LinkedIn Scraping and the Terms of Service: What You Can and Cannot Do

I read LinkedIn’s User Agreement line by line before I built a single data pipeline against the platform, because the terms of service decide what you are agreeing to the moment you log in. The short version is that LinkedIn’s terms of service prohibit scraping in plain language, and the prohibition sits in one specific clause: Section 8.2. This guide walks through what that clause actually says, where else the prohibition appears, and the distinction that trips up almost everyone: a terms of service prohibition is a contract question, which is not the same as whether scraping is legal.

Below I quote the exact wording from LinkedIn’s own legal pages, cover how LinkedIn enforces it, and explain why the official API does not close the gap for most data work.

Does LinkedIn allow scraping in its terms of service?

LinkedIn does not allow scraping in its terms of service. The LinkedIn User Agreement prohibits scraping in Section 8.2, the “Dos and Don’ts” section, where every member who accepts the agreement promises not to use automated tools to scrape or copy the platform.

The operative line is specific. Under Section 8.2 of the User Agreement, members agree they will not:

“Develop, support or use software, devices, scripts, robots or any other means or processes (such as crawlers, browser plugins and add-ons or any other technology) to scrape or copy the Services.”

That single sentence covers the entire toolbox most people reach for. Scripts, robots, crawlers, and browser plugins are all named by category. The phrase “or any other means or processes” is a catch-all that closes the obvious workarounds. The prohibition attaches to “the Services,” which LinkedIn defines broadly across its website, mobile apps, and related products, so it is not limited to one page type or one section of the site.

A second clause in the same section handles automation that is not strictly scraping. Members also agree not to:

“Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages, create, comment on, like, share, or re-share posts, or otherwise drive inauthentic engagement.”

This is the bit that catches connection-request automators, auto-likers, and contact exporters in addition to data scrapers. The terms of service treat automated access itself as the violation, regardless of whether you are reading data or writing it. The next section breaks down exactly which acts fall inside these two clauses.

What exactly does the LinkedIn terms of service prohibit?

The LinkedIn terms of service prohibit five distinct categories of automated and data-handling activity, and Section 8.2 spells each one out by name instead of leaning on a vague catch-all. Reading them as separate buckets makes it clear how wide the prohibition reaches.

LinkedIn restates the same rules outside the User Agreement so members cannot claim they only read one document. The Prohibited Software and Extensions help page says directly that LinkedIn does not permit “crawlers, bots, browser plug-ins, or browser extensions that scrape, modify the appearance of, or automate activity on LinkedIn’s website.” That page also warns that prohibited tools “may become non-operational without notice,” which is LinkedIn telling extension users their tool can be cut off at any time.

The Professional Community Policies add an identity layer on top. Under “Be Trustworthy,” LinkedIn requires members to “use your true identity on LinkedIn, provide accurate information about yourself or your organization, and only share information that is real and authentic,” and to not “create a fake profile or falsify information about yourself.” This matters for scraping because the common evasion tactic of spinning up throwaway accounts breaks a second policy on top of Section 8.2. The community policies also list the “sale of scraped data” as a restricted activity. So the prohibition is not buried in one clause: it runs through the User Agreement, the help center, and the community policies together, which is why enforcement does not depend on a single line of fine print.

Is scraping LinkedIn against the terms of service the same as illegal?

Scraping LinkedIn against the terms of service is not the same as illegal scraping, because a terms of service prohibition is a breach-of-contract matter while legality turns on statutes like the Computer Fraud and Abuse Act. The two questions have different answers, and the hiQ v. LinkedIn litigation is the clearest illustration of the gap.

On the legality side, the public-data question went in the scrapers’ favor. The Ninth Circuit held in hiQ Labs v. LinkedIn that scraping publicly available data likely does not violate the CFAA, reasoning that a public website has “erected no gates” to bypass. The Electronic Frontier Foundation’s summary of the hiQ ruling covers that reasoning, and the same logic later helped scrapers in unrelated cases. In May 2024, Judge William Alsup dismissed X Corp’s scraping suit against Bright Data, writing that giving platforms total control over public web data “risks the possible creation of information monopolies that would disserve the public interest.” Meta dropped a parallel claim against Bright Data earlier the same year.

The contract side is where LinkedIn’s terms of service still bite. After the CFAA question, the hiQ case continued, and in late 2022 the parties settled with a stipulated judgment. A federal court found that hiQ had breached LinkedIn’s User Agreement, and the proposed consent judgment entered a $500,000 judgment against hiQ for breach of contract and related claims, along with an injunction requiring hiQ to stop scraping and destroy the data it had collected. The court treated the User Agreement’s anti-scraping and fake-profile provisions as enforceable contract terms.

The takeaway is that “courts said public scraping is not a CFAA crime” and “LinkedIn’s terms prohibit scraping” are both true at once. One is about a statute. The other is about the agreement you accepted. I go deeper on the statutes and case law in my guide on whether scraping LinkedIn is legal, and I break down the hiQ timeline in detail in the hiQ v. LinkedIn ruling explainer. The practical question that follows is who the contract actually binds, which depends on whether you are logged in.

Who is bound by the LinkedIn terms of service?

The LinkedIn terms of service bind anyone who accepted the User Agreement, which means every logged-in member, and the contract follows your account across every page you visit. The moment you create an account and click through the agreement, Section 8.2 applies to everything you do on the platform while signed in.

