No license is not public domain

random-address is a Python library that hands out real US addresses to use as test data. It makes one promise: every address is in the public domain. Not “open”, not “free”: public domain, so whoever uses them inherits no obligation at all.

Recently I wanted to widen its coverage. The dataset had 20 states and 31 were missing. The data exists: OpenAddresses collects the addresses published by state governments, counties and cities, and has sources for almost the whole country. It looked like a job of importing and moving on.

It turned into a licensing audit, and most of what I found could not be used.

The rule that makes everything else hard

Before the numbers, the rule, because it is what makes this work slow:

The absence of a license is not public domain. It is unknown.

A dataset published on a government portal with no license statement gives you permission for nothing. Maybe the government claims no rights, maybe it does, maybe the data comes from a private vendor under its own contract. If it does not say, you do not know, and if you do not know you cannot redistribute it with a promise that it is public domain.

With that rule, reviewing each source comes down to one question: does the publisher say, somewhere verifiable, that this is in the public domain?

What I found

With the help of agents working in parallel, I went through the configuration file of every OpenAddresses source in the 31 missing states: more than 800 sources. For the promising ones I went to the original publisher and read their terms.

The result, broadly:

• Most declare no license. Neither in OpenAddresses nor on the source portal. Sometimes there is a disclaimer (“data is provided as is”), which is not a license.
• Many require attribution (CC BY) or share-alike (ODbL). They are open, but they are not public domain: they place an obligation on whoever uses them.
• Some restrict use in ways you would not expect from public data: “internal or personal use only”, “may not be sold without a written agreement”.
• Nine states passed: Illinois, Idaho, Louisiana, Indiana, Ohio, Pennsylvania, South Carolina, New Mexico and Minnesota.

Nine out of 31. And the interesting part is not the ratio, but where the license was in the ones that passed.

The aggregator is not the source

In six of the nine cases, the valid license was not on the copy OpenAddresses uses, or there was no copy at all. The publisher had dedicated the data to the public domain, just somewhere else:

• Ada County, Idaho. The source OpenAddresses uses is the City of Boise’s, licensed CC BY 4.0. But the county itself publishes its address points on another service, licensed CC0. Same data, different publisher, different license.
• Cook County, Illinois. OpenAddresses points at a map server with no license. The same county publishes the dataset on its open data portal, marked public domain, with 1.38 million addresses including Chicago.
• Columbus, Ohio. The OpenAddresses source points at a city service with no license. The same city publishes another address point layer with a line that leaves no doubt: “This data is dedicated to the public domain under the Creative Commons Universal License (CC0).”

It goes the other way too. For New Mexico, OpenAddresses marks the statewide source attribution: true, which is more conservative than the publisher: the metadata says Use Constraints: None, and the site’s policy says its information is public domain unless otherwise indicated; citation is “appreciated”, not required.

Iowa was the opposite, and it is the scariest case. OpenAddresses labels dozens of county sources “Public Domain”, but I found nothing on the counties’ side to back that up: either the license field is empty or the source server no longer responds. The label exists only in the aggregator. I did not use them.

The lesson is that an aggregator’s summary is a starting point, not evidence. The license is whatever the publisher says.

Where to look

Nearly every local government in the US publishes with one of three technologies, and each keeps the license in a different place. Knowing where to look turns an afternoon of clicking through portals into a single request.

ArcGIS (Esri), the most common. Each dataset is an “item” with a licenseInfo field:

import json
import urllib.request

def arcgis_license(item_id: str) -> str:
    url = f"https://www.arcgis.com/sharing/rest/content/items/{item_id}?f=json"
    with urllib.request.urlopen(url) as response:
        item = json.load(response)
    return item.get("licenseInfo") or "(empty)"

An empty licenseInfo is the most common answer, and it means what it looks like: there is no license.

Socrata (the data.<city>.gov portals). Each view has metadata with a license field:

def socrata_license(domain: str, view_id: str) -> object:
    url = f"https://{domain}/api/views/{view_id}.json"
    with urllib.request.urlopen(url) as response:
        return json.load(response).get("license")

socrata_license("datacatalog.cookcountyil.gov", "78yw-iddh")
# {'name': 'Public Domain'}

FGDC metadata, the federal standard, usually shipped as XML next to the shapefiles. The fields that matter are useconst (use constraints) and distliab (distribution liability), and the public domain statement is sometimes buried in the second one, in the middle of a legal paragraph.

Phrases that look like public domain and are not

The hardest part was not finding the licenses but reading them. Several sources almost passed, and the “almost” is in the wording:

What it says	What it means
”No restrictions”	They do not restrict your use. It is not a public domain dedication.
”Free for public consumption”	Access costs nothing. It says nothing about redistribution.
”Citation requested, but not required”	Permissive in practice, but still not a dedication.
”Acknowledgement would be appreciated”	Fine next to an explicit dedication. Without one, not enough.
A disclaimer	Protects the publisher from claims; grants you nothing. Not a license.

New Jersey, Maine, Wisconsin, Indiana statewide, Ohio statewide, New York City and Seattle all landed in this zone. They can probably be used, but “probably” is not the promise the library makes. For any of them, the right move is to write to the publisher and ask them to confirm it in writing.

Why not take the shortcut

There is a much faster path. Aggregators offer tens of millions of addresses, ready to download, covering the whole country. A fork of my library did exactly that: a million addresses, all 50 states, tens of thousands of postal codes.

I looked at its data. It includes 12,699 addresses in Utah, a state for which I found no public domain source at all: the statewide one is CC BY 4.0, which requires attribution, and the rest declare no license. Wherever those addresses came from, they are not public domain, and the package gives no specific attribution; its record only says it includes “source-specific terms listed by” the aggregator. Anyone who uses them in a product inherits obligations they do not know about.

This is not a criticism of size. A million addresses is useful. It is that a test data library ends up in other people’s test suites, in their repositories, sometimes in their products, and the license travels with the data. If you cannot say for certain what license it carries, you cannot say anything.

How it ended up in the code

Two small changes make the rule independent of my memory.

The script I use to add addresses requires declaring the source’s license, and accepts only three values:

LICENSES = ("CC0-1.0", "PDDL-1.0", "public-domain")

parser.add_argument("--license", required=True, choices=LICENSES)

It has no default on purpose. Declaring it is the moment to go and read the publisher’s terms, and a CC BY or unlicensed source simply cannot be imported.

And each source is credited in the README, marking which ones came straight from the publisher’s portal rather than the aggregator’s copy, so anyone can repeat the check.

What I take away

Government open data looks public domain by nature, and it is not. Every county, city and state decides, and most decide nothing.

If you are going to redistribute open data, in a library, a dataset or a product, three questions before importing:

1. Where does the publisher state the license, not the aggregator?
2. Is it a dedication (CC0, PDDL, “public domain”) or only permission to access?
3. If it says nothing, am I willing to treat it as unknown?

The third one is the hard one. It means leaving out data that is good, complete and probably free. In my case it was 22 states. But the alternative is promising something you cannot back up, and in a library that exists precisely to be trustworthy, that promise is all there is.