Is Scraping LinkedIn Legal?

I get asked whether scraping LinkedIn is legal more than any other question about this platform, usually right before someone is about to build a pipeline on top of it. The honest answer is that scraping LinkedIn is legal in a narrow, specific way in the US, and it carries real contract and privacy risk that sits entirely outside that narrow legality. Those two things are both true at once, and most write-ups only tell you one of them.

So I read the actual rulings and the actual policies: the Ninth Circuit’s hiQ v. LinkedIn opinion, the $500,000 judgment that followed it, the Bright Data v. Meta decision, Section 8.2 of LinkedIn’s own User Agreement, and a 2024 GDPR fine against a LinkedIn scraper. Below is what each one says about LinkedIn scraping legality, where the legal line sits between public and private data, and how I keep my own collection on the right side of it.

This is general information drawn from reading primary sources. It is not legal advice. For a specific project, talk to a lawyer.

Is LinkedIn scraping legal?

Scraping LinkedIn is legal in the US when it targets publicly visible data and does not bypass a login or other access control. The Ninth Circuit Court of Appeals held in hiQ Labs v. LinkedIn that scraping data a site has made public likely does not violate the Computer Fraud and Abuse Act, the main US anti-hacking statute. That ruling is the foundation for the common claim that LinkedIn scraping is legal, and within its limits it is correct.

The limits are the whole story, though. The hiQ holding is about one statute, the CFAA, and one kind of data, public pages. It does not say scraping LinkedIn is permitted in every sense. LinkedIn’s User Agreement still bans automated collection as a contract term, and any personal data you gather is regulated by privacy law. LinkedIn scraping legality in 2026 is best understood as three separate questions stacked on top of each other.

Each row has a different answer, and clearing one does not clear the others. You can scrape public LinkedIn data without committing a computer crime, while still breaching LinkedIn’s contract, while still risking a privacy fine if you mishandle the personal data. The rest of this article works through each row, starting with the case everyone cites.

What did hiQ v. LinkedIn actually decide?

hiQ v. LinkedIn decided that scraping publicly available LinkedIn profiles likely does not count as accessing a computer “without authorization” under the CFAA. hiQ Labs, an analytics company, built its product on public LinkedIn profile data. When LinkedIn sent a cease-and-desist and blocked hiQ’s access, hiQ sued, and in April 2022 the Ninth Circuit reaffirmed an injunction protecting hiQ’s scraping of public data.

The court’s reasoning is the part worth remembering. The judges used a “gates” analogy: a computer hosting public webpages “has erected no gates to lift or lower in the first place,” as the Electronic Frontier Foundation’s summary of the ruling puts it. With no gate to bypass, there is no unauthorized access, so the CFAA does not reach the conduct. The California Lawyers Association breakdown of the decision describes the same logic and calls the Ninth Circuit the most scraping-friendly circuit in the country. The decision built on the Supreme Court’s 2021 ruling in Van Buren v. United States, which read the CFAA’s “exceeds authorized access” language narrowly.

Here is where the popular summary usually stops, and where it gets misleading: hiQ won the CFAA fight and lost the war. After the appeal, the case went back to the trial court, where in late 2022 the parties filed a stipulated judgment. According to Proskauer, which represented LinkedIn, it entered a $500,000 judgment against hiQ and a permanent injunction barring it from scraping LinkedIn, and the Morgan Lewis recap of the outcome notes the judgment rested on breach of LinkedIn’s User Agreement plus a CFAA violation tied to hiQ using fake accounts to reach password-protected pages. The case that “made scraping legal” ended with the scraper paying half a million dollars, and the CFAA was never the only law in play, which leads straight to the contract question.

Does scraping LinkedIn violate the terms of service?

