Is LinkedIn scraping legal?
There is no single yes or no, and this post is not legal advice. Whether collecting data from LinkedIn breaks a law depends on how it is collected, what is done with it and where. Three separate sets of rules apply at once, and a lead tool can run into any of them:
- LinkedIn's contract. Section 8.2 of LinkedIn's User Agreement (effective 3 November 2025) says members must not use software, including crawlers, browser plugins and add-ons, to scrape or copy the Services, including profiles. LinkedIn's help page on prohibited software and extensions says members who use such tools risk having their accounts restricted or shut down.
- US computer access law. In April 2022, the US Court of Appeals for the Ninth Circuit upheld a preliminary injunction in favour of hiQ Labs, a data analytics company. It found hiQ had raised serious questions about whether scraping public profiles, after LinkedIn sent hiQ a cease-and-desist letter, counted as access without authorisation under the federal Computer Fraud and Abuse Act. Later that year, LinkedIn says, the district court ruled that LinkedIn may enforce its User Agreement against scraping and fake accounts (4 November 2022), and hiQ agreed to a permanent injunction (6 December 2022).
- Privacy law. In an August 2023 joint statement, 12 data protection authorities, including the UK Information Commissioner's Office and the Office of the Privacy Commissioner of Canada, wrote: "Personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions."
So a profile being public does not settle the question, and LinkedIn's contract is not the only rule in play. If your prospecting depends on LinkedIn data, ask a lawyer in your jurisdiction. What you can do yourself, this week, is ask your vendors sharper questions. Three events from 2026 show which ones.
What did the court order in LinkedIn v. ProAPIs?
It permanently barred a data company, an affiliated company and their co-founder from scraping LinkedIn or selling LinkedIn data. On 16 September 2026, Judge P. Casey Pitts of the US District Court for the Northern District of California signed a final judgment on consent in LinkedIn Corporation v. ProAPIs Inc. (case 5:25-cv-08393, court docket). The defendants are ProAPIs Inc., a Delaware company; Netswift (SMC-Private) Limited, incorporated in Pakistan; and Rehmat Alam, whom LinkedIn's complaint names as co-founder and chief technology officer of both.
LinkedIn's complaint, filed on 2 October 2025, alleged that the defendants ran a network of fake accounts numbering in the millions to scrape member, company and school data, and rented out that scraping to customers paying up to $15,000 a month. The defendants never filed an answer. The parties told the court on 6 February 2026 that they had reached an agreement in principle, and the judgment records that the defendants deny liability.
The judgment permanently bars the defendants, and people acting in concert with them, from:
- accessing LinkedIn or its data through impersonation, fake accounts, scraping, crawling, bots or other automated technologies, or otherwise in breach of the User Agreement;
- offering, selling or giving away LinkedIn data, or information derived from it;
- selling or using services that provide LinkedIn data, create or operate LinkedIn accounts for others, or access LinkedIn's servers in an automated way;
- advertising the availability of LinkedIn data, getting around LinkedIn's technical access controls, and using LinkedIn's marks.
The defendants also certified, under penalty of perjury, that they had permanently deleted all LinkedIn data they obtained, destroyed reports made with it, and destroyed their scraping code and the SDKs and APIs used to deliver it. The judgment says it is final and may not be appealed. The defendants agreed to it while denying liability, and the case ended without a trial; the judgment's caption says no trial date was set.
What did HeyReach say after LinkedIn removed its page?
HeyReach said the removal of its LinkedIn page changed nothing for customers. On 25 March 2026, HeyReach, which describes itself as an outreach automation tool, published a note from its CEO, Nikola Velkovski. Velkovski wrote that LinkedIn had removed HeyReach's company page along with some of its executives' personal profiles (the CTO, CRO and CMO).
The note's main points, as HeyReach states them:
- The removal has zero impact on customers or the product, and campaigns keep running.
- "LinkedIn can't detect who uses HeyReach."
- LinkedIn has done the same to every major tool in HeyReach's space; the note names five, including Apollo, Lemlist and LGM.
- HeyReach does not create fake accounts, does not cross limits on messages, InMails or connections, and does not misuse data.
- The restrictions are temporary, and HeyReach expects to be back on LinkedIn.
HeyReach is not a party to the ProAPIs case, and nothing in that case's judgment names it. The note is also a fair example of a vendor telling customers quickly and in plain words what happened. It is HeyReach's own account, though, and we did not find a LinkedIn statement explaining the removal. The claim worth testing with any vendor is the one about detection, because of what LinkedIn told a federal court three months later.
