Public Repository Perpetual Irrevocable User License

What it is

When you make a repository public on Hugging Face, every other user of the platform automatically receives a permanent, irrevocable license to use, copy, share, and build on your content, including models, datasets, and code.

Why it matters (compliance & governance perspective)

This license is perpetual and irrevocable, meaning that once a repository is made public, the license granted to all platform users cannot be withdrawn, even if the repository is later set to private or deleted.

Consumer impact (what this means for users)

Any model, dataset, or code published in a public Hugging Face repository is subject to a permanent, irrevocable license granted to all platform users, covering use, reproduction, distribution, and creation of derivative works; this cannot be undone after the fact.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates copyright law and intellectual property frameworks across jurisdictions, including the U.S. Copyright Act and EU Directive on Copyright in the Digital Single Market. For organizations subject to GDPR, datasets containing personal data published publicly may trigger irreversible data subject rights issues, as the irrevocable license to third-party users conflicts with the right to erasure under GDPR Article 17. The FTC Act is also relevant if the scope of this license is not sufficiently disclosed at the point of publication. GOVERNANCE EXPOSURE: High. The perpetual, irrevocable nature of the public repository license creates significant IP and data governance risk for organizations that publish proprietary models, training data, or research artifacts, whether intentionally or by misconfiguration. Once triggered, the license cannot be recalled through administrative action within the platform. JURISDICTION FLAGS: EU/EEA organizations face heightened exposure where published datasets include personal data, as the irrevocable third-party license may conflict with GDPR data subject rights obligations. U.S. organizations in regulated industries (healthcare, finance) should evaluate whether publishing model weights or datasets could expose sensitive or regulated information. California-based organizations should consider CCPA implications if consumer data is embedded in published datasets. CONTRACT AND VENDOR IMPLICATIONS: Procurement and vendor management teams should assess whether internal IP policies permit publication of models or datasets on public repositories under these terms. Standard enterprise IP protection clauses may be undermined if employees or contractors publish work product publicly on the Hub. Indemnification provisions in the Terms place responsibility for content on the user, not Hugging Face. COMPLIANCE CONSIDERATIONS: Organizations should implement repository visibility controls and access policies to prevent accidental public publication. Data governance teams should assess whether any datasets slated for Hub use contain personal data that would conflict with GDPR Article 17 or similar erasure rights if published publicly. Legal teams should review whether existing IP assignment or confidentiality agreements with employees or contractors address platform publication scenarios.

Applicable agencies

Provision details

Other risks in this policy

• Hugging Face Content License Grant medium
• Unilateral Service Modification and Discontinuation high
• Terms Modification with 10-Day Notice medium
• Account Eligibility and Age Restriction medium
• Payment Terms and Pricing Adjustment medium
• Content Removal and Account Termination at Sole Discretion medium