hiQ v. LinkedIn: What the Ruling Means for Scraping Public Data

I have spent a lot of hours building LinkedIn data pipelines, and every time the legal question comes up, someone summarizes hiQ v. LinkedIn as “scraping LinkedIn is legal now.” That summary is wrong in a way that can cost you. So I went back and read the actual opinions, the consent judgment, and LinkedIn’s own User Agreement, and wrote down what the ruling does and does not say.

The short version is that the LinkedIn scraping lawsuit produced a real, useful web scraping precedent about one federal statute, and hiQ still lost the case and paid LinkedIn. Both of those things are true at once, and the gap between them is the whole point. What follows is a plain-English case summary, the timeline, and what the ruling changes for anyone scraping LinkedIn in 2026.

What was the hiQ v. LinkedIn scraping lawsuit about?

The hiQ v. LinkedIn scraping lawsuit was a six-year fight over whether a data-analytics company could keep scraping public LinkedIn profiles after LinkedIn told it to stop. hiQ Labs built products (Keeper and Skill Mapper) that scraped publicly visible member profiles and sold employers signals about which staff were a flight risk. In May 2017 LinkedIn sent a cease-and-desist letter, invoked the Computer Fraud and Abuse Act, and began blocking hiQ’s access. hiQ sued first, asking a court to stop LinkedIn from cutting it off.

The procedural history is what makes this case confusing, because it bounced through nearly every level of the federal system. Here is the whole timeline in one place.

The takeaway from the timeline is that the famous “scraping is legal” headlines all come from the 2019 and 2022 appellate rulings in the middle, and the case did not end there. To understand why the precedent is narrower than it sounds, you have to look at exactly which statute the Ninth Circuit was interpreting.

What did the Ninth Circuit actually rule about the CFAA?

The Ninth Circuit ruled that scraping data from a public website likely does not count as accessing a computer “without authorization” under the Computer Fraud and Abuse Act. The CFAA, codified at 18 U.S.C. § 1030, is a criminal anti-hacking law that punishes accessing a protected computer “without authorization.” LinkedIn argued that once it sent the cease-and-desist and put up technical blocks, any further scraping by hiQ was unauthorized access and therefore a CFAA violation.

The court rejected that reading. It held that the “without authorization” concept applies to systems that are private by default, the kind protected by a password or some other gate. When a site is open for anyone to view without logging in, there is no authorization to revoke, so scraping it is not the digital equivalent of breaking in. In the court’s framing, public LinkedIn profiles are like a storefront window: visible to all comers, and looking through the window is not trespass.

The California Lawyers Association summarized the holding as finding it likely that “when a computer network generally permits public access to its data, a user accessing that publicly available data will not constitute access without authorization under the CFAA.” The Electronic Frontier Foundation, which filed briefs in the case, put it more bluntly in its write-up that scraping public websites still is not a crime.

Two limits on that ruling matter for anyone relying on it:

• It is a Ninth Circuit decision. That binds federal courts in the western US, including California, where most large platforms are based. It is persuasive elsewhere and not controlling.
• It was decided on a preliminary-injunction standard. The court asked whether hiQ had raised “serious questions” worth preserving the status quo over. It did not decide whether hiQ would win a full trial on the CFAA. The bar for that standard sits below a final merits judgment.

That second point is why the Supreme Court got involved, and why the case had to make a detour through an unrelated hacking prosecution before the Ninth Circuit could rule the way it did.

How did the Supreme Court and Van Buren change the case?

The Supreme Court changed the case by vacating the 2019 ruling and sending it back to be reconsidered in light of Van Buren v. United States. In June 2021 the Court granted LinkedIn’s petition, wiped the Ninth Circuit’s first opinion, and pointed the lower court at Van Buren, a decision it had just issued days earlier.

Van Buren was not a scraping case. It was about a police officer who looked up a license plate in a database he was allowed to use, for a corrupt reason. The question was whether using authorized access for an improper purpose “exceeds authorized access” under the CFAA. The Supreme Court said no, and adopted a narrow, gates-up-or-down reading of the statute: you violate the CFAA when you access areas of a computer that are off-limits to you, and not when you misuse data you were allowed to reach in the first place.

On remand, the Ninth Circuit found that Van Buren reinforced its earlier conclusion: if the CFAA is about gates, then public profiles have no gate, so accessing them is not a violation. The court reaffirmed the injunction in April 2022, a result law firm Jenner & Block described as the Ninth Circuit “reaffirming a narrow interpretation of the CFAA.” So the Supreme Court detour did not weaken the scraping precedent; it strengthened the statutory logic underneath it, and the part that hurt hiQ came from somewhere the CFAA never reached.

How did hiQ v. LinkedIn actually end?

hiQ v. LinkedIn ended in a settlement where hiQ accepted a $500,000 judgment and a permanent injunction barring it from scraping LinkedIn. On December 6, 2022 the two sides filed a stipulated consent judgment in the Northern District of California, and the court entered it. By then hiQ had effectively wound down, and the terms reflected a clear LinkedIn win on the claims that survived the CFAA fight.

Those surviving claims were about contract and property. The CFAA, the hacking statute, played no part in them. A month earlier the district court had ruled that hiQ breached LinkedIn’s User Agreement, which every hiQ employee had accepted by signing up for LinkedIn accounts. Law firm Morgan Lewis walked through how the consent judgment established hiQ’s liability under California’s common-law torts of trespass to chattels and misappropriation alongside the breach-of-contract finding.