What did the BrowserGate ruling decide?
It decided only standing: neither plaintiff had adequately alleged an injury of their own, so both privacy lawsuits over LinkedIn's extension scanning were dismissed as filed. It did not rule on scraping tools at all.
BrowserGate is a report by Fairlinked e.V., which describes itself as an association of commercial LinkedIn users. It alleges that LinkedIn's website checks visitors' browsers for installed extensions. BleepingComputer reported on 3 April 2026 that, in its own testing (the article gives no test date), a LinkedIn script checked for 6,236 browser extensions. LinkedIn told BleepingComputer that it looks for extensions that scrape data without members' consent or otherwise break its terms, and that it does not use the data to infer sensitive information about members.
In April 2026, Nicholas Farrell and Jeff Ganan filed proposed class actions against LinkedIn over the scanning. In its motion to dismiss, filed on 30 June 2026, LinkedIn told the court that it deploys browser-extension detection systems to identify software that could scrape or automate behaviour on LinkedIn. On 8 September 2026, Judge Vince Chhabria of the same court granted LinkedIn's motions: neither plaintiff alleged that their own extensions passed private information to LinkedIn, so neither had adequately alleged standing. Chhabria's amended order of 11 September kept the 14 days to amend and the remark that it seemed unlikely the plaintiffs could ever allege a privacy violation, and clarified that if they did not amend, the dismissal would not stop them refiling in state court.
As of 20 October 2026, the court dockets show a judgment entered in each case (Farrell, Ganan), and a notice of appeal to the Ninth Circuit filed in Ganan's case on 17 September 2026. We make no prediction about the appeal.
For buyers, the record matters more than the ruling. LinkedIn has said in a court filing that it looks for software that scrapes or automates activity on its site. Any vendor who tells you LinkedIn cannot see its tool is making a claim you have no way to check.
Five questions to ask any lead data or LinkedIn tool
Ask each vendor these five questions on the demo call, then ask for the answers by email. The good and worrying answers below are our own examples of what to listen for, not quotes from any vendor.
| Ask this | A good answer sounds like | A worrying answer sounds like | Why it matters |
|---|---|---|---|
| 1. Where does each field in your data come from, and how is it collected? | Names its sources field by field, says whether any of it comes from LinkedIn, and puts that in writing. | Calls its sources proprietary and stops there, or sells real-time LinkedIn profile data. | LinkedIn's complaint said the defendants openly offered real-time, detailed LinkedIn profile data. |
| 2. Do you log in to LinkedIn with accounts you create, rent or control? | No. It works only in your own account, or it does not touch LinkedIn at all. | Offers ready-made, rented or shared LinkedIn accounts to send from or search with. | The judgment bars ProAPIs from services that create or operate LinkedIn accounts for others. |
| 3. How does your tool interact with LinkedIn, and what happens to my account if LinkedIn restricts it? | Explains plainly whether it is an extension, a desktop app or a cloud service, admits LinkedIn's terms prohibit automation tools, and tells you what to do if you are restricted. | Promises LinkedIn cannot detect it, or that your account is completely safe. | LinkedIn told a court it detects extensions that could scrape or automate, and its help page says prohibited tools may stop working without notice. |
| 4. If you had to delete LinkedIn data tomorrow, what happens to the records I already have? | Can tell you which of your records depend on LinkedIn and what would change. | Says it could never happen, or cannot say what came from where. | The ProAPIs defendants certified that they deleted all LinkedIn data and destroyed reports made with it. |
| 5. What will you commit to in the contract, including how people can opt out? | Shares its terms and a data processing agreement, and shows how a person asks to be removed. | Reassurance on the call that never makes it into the contract. | Twelve privacy regulators said in 2023 that public personal data is still covered by privacy law in most jurisdictions. |
One answer alone rarely settles it. A vendor that answers all five plainly, and in writing, is giving you something you can check later. A vendor that dodges two or more is asking you to carry risk you cannot see.
What should a small team do this week?
Spend about an hour on it, before your next renewal date. These steps are our advice, not legal advice.
List every tool that touches LinkedIn or supplies contact data
Include browser extensions your team installed, enrichment tools and any list you bought. Note who owns each one and when it renews.
Send the five questions by email
Paste the table above into one email per vendor. Written answers are easier to compare and easier to hold a vendor to.
