Is LinkedIn Scraping Legal? What US Law and Privacy Rules Say

Collecting publicly visible LinkedIn profile data is not, on its own, a federal crime in the US. But “not a crime” is a narrow answer. LinkedIn’s rules prohibit scraping tools, privacy laws such as the GDPR can still apply to the data you collect, and the court rulings people cite were decided on limited questions. This guide separates the three layers (criminal law, contract and privacy) so you can decide what is safe for your outbound program.

This is general information for sales and marketing teams, not legal advice. If you plan to collect data at scale, have a lawyer who knows your market review the plan.

Plusvibe

Build Prospect Lists With Care

PlusVibe’s Chrome extension can collect prospects from LinkedIn and other sources, with tools for email verification and personalized outreach.

Explore prospecting tools

Key takeaways

US courts have not treated viewing public web pages as hacking, but the main LinkedIn ruling came at an early stage and left LinkedIn’s other claims open.
LinkedIn’s terms ban scraping software, so the realistic risks are account restrictions, cease-and-desist letters and contract claims, even where no crime is involved.
Personal data stays personal data when it is public. In the EU and UK, the GDPR applies, and a French regulator has fined a contact-data company for scraping LinkedIn details.
What you do after collecting data (verification, relevance, opt-outs, honest outreach) matters as much as how you collected it.

Why there is no single yes or no
Layer one: US computer-access law and the hiQ case
Layer two: LinkedIn’s rules and what happens to accounts
Layer three: privacy law and personal data
So is scraping LinkedIn legal for outreach?
What to check before you collect or use LinkedIn data
A lower-risk way to build prospect lists
Our perspective
From a verified list to the inbox
Frequently asked questions
Sources

Why there is no single yes or no

Lawyers who study the subject describe scraping as not illicit in itself. The same academic analysis of the right to scrape data notes that it must still respect criminal law, privacy and data protection, copyright and contract law. Each of those is a separate test, and passing one does not pass the others.

The field is also still moving. A Quinn Emanuel review of web scraping law points out that the rules develop reactively, one dispute at a time, between websites, regulators and scrapers. So any article claiming a final, universal answer is overselling.

A useful way to think about it is as three layers:

Layer	Key question	Typical consequence if you fail
Criminal and computer-access law	Did you access something you were not authorized to access?	Rare for public pages, serious if it happens
Contract and platform rules	Did you break LinkedIn’s terms of use?	Banned accounts, blocked IPs, legal letters, civil claims
Privacy and data protection	Did you have a lawful reason to collect and use personal data?	Regulator orders, deletion, fines

Layer one: US computer-access law and the hiQ case

Most of the confident “scraping is legal” headlines trace back to hiQ Labs v. LinkedIn. hiQ collected public profile data, and LinkedIn tried to stop it under the Computer Fraud and Abuse Act (CFAA), the US federal anti-hacking law.

The details matter. In 2019 the Ninth Circuit held that hiQ had raised a serious question about whether the CFAA’s “without authorization” language reaches access to data that is public. That was a preliminary-injunction ruling. The court did not settle the dispute for good, and it expressed no opinion on whether LinkedIn’s other claims, including trespass, misappropriation and DMCA claims, might ultimately succeed.

The Supreme Court’s decision in Van Buren v. United States later narrowed how the CFAA’s “exceeds authorized access” wording is read, which supports the view that public pages are not a locked gate. The hiQ litigation itself wrapped up afterward, and the practical lesson drawn by lawyers is that winning on the CFAA did not protect a scraper from every other claim.

Layer one: US computer-access law and the hiQ case — overview diagram

The American Bar Association’s litigation section has also flagged broader implications of rulings like this one, including concerns about how public data is controlled. In short, the CFAA is the layer where scrapers of public pages stand on the firmest ground. It is not the only layer.