Scraping LinkedIn violates the terms of service. Section 8.2 of LinkedIn’s User Agreement lists, under its “Don’ts,” a prohibition on developing, supporting, or using “software, devices, scripts, robots, or any other means or processes (including crawlers, browser plugins and add-ons, or any other technology) to scrape the Services or otherwise copy profiles and other data from the Services.” It also bans using bots or automated methods to access the Services. An automated LinkedIn scraper that runs while logged in does exactly what that clause forbids.

The legal weight of that clause is what changed after hiQ. A terms-of-service violation is a breach of contract, which sits in civil law and carries no criminal penalty on its own. For years it was unclear whether those anti-scraping terms were enforceable, but the hiQ litigation answered it. The trial court granted LinkedIn summary judgment on its breach-of-contract claim, finding that hiQ’s scraping and its use of fake profiles violated the User Agreement, and that the anti-scraping provisions were enforceable. Proskauer’s note on that ruling walks through the finding.

The practical consequences of breaching Section 8.2 fall into two buckets, and I keep them separate when I plan any collection.

• Account enforcement. LinkedIn detects automated behavior and restricts or permanently bans the account behind it. LinkedIn’s own help page on prohibited software warns that members using crawlers, bots, or scraping plugins risk having their accounts restricted or shut down. This hits any method that relies on a logged-in session, including most browser-extension scrapers.
• Civil liability. LinkedIn can sue for breach of contract and seek damages, as the hiQ judgment shows. This is the exposure that scales with how much you collect and how commercial the use is.

A contract only binds the people who agreed to it. You agree to LinkedIn’s User Agreement when you create an account and log in. That detail is the hinge for the next question, because a scraper that never logs in is in a meaningfully different contractual position. The case that drew that line is Bright Data v. Meta.

Where is the line between public data and logged-in data?

The line sits at the login. Scraping data you can see while logged out is treated very differently from scraping data behind an account, both under the CFAA and under contract law. The clearest statement of this came in Meta Platforms v. Bright Data, decided in the Northern District of California in January 2024.

In that case Meta sued the data provider Bright Data for scraping public Facebook and Instagram profiles. Judge Edward Chen granted Bright Data summary judgment on the contract claims, and the quoted reasoning maps directly onto LinkedIn. The court found that Meta’s terms “do not bar logged-off scraping of public data,” because the terms bind users who are logged into an account, and a scraper collecting public data while logged out is not bound by them. Quinn Emanuel’s analysis of the decision explains why this matters for the whole industry, and Meta dropped the suit a month later.

Putting hiQ and Bright Data together gives a usable rule for LinkedIn. The combination of who is bound by the contract and which statute applies produces four situations.

The safest cell is the top row: public data, collected without logging into a LinkedIn account. That is also why the collection method matters as much as the data, a point I come back to at the end. Before that, the data itself raises one more body of law, because almost everything on a LinkedIn profile is personal data.

Is scraping LinkedIn legal under GDPR?

Scraping LinkedIn is subject to GDPR whenever the data concerns people in the EU or UK, because names, job titles, employers, and contact details are all personal data under the regulation. Public availability does not switch GDPR off. You still need a lawful basis to process the data, and for scraping that basis is almost always “legitimate interest” under Article 6(1)(f), which requires a documented balancing test weighing your interest against the rights of the people in the data.

The European regulators have made this concrete, and one case is squarely about LinkedIn. On 5 December 2024 the French data protection authority CNIL fined the company behind the KASPR LinkedIn extension. According to CNIL’s published decision, KASPR ran a Chrome extension that pulled professional contact details from LinkedIn profiles into a database of roughly 160 million contacts, and the regulator imposed a EUR 240,000 fine. The detail that matters for anyone scraping profiles: CNIL found that KASPR collected contacts even where users “had chosen to restrict visibility to their 1st and 2nd-degree connections,” and held that scraping that restricted data “exceeded what could reasonably be expected” from people on a professional network.