This is why the logged-in versus logged-out distinction is the single most important factor in how the terms apply to you:

• Logged in: You accepted the User Agreement, so Section 8.2 binds you. Scraping through your account, or through automation that uses your session, is a direct breach. This holds even for data that is publicly visible, because the agreement does not exempt public pages.
• Logged out: You never agreed to the User Agreement, so the breach-of-contract theory is weaker. This is the scenario the hiQ CFAA ruling addressed. The legality question still depends on the CFAA, copyright, and privacy law, and LinkedIn aggressively blocks anonymous traffic at the technical level.

The logged-out path is narrower than it sounds, because LinkedIn shows far less data to signed-out visitors and throttles or blocks automated requests quickly. I cover what is actually reachable without an account in my walkthrough on scraping LinkedIn without logging in, and what the site’s crawl directives say in what LinkedIn’s robots.txt allows. The robots.txt file is a separate signal from the User Agreement: it tells automated crawlers which paths LinkedIn asks them not to fetch, and LinkedIn disallows most of the site there too. Once you know who the contract binds, the next question is what LinkedIn does when it detects a breach.

How does LinkedIn enforce its scraping terms?

LinkedIn enforces its scraping terms through automated detection first and legal action second, and the platform is explicit that a breach can cost you your account. The User Agreement and help pages both state that members who violate the rules “risk having their accounts restricted or shut down.”

The automated layer is where most enforcement happens, and the numbers show how heavily LinkedIn leans on it. In its transparency reporting, LinkedIn stated that automated defenses blocked 97.1% of fake accounts before any member reported them in the first half of 2025, up from the 90.1% it reported for the same period in 2023. Those defenses target the throwaway accounts that scraping operations rely on, which is why account churn is a constant cost for anyone running automation against the logged-in site. Detection signals include request velocity, behavioral patterns that do not match a human session, and reputation scoring on the IP and account.

The legal layer is rarer but real. The hiQ judgment showed LinkedIn will litigate a breach of its User Agreement to a stipulated judgment and an injunction. Most individual scrapers will never see a lawsuit, but the enforcement ladder runs from a soft account restriction, to a permanent ban, to IP-level blocking, and in commercial-scale cases to a contract claim. The cost that bites first is operational: rebuilding blocked accounts and rotating infrastructure is a recurring tax, separate from any legal exposure. That cost is the reason the sanctioned route matters, even though it is narrow.

What is the compliant way to get LinkedIn data?

The compliant way to get LinkedIn data is the official LinkedIn API through its vetted developer program, because it is the only access method LinkedIn sanctions in its terms. The API sidesteps Section 8.2 entirely, since you are using an authorized interface instead of scraping the Services.

The catch is scope. The LinkedIn API Terms of Use and developer program run on a self-serve tier plus partner programs, and access is narrowly conditioned. Developers are authorized only for the specific use case they applied for, and the marketing, job posting, and other programs require LinkedIn to vet your application, privacy practices, and security before granting access. The API exposes the data LinkedIn chooses to make available through approved products. It does not return bulk profile data, full search results, or contact lists the way most data projects need, so it covers a thin slice of common scraping use cases.

That gap between what the API offers and what teams actually need is the structural reason a market of LinkedIn scrapers exists. For data the API does not expose, every option carries the Section 8.2 tension I described above, and the practical questions become reliability, maintenance, and who absorbs the blocking work. A LinkedIn scraping API removes the infrastructure burden by accepting a profile or company URL and returning parsed JSON, with the proxy rotation and parsing handled server-side. In my testing against ChocoData’s LinkedIn endpoint, a single authenticated request returned a profile as structured JSON without my running a browser fleet or an account pool.

The request is a plain GET with your API key as a query parameter:

curl "https://chocodata.com/api/v1/linkedin/profile?url=https://www.linkedin.com/in/williamhgates&api_key=$CHOCO_API_KEY"

The Python version is the same shape and returns the profile fields ready to load into a dataframe:

import requests
import pandas as pd

resp = requests.get(
    "https://chocodata.com/api/v1/linkedin/profile",
    params={
        "url": "https://www.linkedin.com/in/williamhgates",
        "api_key": "YOUR_CHOCO_API_KEY",
    },
    timeout=30,
)
profile = resp.json()["data"]

df = pd.json_normalize(profile)
print(df[["full_name", "headline", "location"]].head())

You can get an API key on the ChocoData sign-up page and swap it into the snippet above, and the same URL pattern drives the LinkedIn profile scraper API for production runs. Using a tool like this does not change what LinkedIn’s terms say. It changes who runs the infrastructure. The contract analysis in this article still applies, which is why the legal and robots.txt context above is worth reading before you collect anything at scale.

Summary: what the LinkedIn terms of service allow and prohibit

The LinkedIn terms of service prohibit nearly every form of automated data collection and permit only the official API for sanctioned access. Here is the whole picture in one view.

Scraping the public web is generally treated as legal in the US after hiQ and the Bright Data dismissals, but LinkedIn’s User Agreement is a contract you accept when you log in, and Section 8.2 prohibits scraping inside that contract. Those two facts coexist. The compliant route is the official API, which is narrow by design. Everything outside it carries the contract tension this article describes, so the decision comes down to a risk-and-maintenance call. For the legality detail, see is scraping LinkedIn legal; for the case that settled the contract question, see the hiQ v. LinkedIn explainer.