If Camellia is of equivalent security and speed to AES, concerns arise.
First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does that mean that Camellia is currently more secure than AES, or is this a result of the lack of research on the cryptanalysis of the cipher?
There are a variety of reasons why AES is more widely used:
AES is a standard.
AES has been vetted by cryptanalysts more extensively than Camellia. As a result, we can have greater confidence in the security of AES than in Camellia. Therefore, on the merits, there may be good reasons to choose AES over Camellia.
AES is a government standard (FIPS). Government procurements may be required to comply with applicable government standards. Therefore, when selling to the government, AES may be required; if so, Camellia isn't an acceptable substitute.
AES is a industry standard. No one will get fired for using AES. If (say) Apple uses AES, and AES gets broken, the newspaper headline won't be about Apple; it'll be about flaws in something everyone is using. On the other hand, if Apple uses Camellia and Camellia gets broken, the newspaper headline will be about why Apple took it upon themselves to deviate from industry standard practice and how that led to a security breach in their systems. Therefore, aside from its merits, there's an incentive to choose the industry standard.
Camellia is patented. AES is unpatented and free for all to use, without patent encumbrances. Regardless of what licenses might be available, many people are a bit wary about any patented algorithm, due to uncertainty, IP risks, etc. If the unencumbered version is every bit as good, it's easier to use the unencumbered version. Also, it is possible that some open source crypto library developers may be less likely to implement Camellia, because of the potential patent situation or because of the reduced demand to the above factors, so standard crypto libraries are less likely to Camellia. Similarly, many standards bodies have a bias against patent-encumbered algorithms, when there are alternatives that are every bit as good; therefore, some standards bodies may be less likely to use Camellia when they standardize on network protocols that require crypto.
AES is entrenched. AES is a brand name that is widely known and recognized. Also, AES is good enough. Camellia is newer, and the benefits of Camellia are unclear or not as well known. (In many contexts, Camellia has no obvious advantages, so a developer might not see any reason to adopt it instead of AES, if they already know and trust AES and consider AES adequate for their needs.) There's no shortage of other block ciphers out there that could be considered, but if AES is good enough, there's not much incentive to use them.
As a bonus feature, AES has hardware support in Intel processors which implement the AES instruction set, with AMD support coming soon in their Bulldozer based processors.
The AES instructions set consists of six instructions.
Four instructions, namely AESENC, AESENCLAST, AESDEC, AESDECLAST, are provided for data encryption and decryption (the names are short for AES Encrypt Round, AES Encrypt Last Round, AES Decrypt Round, AES Decrypt Last Round). These instructions have both register-register and register-memory variants.
Two other instructions, namely AESIMC and AESKEYGENASSIST are provided in order to assist with AES Key Expansion (the names are short for AES Inverse Mix Columns, and AES Key Generation Assist).
This Intel document also goes into some other potential benefits of using their instruction set
Beyond improving performance, the new instructions help address recently discovered side channel attacks on AES. AES-NI instructions perform the decryption and encryption completely in hardware without the need for software lookup tables. Therefore using AES-NI can lower the risk of side-channel attacks as well as greatly improve AES performance
Maybe Camellia might get more popular after its patents did expire for good. It is "japanese-make" and the fareastern browser and server environments are widely using it. This is because Japanese people still live in a mind policy like "only japanese things are reliable or can be trusted" (umm... which isn't the case actually seen from more neutral standpoint, regarding "people" or "makers" because they are finally humans as well with all imperfections given to the human race) OR if its authors expicitely (officially and permanently!) step back and keep distant from any further claims including possible future fees or renewals of their patents in this algorithm. (and yes put it under opensource or the gnu terms after patent expiration - means making the source officially public to allow further vetting and maybe improval by the public audience and expertise). And making it a defined standard finally as well. Why only having one blockcipher standard (AES)? Ah, yes there is still another standard: ChaCha20 - which is made for streams.B
