Using free blocklists in a commercial product: what the licence allows
You want to ship filtering in a router, a DNS service, a firewall, a security app or a family app, and the free domain lists published online look like a quick start. This guide covers what you must check before one of them goes into a product you sell.
It is written for product managers, engineering leads and the people who sign off on third-party data.
The short version
- Using a free list on your own network is rarely a problem. Shipping it in a product means copying and distributing it to every customer.
- Each list's licence decides what you may do: some allow commercial use with credit, some require you to share changes, some forbid commercial use, some have no licence at all.
- A combined list carries the terms of every list it was built from.
- After the licence come upkeep, false blocks and the questions your customers' procurement teams will ask.
Using a list and shipping a list are different acts
The same file can be harmless on your office router and a licence breach inside your firmware. What changes is who receives a copy.
Your own network
You load a list into your own filter. Most free licences allow this, including many that forbid commercial redistribution.
Inside a product you sell
The list ships in firmware, an app or an appliance image. Every customer receives a copy, so redistribution and commercial terms apply.
As a hosted service
Customers use your cloud filter and never see the file. Some licences treat that as distribution and some do not, so the wording decides.
A category database licensed for the product you ship
Our database comes with an OEM licence that covers embedding the data in a product, so the right to ship is settled before your first release. The data is ours, which means one set of terms instead of one per list.
- 58 web filtering categories, each with one definition across the whole file.
- Newly registered domains categorized every day and delivered as delta files.
- Files and a lookup API that run inside your own systems.
Licence types you will find on free domain lists
Free lists use a handful of licence families. The family tells you roughly where you stand; the list's own licence file tells you exactly.
| Licence family | Usually allows | Usually asks of you | In a paid product |
|---|---|---|---|
| Permissive (MIT or BSD style) | Commercial use, changes and redistribution | Keep the copyright and licence notice with the copy | Workable, with credits |
| Public domain dedication | Almost any use | Nothing formal; credit is a courtesy | Workable, if every source is too |
| Attribution (Creative Commons BY) | Commercial use and changes | Credit the source, link the licence, say what you changed | Workable, with a credits page |
| Share-alike or copyleft (CC BY-SA, GPL) | Commercial use and changes | Versions you distribute must carry the same licence | Possible; your merged list may have to be shared |
| Non-commercial (CC BY-NC, "personal use only") | Personal and non-profit use | No commercial use at all | Not usable without a separate agreement |
| No licence stated | Reading it | Permission for anything else | Treat as not allowed until agreed in writing |
How strongly a list of domains is protected differs by country. A single domain name is a fact, but the selection of a list can be protected, and in the EU a separate database right can apply. Treat each licence as binding.
Combined lists inherit every upstream licence
Many popular free lists are built by merging dozens of smaller ones. The combined file's own licence usually covers the scripts that build it, not the entries it pulls in.
Combined list
One file, three sets of terms still attached to its entries
Your product
The strictest term in the mix decides what you may ship
One personal-use source inside a combined list can be enough to rule the whole file out of a paid product. Check the list of sources, then the licence of each.
Beyond the licence: four risks for a shipping product
A clean licence answers whether you may ship the list. These four decide whether you want to.
Upkeep you do not control
- Many lists are kept by one or two volunteers in their spare time.
- Updates are irregular, and some lists stop without notice.
- Your release cycle ends up depending on someone else's free evenings.
Nobody answers for a false block
- A customer's own site or a payment page on a list becomes your support ticket.
- You cannot fix the upstream file quickly, so you carry local overrides forever.
- Each override is one more thing to merge on every update.
Coverage with mixed definitions
- Free lists are strongest on ads, trackers and well-known threats.
- Content categories such as gambling, dating, AI tools or VPN services are patchy.
- Two lists rarely agree on what "adult" or "social" means, and a site in two categories fits neither.
Customer due diligence
- Enterprise buyers ask where your data comes from and what rights you hold.
- "A mix of public lists" invites a longer questionnaire.
- A named data licence answers the question in one line.
How the database handles upkeep and accountability
Licence holders get scheduled refresh deliveries, from quarterly to daily depending on the plan, plus newly registered domains categorized every day. Regular manual validations measure accuracy, and there is one team to contact about any row.
Why one ad list can break your customers' own tools
A free ad and tracker list blocks every entry the same way. Category data lets a product treat a pure ad network differently from an analytics service that a customer's own staff rely on.
Five domains that ad lists often carry, and what their categories let a product decide
These rows come from our data. Where a domain has a second category, a product can offer a work setting that keeps it open while a privacy setting blocks it.
| Domain | Categories in our data | What a product can do with that |
|---|---|---|
| doubleclick.net | Advertising/Marketing | Advertising only: block it in any ad-blocking tier |
| scorecardresearch.com | Advertising/Marketing | Advertising only: same treatment |
| hotjar.com | Advertising/Marketing, Business, Web-based Applications | Also a business web app: a work tier can keep it open |
| mixpanel.com | Advertising/Marketing, Web-based Applications | Product analytics a customer's own team may use daily |
| segment.com | Advertising/Marketing, Web-based Applications | A data tool behind many business apps; decide per tier |
A 12-point check before a free list ships
Run this for every list, and keep the answers with your release documents. It takes an afternoon per list and saves a recall later.