What the hiQ ruling does not cover

Logged-in data. The reasoning concerned pages anyone could see without signing in. Data behind a login, in a connection-only view or in a paid tool is a different situation.
Your contract with LinkedIn. Anyone who creates an account agrees to the User Agreement. Breach of contract is a civil matter, not a CFAA question.
Privacy law. The hiQ opinion was about computer access, not about whether you may process people’s personal data.
Other countries. US court reasoning does not bind a data protection authority in Europe.

Layer two: LinkedIn’s rules and what happens to accounts

LinkedIn’s position is consistent. Its help center states that it does not permit third-party software, including crawlers, bots, browser plug-ins and extensions, that scrapes the site or automates activity. Earlier, LinkedIn told a correspondent that it does not permit software that scrapes or copies member data and that it has technical defenses against such tools.

That matters because the most common consequence is not a lawsuit. It is a restricted or closed account. If your prospecting depends on one salesperson’s profile, losing it means losing their network, messages and history.

There is a structural reason tools get into trouble. LinkedIn offers no public API for content, connections or messaging, so third-party tools often rely on workaround approaches to interact with the platform. Those workarounds are exactly what LinkedIn’s detection is built to catch.

Privacy regulators are pushing platforms the same way. A 2023 joint statement from data protection authorities, including Canada’s and Australia’s, advised social media companies to use layered controls such as rate limiting and bot detection against unlawful scraping. The UK ICO’s copy of that statement stresses that no single safeguard is enough. Expect detection to keep getting stricter, not looser.

Practical signs you are in the risk zone

A tool asks for your LinkedIn password or session cookie and runs in the background.
It visits hundreds of profiles an hour from one account.
It collects data about people who restricted their visibility to connections.
It exports data that was never visible to you in the first place.

If you are comparing extension-style tools, our guides to LinkedIn email extractor tools and lead scraping extensions explain how they work and what to weigh before installing one.

Layer three: privacy law and personal data

This is the layer most US teams overlook. A profile is public, but the person in it still has rights, and in many countries “publicly available” does not mean “free to reuse for any purpose.”

The KASPR decision

The clearest enforcement example for LinkedIn data is from France. The CNIL fined KASPR €240,000 for collecting contact details from LinkedIn users who had limited their visibility to first- and second-degree connections. The regulator found that collection went beyond what those people could reasonably expect and was unlawful under Article 6 of the GDPR. It also ordered the deletion of that data. Where the data could not be separated out, the company had to inform the people concerned and use the data solely for that purpose.

The lesson is not “never touch LinkedIn data.” It is that a person’s chosen privacy setting is a signal about what they expect, and ignoring it is a legal weakness.

The GDPR’s reach

The GDPR applies to personal data of people in the EU, and the same logic shows up in guidance on scraping in general. The European Data Protection Board’s 2026 guidelines on web scraping concern collection for generative AI training, but they restate principles that apply broadly: the GDPR applies when personal data is processed, and the controller must address transparency, purpose limitation and a lawful basis. If you rely on legitimate interest, the same guidelines require a balancing test that weighs your interest against the rights of the people concerned.

The EDPB also observes that scraping is often large-scale and happens without people’s awareness, which is why regulators care about accountability. If you sell to Europe or the UK, plan for these obligations. Our short explainer on GDPR compliance covers the basics.

And in the US?

There is no single federal privacy law that mirrors the GDPR. Some states have comprehensive privacy statutes with their own rules for personal data, and B2B contact data can fall under them depending on the state and the law’s exemptions. Check the statutes of the states where your prospects live. For email specifically, the CAN-SPAM rules still apply to the messages you send. Our cold email compliance checklist walks through sender identification, opt-outs and record keeping.

So is scraping LinkedIn legal for outreach?

Here is the honest summary for a US-based team:

Criminal exposure for reading public pages: low, based on the CFAA reasoning above, though the key ruling was preliminary and narrow.
Contract and platform risk: high. LinkedIn bans scraping tools and enforces that through accounts and, occasionally, litigation.
Privacy risk: depends on whose data you collect, what you collect and what you do with it. Contact details of EU or UK residents, and data that people deliberately restricted, carry the most risk.

