oracle JDK 11 Oracle builds | OTN License Agreement for Oracle Java SE | No | Oracle also published an Oracle build of OpenJDK 11 under GPL. The two are easy to confuse and carry opposite outcomes |
| Oracle JDK 17 through 20 at release | No Fee Terms and Conditions | Yes, including production and commercial use | The terms are time boxed. Oracle moved JDK 17 updates to OTN terms in September 2024, one year after JDK 21 shipped |
| Oracle JDK 21 and later LTS families | No Fee Terms and Conditions at release | Yes at release | The same clock applies. Verify the current position on Oracle's roadmap page before you rely on it for a 2026 renewal |
| Any third party OpenJDK build | GPL version 2 with the Classpath Exception | Yes | Nothing Oracle controls. Support is a separate commercial choice |
Oracle JDK 8 update 202 was the last public update released under the Binary Code License in January 2019. Update 211, released that April, was the first under the OTN terms.
Estates that froze on 8u202 and never patched again are, on the licensing question alone, in a defensible position. They are also five years behind on security, which is a different conversation and usually the more urgent one.
The failure mode we see most often is partial. A platform team standardized on 8u202, then a single application owner applied 8u333 to fix an issue in 2022, and that one installation converted the whole argument into a negotiation.
Oracle introduced the No Fee Terms and Conditions with JDK 17 in September 2021 and permitted commercial production use at no charge. The permission is bounded by a clock, not by the version.
Oracle's stated pattern is that a family stays on the no fee terms until one year after the next long term support release. JDK 21 shipped in September 2023, so JDK 17 updates published from September 2024 moved to the OTN terms.
Two consequences follow, and both are missed routinely. Updating a JDK 17 estate past that cut over point silently changes its license, and the same clock will apply to JDK 21 as soon as the following LTS family has been out for a year.
Because Oracle can and does adjust this policy, treat any date in this section as something to verify rather than something to assume. Oracle's own Java SE support roadmap and the No Fee Terms and Conditions text are the two pages that will show a change first.
Oracle published two Java 11 distributions. The Oracle JDK carried the OTN terms and generates a charge. The Oracle build of OpenJDK carried GPL version 2 with the Classpath Exception and does not.
Both came from oracle.com, both print Oracle Corporation in the release file, and both were widely deployed between 2018 and 2021 by teams that saw no meaningful difference. The LICENSE file is the only thing that separates them.
In practice this single distinction has moved seven figure claims. If your Java 11 estate is material, check the license text on every host before you concede a single installation.
Every argument on this page disappears if the binary is not Oracle's. GPL version 2 with the Classpath Exception carries no employee metric, no audit clause, and no renewal.
That is why the binary level inventory matters more than the contract review for most enterprises. A clean estate does not need a strong contractual position because it does not need a contract.
The migration mechanics, the distribution choice, and the realistic timeline are set out in our Java exit strategy guide and in the wider Oracle Java licensing pillar.
Open the installation directory and read three files. The banner printed by the runtime is useful as a first pass but it is not sufficient on its own.
This is the single most valuable hour of work in the whole exercise, because everything downstream depends on the answer being right.
Store the output of all three per installation. A screenshot is not evidence. A dated file with a hash is.
The first four are technical discovery problems. The fifth is an evidence problem, and it is the one Oracle opens with.
A list of hostnames and version numbers is not an inventory. It is a spreadsheet that will be picked apart in the first call.
Oracle knows what was downloaded from its own site under accounts registered on your email domains, and it can observe update check traffic from your endpoints. It does not know what is installed where.
Understanding that asymmetry is the whole game. Almost every opening letter is written to close the gap between what Oracle can prove and what Oracle suspects, using information you supply.
Oracle requires an account to download most Java artifacts. Those records persist, they are tied to the email domain used to register, and Oracle's licensing organization has access to them.
A download record is not proof of commercial production use. It is proof that somebody at your company accepted a license agreement, which is enough to open a conversation and enough to make a denial expensive.
Oracle Java installations on Windows and macOS check Oracle servers for updates by default. That traffic carries version and platform information and originates from your public addresses.