For broader AI and scraping projects, CNIL went further in 2025. Its focus sheet on web scraping under legitimate interest sets out concrete safeguards: excluding sites that visibly object to scraping, filtering out data that is irrelevant to your purpose, and deleting sensitive categories at the point of collection, all of which mirror the European Data Protection Board’s 2024 guidelines on legitimate interest. The compliance signal from KASPR is direct: restricting collection to genuinely public fields, honoring visibility settings, and not hoarding data you do not need are the behaviors regulators reward, while collecting masked or restricted contact details is the behavior they fine. That distinction shapes how I actually pull LinkedIn data, which is the last section.

How do you scrape LinkedIn data legally?

You scrape LinkedIn data legally by staying inside all three rules at once: collect only public data, avoid logging in or bypassing access controls, and handle any personal data with a lawful basis and restraint. None of the cases above protects a scraper that logs into an account to reach gated data, and none protects collecting personal details a person tried to hide. The practices below are the ones that keep a project aligned with hiQ, Bright Data, Section 8.2, and the KASPR decision.

The ethical considerations track the legal ones closely. The KASPR ruling turned on a point that is as much about ethics as law: collecting contact details a member had deliberately restricted exceeded what people could reasonably expect on a professional network. Ethical LinkedIn data scraping respects the same boundary the regulators drew, so a checklist that satisfies the law tends to satisfy the ethics too. These are the LinkedIn scraping legal considerations I work through before any collection.

• Collect public data only. Limit scraping to fields a logged-out visitor can see. This is the data hiQ and Bright Data protect, and it sidesteps the CFAA “gate” problem entirely.
• Avoid logging in to scrape. A logged-out method keeps you off the Section 8.2 contract hook, since the User Agreement binds logged-in users. It also means there is no account for LinkedIn to ban.
• Respect visibility settings. Do not collect contact details or fields a user restricted. Pulling masked data is the exact conduct CNIL fined in the KASPR case.
• Honor robots.txt and rate limits. Slow, polite request rates reduce server load and weaken any “unauthorized access” or trespass argument. I cover the detail in what LinkedIn robots.txt says about scraping.
• Establish a lawful basis for personal data. If your targets are in the EU or UK, document a legitimate-interest assessment before you collect, and delete data you do not need.
• Mind the data you buy as well as the data you scrape. Liability follows scraped personal data downstream, so buying a LinkedIn dataset a broker scraped does not transfer the risk away from you.

The method that satisfies most of these at once is to pull public profile data through an API that operates logged out. A logged-in browser session is the riskier path here, because it puts an account on the line. The logged-out API removes the account-ban exposure and keeps collection on public fields. In my own work I send a public LinkedIn URL to ChocoData’s LinkedIn endpoint and get structured JSON back without ever attaching my LinkedIn login. The request is a plain GET with the profile URL and an API key:

curl "https://chocodata.com/api/v1/linkedin/profile?url=https://www.linkedin.com/in/williamhgates&api_key=$CHOCO_API_KEY"

The Python shape is the same, which makes it easy to wire into a compliance-aware pipeline that only keeps the public fields you actually need:

import requests

resp = requests.get(
    "https://chocodata.com/api/v1/linkedin/profile",
    params={
        "url": "https://www.linkedin.com/in/williamhgates",
        "api_key": "YOUR_CHOCO_API_KEY",
    },
    timeout=30,
)
profile = resp.json()

# Keep only public, purpose-relevant fields; drop the rest.
keep = {k: profile.get(k) for k in ("name", "headline", "location", "current_company")}
print(keep)

Because this runs logged out against public pages, it stays in the top row of the risk table above, where both the CFAA and contract exposure are lowest. You can get an API key on the ChocoData sign-up page and swap it into either snippet. For the contract side in full, I break down exactly which clauses apply in LinkedIn scraping and the terms of service, and for the implementation side I walk through a working build in how to scrape LinkedIn with Python. The legal picture is stable for now, but it rests on case law and regulator decisions that keep moving, so it is worth rechecking the primary sources before you scale a project on LinkedIn data.