Find the licence file for the list and for every source it pulls from.
Confirm commercial use is allowed, in writing from the maintainer if the licence is unclear.
Note the attribution duty and where it must appear: documentation, an about screen or a credits page.
Check share-alike terms against how you merge lists and what you hand to customers.
Record the last update and how often the list really changes, not how often it promises to.
Find a maintainer contact and how they handle removal requests from site owners.
Measure overlap with your other lists to avoid duplicates and conflicting entries.
Test for false blocks against the sites your customers use most.
Plan local overrides you can ship faster than the upstream list changes.
Check the size against the memory and rule limits of your smallest device.
Keep the licence text for each list with the release that ships it.
Write the customer answer to "where does your filtering data come from?" before anyone asks.
Where free lists still fit, and where licensed data takes over
Most product teams end up with a mix. The useful question is which job each source does.
Free lists work well for
- Internal testing and prototypes that never reach a customer.
- Personal, research and non-profit projects within the licence.
- Security feeds whose licence allows commercial use, or that sell commercial terms.
- A second opinion when you investigate a single domain.
Licensed category data takes over for
- Content categories with one definition across every domain; see the 58 web filtering categories.
- Sites that belong in several categories at once.
- New domains categorized every day, not when someone reports them.
- A licence that names your use case, such as built-in router filtering or a SaaS product.
Moving a shipped product off free lists
If a product already ships with free lists, the move can be gradual. Customers should see better categories, not a broken update.
Inventory
List every free source in the product, its licence and the setting it powers.
Map settings to categories
Match each user setting to categories, so "Block adult content" keeps meaning the same thing.
Run both side by side
Compare decisions on real traffic for a release cycle and review the differences.
Switch and keep what fits
Move to the licensed data, keeping only free sources whose terms suit a paid product.
Export shapes such as hosts files, response policy zones and firewall lists are covered in DNS blocklist formats, and the lists by environment in which blocklists each network needs.
Free public lists next to a licensed category database
Judged as inputs to a product you sell, not as tools for one network.
| For a shipping product | Free public lists | Licensed category database |
|---|---|---|
| Right to ship it | Different terms for each list and each source | One OEM licence that covers embedding |
| Category definitions | Whatever each maintainer decided | 58 categories, one definition each |
| New domains | Added when someone reports them | Categorized every day, delivered as delta files |
| A site in two categories | On one list, or on none | Several categories where a site fits more than one |
| Where it runs | Wherever you copy the file | Files and a lookup API inside your own systems |
| Answer for procurement | A list of sources and licences | A named data licence from one supplier |
Free blocklists in products: frequently asked questions
Can I use a free blocklist in a commercial product?
Only if the licence of that list, and of every list it was built from, allows commercial use and redistribution. Some free lists do, often with an attribution duty; others forbid commercial use or have no licence at all.
Are lists of domains protected by copyright?
It depends on the country. A bare domain name is not protected, but the selection of a list can be, and in the EU a separate database right can protect lists that took substantial effort to build, so treat the licence as binding.
What does share-alike mean for a blocklist?
A share-alike or copyleft licence lets you use and change the list, but versions you distribute must carry the same licence. If you merge such a list into your own data, the merged result may have to be published under those terms.
What if a list has no licence?
In most countries no licence means no permission beyond reading it. Ask the maintainer for written permission before you copy it into a product.
Does running a hosted service count as distributing the list?
It depends on the licence wording. Some licences only cover copies you hand over, others treat offering the data over a network as distribution, so have counsel read the exact terms.
Do I have to credit the people who maintain a free list?
If the licence asks for attribution, yes, usually in your documentation or an about screen, with a link to the licence. Many teams keep one credits page for all the lists they use.
What does an OEM licence for category data cover?
Our OEM licence covers embedding the category data in a product you sell, delivered as files and a lookup API that run in your own systems. It does not allow resale or publication of the raw data.
This guide explains common licence terms in plain words. It is not legal advice: have your counsel read the licence of each list before it ships.
Starter database tiers begin at $999 for the 1 million most popular domains, and OEM licences for products are quoted per deployment. Bring a short description of your product and how it reaches customers, and we will scope the licence around it.
Ship filtering on data you have the right to use
Tell us what you build, where it runs and how it reaches customers. We will propose the files and an OEM licence that covers it.
Creative Commons is a trademark of Creative Commons Corporation. Licence names are used here only to identify the licence families discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by Creative Commons or by any maintainer of a public blocklist.