Blocking that traffic at the perimeter is sensible hygiene. Doing it the week after a letter arrives looks like exactly what it is, so the time to do it is now.
Oracle cannot see your installation count, your host names, your employee number, or your organizational structure. Every one of those appears on the first information request for that reason.
Read any opening request as a shopping list of the things Oracle needs from you in order to build a number. Then decide, deliberately and in writing, which items you are contractually obliged to provide.
The evidence asymmetry, in one table
| Oracle already has | Oracle needs you to supply |
|---|---|
| Download records tied to your email domains | Installation counts and host inventories |
| Update check telemetry from your public addresses | Your total employee number and how you counted it |
| Your support ticket history on Oracle products | Which applications depend on Java and who owns them |
| Public filings, job adverts, and press coverage | Subsidiary and affiliate structure across the group |
Everything in the right hand column is voluntary until a contractual audit clause makes it otherwise. Establish which clause applies before you answer.
Java that arrives inside an Oracle product you are licensed for is usually covered for that product's use, at no incremental charge. The entitlement is real, it is narrow, and it is where the most valuable arguments live.
Two thirds of the value in a well run Java review comes from moving installations out of the chargeable population, not from negotiating the rate on the ones that remain.
The entitlement covers the product, not the machine and not the company. A JDK installed for WebLogic that also runs a scheduled internal batch job has left the boundary.
This is the most common finding in a real review and it is easy to fix before anyone asks. Separate the runtimes, document which installation serves which product, and stop sharing a single JDK across a licensed product and an unlicensed one.
Legacy perpetual licenses carry the same discipline problem. They are valid for the quantities and metrics on the original ordering document, and support lapsed long ago, so they cover a fixed historical footprint rather than today's estate.
Seven artifacts, assembled before anybody contacts you, held by one named owner, and refreshed on a fixed cadence. That file is the difference between a two month conversation and a two year one.
The point is not to be perfect. The point is to be able to answer any question in a single working day with a document that already existed.
Artifact six is the one enterprises leave until last and it is the one that decides the invoice. Our guide to the employee metric covers the counting method and the edge populations in detail.
One named owner in procurement or software asset management, with a standing quarterly refresh and a hard rule that the binary inventory reruns after any major platform change. Shared ownership means no ownership.
The refresh matters more than the initial build. An entitlement file assembled once and left alone is worse than useless in month eighteen, because it invites confident statements that are no longer true.
| Artifact | Owner | Refresh cadence | Test that it is real |
|---|---|---|---|
| Binary inventory | Platform engineering | Quarterly and after any platform change | Pick three hosts at random and reproduce the entry in ten minutes |
| License text library | Software asset management | Annually, and whenever a new build family appears | Every build family in the inventory has a matching dated text |
| Entitlement register | Procurement | At every Oracle transaction | Each restricted use claim points at a specific ordering document |
| Employee number and method | Finance or human resources | Annually, and at any acquisition or divestment | Two people reproduce the same number from the same written method |
| Written position | Legal | Annually, or on any material change | Counsel has read it in the last twelve months |
The common advice is to start with a discovery scan of the estate. That is the second step, not the first, and running it first regularly costs enterprises money.
A discovery scan run before you have decided the questions you are answering produces an undifferentiated list of every Java looking thing on the network. It mixes Oracle and OpenJDK, production and laboratory, owned and vendor supplied.
That list then becomes an internal document that exists, that somebody will eventually share, and that overstates the chargeable population by a wide margin. We have seen a first pass scan report used verbatim as the basis of an Oracle claim because a well meaning engineer attached it to an email.
The right first step is the license map. Decide which build families you care about and what evidence distinguishes them, then scan for exactly that. The scan becomes a targeted evidence gathering exercise rather than a liability you created yourself.
The bill scales with your headcount, not with your Java footprint, so the cost of a wrong position is set by how large the company is rather than by how much Java it runs. That is the whole design of the current metric.
The arithmetic is unforgiving and it is worth doing out loud before anyone asks you for a number.
A manufacturer with 5,000 employees runs Oracle Java on 40 servers and nowhere else. Under the Java SE Universal Subscription metric it pays for 5,000 employees, not for 40 servers.
