Oracle’s licensing model for Java has changed. Java SE is no longer free for commercial use, and the pricing is no longer based on installations or actual usage.

Under Oracle’s current subscription model, licensing is calculated using a per-employee metric. This means every employee in your organization must be licensed – even if only a handful actively use Java, or some employees do not even have a device.

This shift has caught many organizations by surprise, leading to substantial, unbudgeted costs.

Oracle’s Java Sales team commonly proposes a five-year licensing agreement, presenting it as an opportunity to lock in pricing without indexation. However, many organisations are reluctant to commit to such long-term commitments, especially when licensing is required for every employee under the current model.

As part of the negotiation, sales representatives may offer to overlook past unlicensed usage, implying that if the agreement is declined, retrospective fees could be pursued.


Many organisations only become aware of their Oracle Java licensing obligations after being contacted by Oracle—often following download activity or system update checks that transmit usage-related metadata.

Oracle does not need to perform a formal audit to raise licensing concerns. When Java’s update feature is enabled (as it typically is for security purposes), the software automatically connects to Oracle servers to check for and download updates. These interactions share identifiable details—such as IP address, timing, and frequency – providing Oracle with enough insight to associate Java activity with your organization and initiate a compliance discussion.


This puts IT teams in a difficult position—balancing the need for secure, up-to-date systems with the risk of triggering unexpected licensing exposure. Although it is technically possible to disable Java’s automatic update feature to avoid detection, doing so is not recommended—and in practice, it is rarely done.  

Disabling updates creates avoidable security risks, leaving systems vulnerable to threats that updates are designed to patch. It may also conflict with internal IT policies, industry standards or cybersecurity requirements.

In short, avoiding detection can cause more problems than it prevents. A better approach is to gain proactive visibility – know where Java is used, how it is deployed and whether it genuinely requires licensing.

GDPR Data*
This field is for validation purposes and should be left unchanged.

ITAA helped us uncover licensing risks we were unaware of. Their expertise allowed us to quantify our exposure and make informed decisions about whether to remain with or transition away from Oracle Java. Thanks to their guidance, we significantly reduced costs and avoided unexpected compliance issues.

Oracle Java licensing can be complex and far-reaching. Whether you are exploring your options, responding to Oracle outreach, or planning a broader IT review, our team is here to help.

Speak with one of our specialists for clear, practical advice or request a personalized consultation to assess your organization’s position.

GDPR Data*