The consent judgment required hiQ to stop scraping LinkedIn and to destroy the source code, algorithms, and data built from scraped profiles. LinkedIn publicly called the result a “final, decisive victory” that set “important legal precedent,” as The Record and other outlets reported. The lesson I take from the ending is that winning the CFAA argument did not save hiQ, because the contract claim was a separate door, and LinkedIn won through that door.

What does the hiQ precedent mean for scraping public LinkedIn data in 2026?

The hiQ precedent means that scraping public, logged-out LinkedIn data rests on solid footing against CFAA claims in 2026, while contract and privacy exposure is the part you actually have to manage. The CFAA risk for genuinely public data is low in the Ninth Circuit. The risk that still exists comes from terms of service you agreed to and from the kind of data you collect.

A second case reinforced the public-data side after hiQ. In January 2024, in Meta v. Bright Data, US District Judge Edward Chen granted summary judgment for the scraper, finding that Meta’s terms “do not bar logged-off scraping of public data.” Crucially, the court reasoned that Bright Data was not a “user” bound by the terms while it was logged out, so the contract never attached. Meta dropped the rest of the suit a month later. That logged-out reasoning is the throughline connecting both cases.

The practical line that keeps winning in court is the login wall. Data you can see in a logged-out incognito window is the data the hiQ and Bright Data reasoning protects. The moment a scraper signs into an account, it accepts LinkedIn’s User Agreement and the contract analysis flips, which is exactly the trap hiQ fell into. I dig into the contract side in detail in my guide on LinkedIn scraping and the terms of service, and into the technical line in how to scrape LinkedIn without logging in.

That contract risk is not theoretical, and LinkedIn has been pressing it hard against newer targets.

Is there a LinkedIn scraping lawsuit in 2025?

Yes, there is an active LinkedIn scraping lawsuit from 2025: LinkedIn sued ProAPIs, Inc. and its CEO over an alleged large-scale scraping operation built on fake accounts. According to The Record, LinkedIn’s complaint alleges ProAPIs created and controlled millions of fake LinkedIn accounts to scrape member data (including posts, reactions, and comments) and resold access to that data for as much as $15,000 per month.

The legal shape of the 2025 case is different from hiQ in a way that matters. hiQ scraped public profiles from the open web and argued the data was public. ProAPIs is accused of creating fake accounts to get behind LinkedIn’s systems, which is conduct that lives squarely in contract-breach and fraud territory. The public-data CFAA question hiQ won barely touches it. LinkedIn’s User Agreement bans fake accounts in section 8.2 and bans scraping software in the same section, so a fake-account scraping operation breaches the terms on two independent grounds.

This is why I tell people the hiQ “update” they are looking for is not really a new public-data ruling. The recent enforcement, including the ProAPIs suit, targets the methods that were always the weak spot: signing in, faking identities, and ignoring the contract. None of that disturbs the public-data precedent. It just shows where LinkedIn chooses to fight.

What legal and ethical issues remain when scraping LinkedIn data?

The legal and ethical issues that remain when scraping LinkedIn data fall into three buckets: contract terms, privacy law, and the nature of the personal data itself. The CFAA question is largely settled for public data. These three are not.

The first issue is contract. LinkedIn’s User Agreement prohibits scraping regardless of what the CFAA says, and accepting those terms (by holding an account) is enough to expose you to a breach claim, as hiQ learned. A site’s terms of service can bind you even where a criminal statute does not.

The second issue is privacy law, and this is where “public” stops being a safe word. Public availability does not strip personal data of protection under Europe’s General Data Protection Regulation. Regulators have backed this up with money. France’s CNIL fined Clearview AI 20 million euros for scraping publicly posted photos to build a facial-recognition database without a lawful basis, and the Dutch DPA later added a 30.5 million euro fine for the same underlying practice. Names, job titles, and profile photos on LinkedIn are personal data, so collecting them at scale can fall under the GDPR even when each profile is openly visible.

The third issue is ethical and reputational. Scraping that respects rate limits, avoids deception, and collects only what a project genuinely needs tends to also stay on the right side of the legal lines above. I cover the practical boundaries in my piece on whether scraping LinkedIn is legal and what LinkedIn’s robots.txt says. The cleaner approach feeds directly into how you should set up collection in the first place.

How do you scrape LinkedIn data without repeating hiQ’s mistakes?

You avoid hiQ’s mistakes by staying on public data, never signing into accounts you have to scrape, and handling personal data carefully, and the simplest way to hold that line is to collect public profiles through an API that runs no logged-in sessions. hiQ’s exposure came from the User Agreement its staff accepted. A request that targets a public profile URL and never logs in does not accept those terms in the first place, which is the same distinction that cleared Bright Data.

In my own testing I run public LinkedIn collection through ChocoData, which takes a public profile URL and returns parsed JSON without me logging in, rotating accounts, or managing the blocking myself. A single request looks like this:

curl "https://chocodata.com/api/v1/linkedin/profile?url=https://www.linkedin.com/in/williamhgates&api_key=$CHOCO_API_KEY"

That request hits a public profile (the same kind of page the hiQ ruling addressed) and returns structured fields without a login session attached to it. Because there is no account in the loop, the contract trap that ended hiQ never opens. The same pattern covers the other public endpoints I use, such as the LinkedIn company scraper and the LinkedIn search results scraper. You can create a ChocoData API key and run the request above against any public profile to see the shape of the response.

Two habits keep collection clean beyond the tooling. Pull only the public fields a project actually uses, and treat anything that looks like personal data under the GDPR as something that needs a lawful basis before you keep it, even when it was openly visible. The hiQ record is a six-year reminder that the legal question covers more than “can I reach this data.” It also covers “what did I agree to, and whose personal data is this.” Get those two right and the famous precedent works in your favor, and you sidestep the mistake that cost hiQ half a million dollars.