At the published tier of $10.50 per employee per month that is $52,500 a month, or $630,000 a year at list, before any discount.
The same 40 servers under the retired per processor model would have been a five figure annual number. The deployment did not change. The metric did.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
Oracle Java licensing is not decided by what you deployed. It is decided by which text was inside the folder on the day you installed it, and by whether you can still show that text.
Size the forward number yourself before the first call. The Oracle Java license calculator takes a headcount and returns the list exposure, and the tier pricing worked example shows where the band edges sit.
If a formal notice has already arrived, stop reading here and go to the GLAS formal notice response guide, then the Java audit defense playbook and the supporting audit defense kits.
For a documented outcome at scale, the Illinois manufacturing case study sets out how a 5.35 million dollar exposure was worked down, and the wider Oracle knowledge hub holds the rest of the cluster.
White Paper · Oracle
The Oracle Java Audit Defence Playbook
What the Universal Subscription really costs and how buyers push back. Read it free.
Ongoing coverage across renewals, audits and migrations sits inside the Vendor Shield subscription, which includes Oracle Java in every tier.
Some Oracle Java builds are free for commercial production and some are not, and it depends on the build rather than the version. Oracle JDK 8u202 and earlier, plus any family still inside the No Fee Terms window, are free. Oracle JDK 8u211 and later, Oracle JDK 11, and post cut over JDK 17 updates are not.
Read the LICENSE file and the legal folder at the JDK root. An OTN or No Fee Terms text means Oracle terms, while GPL version 2 with the Classpath Exception means an OpenJDK build and no Oracle obligation. Record the file, a hash, and the collection date.
Yes, if the download used an Oracle account, and Oracle's licensing organization can query those records by email domain. A download record proves that somebody accepted a license, not that your company ran the software commercially. It is enough to open a conversation, which is why it appears in so many first letters.
Yes, you need to be able to prove it, because Oracle will not take the assertion on trust. Capture the release file and license text from a sample of every build family and keep the evidence dated. Also check third party applications and container images, since those are where Oracle binaries arrive without anyone choosing them.
Yes, perpetual Java SE Advanced, Advanced Desktop and Suite licenses survived Oracle withdrawing them from sale. They cover the quantities and metrics on the original ordering document and nothing beyond it. Treat them as a fixed historical footprint, and check the detail in our Oracle Java licensing pillar.
No, a WebLogic Server license carries a restricted use entitlement to the Java SE that WebLogic requires. The entitlement covers that product's use only, so the moment the same JDK also serves an unrelated application the restricted use argument fails. Keep the runtimes separate and document which installation serves which product.
An audit right is contractual, so with no signed Oracle agreement covering Java, Oracle has a copyright claim rather than an audit right. That changes what you must hand over. Our guide to the GLAS formal notice shows how to test which agreement a letter relies on.
Four to eight weeks for a mid sized enterprise that starts before any contact, and considerably longer under a response deadline. The binary inventory is the long pole, particularly on developer machines and build infrastructure. Starting cold after a formal notice removes most of your options and all of your leverage.
Only after establishing that the chargeable population is real, because the subscription is priced on your total workforce rather than your Java estate. Buying to end a conversation converts a one time question into a permanent cost that grows with headcount. Size it first with the license calculator.
The full buyer side response framework. The first letter to LMS, the data perimeter, the OpenJDK transition timeline, and the negotiation choreography that has reduced publisher claims by an average of fifty eight percent across more than forty live engagements since 2023.
Forty eight pages. PDF. Used in the largest Java audit settlements of 2025 and 2026.
The standard reseller pitch is that the Universal Subscription is the safe choice because it covers everything and avoids audit risk. We disagree. In our engagement experience, the Universal Subscription is the most expensive answer in roughly seven out of ten enterprise estates we have modeled. Run the estate sweep first, isolate Oracle Java to workloads that require Oracle support, migrate everything else to a free OpenJDK distribution, and only then negotiate the residual.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
The publisher opened at twenty seven million per year. We closed at four million per year on a defensible scope, with a no audit covenant and a price cap on growth. Redress did the work that our procurement team did not have the inside experience to run.
