Pose Estimation Model Licenses: Which Can You Ship Commercially?

Choosing a model is the job of our pose model roundup. This page reads the paperwork: the LICENSE files, model cards and SDK terms as they stood on 2026-10-12, and what each lets a commercial fitness product do. It is not legal advice; confirm with counsel before you ship.

Three sets of terms, and the one you ship under#

A pose model can come with up to three separate sets of terms:

1. Code license: the LICENSE file in the repository.
2. Weights terms: the model card, or wherever the weights are hosted.
3. Service terms: for an SDK, its terms of service.

They can differ, and the one you need is the one covering what you actually ship: a bundled model file brings its card's terms, a closed SDK its service terms.

The layers, model by model#

The last column is our reading, not the vendor's.

MediaPipe and BlazePose GHUM 3D#

The google-ai-edge/mediapipe LICENSE file is the Apache License, Version 2.0, and the BlazePose GHUM 3D model card, dated April 16, 2021, says "LICENSED UNDER Apache License, Version 2.0". Code and weights agree.

The card's intended use is "3D full body pose estimation for single-person videos on mobile, desktop and in browser", and its domains include "Fitness and repetition counting" and "3D pose measurements (angles / distances)". Out of scope, it lists:

• multiple people in an image;
• people "further than 14 feet/4 meters" from the camera;
• a head that is not visible;
• "Applications requiring metric accurate depth";
• "Any form of surveillance or identity recognition is explicitly out of scope and not enabled by this technology".

Its ethical considerations add: "The model is not intended for human life-critical decisions. The primary intended application is entertainment."

These are model-card statements, not Apache license terms, and we are not saying whether they bind you. A fitness product should read them anyway: in our reading, angle-based form feedback sits inside the card's domains, and a feature needing metric-accurate depth does not.

MoveNet#

MoveNet is served through the pose-detection package, which lives in the tensorflow/tfjs-models repository; that repository's LICENSE file is the Apache License, Version 2.0. The weights have their own cards, and they differ:

• The MoveNet.SinglePose card covers Lightning and Thunder (17 keypoints), says "Licensed Under Apache License, Version 2.0", and puts multi-person use out of scope: "not intended for detecting poses of multiple people in the image".
• The MoveNet.MultiPose card covers up to 6 people, but the text we extracted from it has no license line.

That makes the package's MULTIPOSE_LIGHTNING type (up to 6 poses, per its README) the plainest layer problem on this page: Apache-2.0 code, and no license line in the extracted text of its card. Confirm MultiPose terms before you ship it commercially; our MediaPipe vs MoveNet head-to-head flags the same gap. The tfjs-models README links the weights on tfhub.dev, a host we could not reach, so we could not read any terms shown there.

Ultralytics YOLO pose#

The ultralytics/ultralytics LICENSE file is the GNU Affero General Public License, Version 3 (AGPL-3.0). The README calls AGPL-3.0 "perfect for students, researchers, and enthusiasts" and describes the Ultralytics Enterprise License as "For development and production use", covering "business products and services, including internal tools, automated workflows, and production deployments, bypassing the open-source requirements of AGPL-3.0." That includes internal tools, not only apps you ship.

The license text addresses networked use too. Section 13, "Remote Network Interaction": "if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge".

In our reading, keeping YOLO pose on your own server does not by itself take you outside AGPL-3.0; whether your pipeline counts as a modified version is a question for counsel. The README's Enterprise paragraph names "Ultralytics software and AI models" together, and we did not verify separate terms for the pretrained pose weights, so our recommendation is to treat code and weights as one licensing decision. We did not review Ultralytics' licensing page and have no price to report.

OpenPose#

The CMU-Perceptual-Computing-Lab/openpose LICENSE is headed "ACADEMIC OR NON-PROFIT ORGANIZATION NONCOMMERCIAL RESEARCH USE ONLY" and grants "a personal, non-exclusive, non-transferable license to use the Software for noncommercial research purposes, without the right to sublicense". It defines "Software" to include "all or any derivatives and/or modifications created or made by You". In our reading, a modified fork stays under the same noncommercial grant.

The README says "OpenPose is freely available for free non-commercial use" and points commercial users to a FlintBox link, CMU's licensing portal; no price is published in the repository. In our reading, a commercial fitness product needs that separate license. If it does not want one, see commercial alternatives to OpenPose.

MMPose and RTMPose#

The open-mmlab/mmpose LICENSE opens "Copyright 2018-2020 Open-MMLab. All rights reserved." and continues with the Apache License, Version 2.0. RTMPose lives in the same repository, under projects/rtmpose. We did not verify the terms for pretrained weights downloaded from OpenMMLab's hosts, so check them before you ship a checkpoint.

ML Kit Pose Detection: service terms, not a license#

Where MediaPipe gives you Apache-2.0 code and a model card, ML Kit Pose Detection is a closed SDK under service terms, and Google's Pose Detection page says: "This API is offered in beta, and is not subject to any SLA or deprecation policy." The ML Kit Terms of Service, last modified May 14, 2025, "incorporate and are subject to the Google APIs Terms of Service", and three parts matter for a fitness app:

• Models count as related software. The terms say "machine learning models will be considered related software" and "you may not reverse engineer or attempt to extract the source code or any related software". In our reading, the pose model is not yours to pull out and reuse.
• Input is processed on the device. Processing "fully happens on-device, and ML Kit does not send that data and the resultant outputs to Google servers".
• Usage metrics go to Google. The APIs "send metrics about the performance and utilization of the APIs in your app to Google", and "You are responsible for informing users of your app about Google's processing of ML Kit metrics data as required by applicable law."

Our recommendation: cover that disclosure duty in your fitness app privacy policy.

Apple Vision: no model file, no open-source license#

Apple's documentation lists VNDetectHumanBodyPoseRequest from iOS 14.0, macOS 11.0, tvOS 14.0 and visionOS 1.0, and VNDetectHumanBodyPose3DRequest from iOS 17.0 and macOS 14.0. The model ships inside the operating system, so there is no model file or open-source license to read; its use is governed by Apple's developer agreements, which we did not review for this page. API details are in Apple Vision body pose.

Apache-2.0 still has conditions#

Apache-2.0's section 2 grants "a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work". Section 4 attaches conditions to redistribution: give recipients a copy of the License; put prominent notices on files you modified; keep the copyright, patent, trademark and attribution notices; and if the Work includes a NOTICE file, include its attribution notices in a NOTICE file, the documentation, or a display such as an about screen.

In our reading, an app that bundles the library or a model file redistributes it, so ship a licenses screen with the license text and any NOTICE attributions.

Our recommendation#

• One user, on device: MediaPipe/BlazePose or MoveNet SinglePose, the two options here verified Apache-2.0 on both layers.
• Several people in frame: none of the multi-person models in our roundup (MoveNet MultiPose, YOLO pose, OpenPose) is verified Apache-2.0 on both layers, so settle the license before the architecture. Multi-person pose tracking covers the engineering.
• Inference on your server: not distributing a binary does not settle AGPL-3.0. On-device vs cloud pose estimation covers the wider trade-off.