Tag records by source in your CRM
Add a field for where each lead came from. If a vendor has to delete data, you can find and remove what came from it in minutes.
Build more of your list from signals you can see yourself
People who comment on a post about your problem, change roles or start hiring are visible without bulk collection. Our guide to free buying signals lists 15 of them.
Take worrying answers to a lawyer
If a vendor will not say where its data comes from, or relies on accounts it controls, get advice for your jurisdiction before you renew.
The same questions apply to Siela. Our AI SDR does its LinkedIn work in your own signed-in browser inside the Siela desktop app, only while the app is open, and LinkedIn's rules on automation tools apply to it as they do to any other tool. Our post on whether LinkedIn automation is safe sets out what LinkedIn allows and where the account risk sits.
Frequently asked questions
Is it legal to scrape public LinkedIn profiles?
There is no single answer, and this is not legal advice. LinkedIn's User Agreement prohibits scraping. In 2022 the Ninth Circuit found hiQ had raised serious questions about whether US computer access law covers public profiles, but LinkedIn says hiQ later agreed to a permanent injunction. Privacy regulators say public personal data is still covered by privacy law in most jurisdictions. Ask a lawyer where you operate.
What did LinkedIn win against ProAPIs?
A final judgment on consent, signed on 16 September 2026 in the Northern District of California. It permanently bars ProAPIs, Netswift and co-founder Rehmat Alam from accessing LinkedIn through fake accounts, scraping or bots, and from selling LinkedIn data. The defendants deny liability, certified they deleted all LinkedIn data, and the judgment cannot be appealed.
Can LinkedIn detect browser extensions?
LinkedIn says it can detect some. In a June 2026 court filing it said it uses browser-extension detection systems to identify software that could scrape or automate activity. BleepingComputer reported in April 2026 that a LinkedIn script checked for 6,236 extensions in its test. LinkedIn's filing also says it does not detect every extension.
Did the BrowserGate ruling say LinkedIn's extension scanning is legal?
No. Judge Vince Chhabria dismissed both lawsuits in September 2026 because neither plaintiff adequately alleged being personally harmed, which is a question of standing. Chhabria did not decide whether the scanning is lawful. As of 20 October 2026, a notice of appeal had been filed in Ganan's case.
What happened to the data ProAPIs collected?
Under the consent judgment, the defendants certified under penalty of perjury that they had permanently deleted all LinkedIn data they obtained, destroyed reports and analyses made with it, and destroyed their scraping code and the SDKs and APIs used to deliver it. They are also barred from passing LinkedIn data, or information derived from it, to anyone.
Sources
- LinkedIn User Agreement (effective 3 Nov 2025), section 8.2 (checked 20 Oct 2026)
- LinkedIn Help: Prohibited software and extensions (checked 20 Oct 2026)
- hiQ Labs v. LinkedIn, Ninth Circuit opinion No. 17-16783 (filed 18 Apr 2022)
- LinkedIn newsroom: Court order affirms LinkedIn's legal positions against hiQ (published 4 Nov 2022)
- LinkedIn newsroom: hiQ agrees to permanent injunction (published 6 Dec 2022)
- Joint statement on data scraping and the protection of privacy (12 data protection authorities) (published 24 Aug 2023)
- LinkedIn v. ProAPIs: Final judgment on consent (N.D. Cal. 5:25-cv-08393) (signed 16 Sep 2026)
- LinkedIn v. ProAPIs: Complaint (filed 2 Oct 2025)
- LinkedIn v. ProAPIs: Joint stipulation to stay proceedings (filed 6 Feb 2026)
- CourtListener docket: LinkedIn v. ProAPIs (checked 20 Oct 2026)
- HeyReach: Quick update from Nick (CEO) (published 25 Mar 2026)
- BleepingComputer: LinkedIn secretly scans for 6,000+ Chrome extensions (published 3 Apr 2026)
- Farrell v. LinkedIn: LinkedIn's motion to dismiss (filed 30 Jun 2026)
- Farrell v. LinkedIn / Ganan v. LinkedIn: Order granting motions to dismiss (signed 8 Sep 2026)
- Farrell v. LinkedIn / Ganan v. LinkedIn: Amended order (signed 11 Sep 2026)
- CourtListener docket: Farrell v. LinkedIn (checked 20 Oct 2026)
- CourtListener docket: Ganan v. LinkedIn (checked 20 Oct 2026)
- Proskauer: Court finds hiQ breached LinkedIn's terms prohibiting scraping (published 11 Nov 2022)