“Legal” and “safe for your business” are different questions. A tactic can be lawful and still cost you your best sales account.

What to check before you collect or use LinkedIn data

Use this as a pre-flight list before any prospecting workflow goes live.

Source. Can you see the data on a public page, or only because you are logged in or connected? Prefer sources a person has chosen to make public for professional contact.
Location of the person. Flag prospects in the EU, UK and states with strong privacy laws, and apply stricter handling to them.
Purpose and minimization. Collect only what you need to send a relevant business message: name, role, company, a verified work email. Skip personal details with no outreach use.
Accuracy. Wrong or outdated data is a privacy problem and a deliverability problem. Run every address through email verification before sending.
Retention. Set a deletion schedule for leads who never engage.
Opt-outs. Honor unsubscribe and deletion requests quickly, and keep a suppression list.
Account safety. Never run unattended automation on a personal LinkedIn profile you cannot afford to lose.
Documentation. Write down your lawful basis, your data sources and your retention rules. If a regulator or a prospect asks, you can answer.

A lower-risk way to build prospect lists

Most of the risk comes from bulk extraction from one platform. A calmer workflow separates discovery from data collection:

Discover manually. Use LinkedIn the way it is meant to be used: search, read and connect. Tools such as Sales Navigator help you narrow down accounts and roles through LinkedIn’s own interface.
Identify the company and role. Work from business-level facts: company domain, job title, department.
Enrich from business data sources. Lead enrichment adds work emails and firmographics from data sources other than a scraped LinkedIn session.
Verify. Remove invalid, risky and catch-all addresses before the first send.
Send relevant, compliant email. Lead with a reason you are writing to that person, identify yourself and include a clear opt-out.

For a deeper look at the email side of this, see our guide on LinkedIn email scraping and verifying before outreach.

Our perspective

We build cold email software, and we see the downstream result of collection decisions every day: bounces, spam complaints and damaged sender reputation. Our view is that how you get a list matters less to deliverability than how clean, relevant and recent it is, but it matters a great deal to your risk.

We would not tell anyone that scraping is simply fine. A narrow court win on public pages does not remove LinkedIn’s terms, and it does not remove privacy law. What we tell teams is to treat contact data as a liability as well as an asset: collect less, verify all of it, keep it only while it is useful and never send from infrastructure you cannot protect.

That is why PlusVibe focuses on the sending side: private warm-up, isolated sending infrastructure, inbox rotation and deliverability monitoring, so a good, compliant list reaches the inbox. Our Chrome extension helps collect prospect details, and we encourage teams to use it within the platform rules and the privacy law that applies to their market, then verify before they send.

— Yaro

From a verified list to the inbox

Once your list is lawful and clean, the next risk is sender reputation. Sending cold email from your main domain or from shared infrastructure puts the whole business on the line if complaints rise.

PlusVibe gives you private email warm-up, isolated sending infrastructure, inbox rotation and verification in one platform, with a free trial to test it. Published plans start with Personal at $37-$58 per month and Business at $77-$220 per month, and Agency starts from $497 per month. You can compare everything on the plans page, or look at our verification tools first.

If you would rather not manage mailboxes yourself, our done-for-you email setup handles the infrastructure at $1,500 per month.

Frequently asked questions

Is it legal to scrape LinkedIn profiles?

Scraping publicly visible pages is not a federal crime in the US on the reasoning of the Ninth Circuit’s hiQ ruling, but that ruling was preliminary and left other claims open. It does not override LinkedIn’s terms or privacy law. Treat it as a civil and regulatory risk question, not a green light.

Will LinkedIn ban you for scraping?

It can. LinkedIn does not permit scraping software or automation tools such as bots and browser extensions, and it runs technical defenses against them. The most common outcome is a restricted or closed account, so avoid running automation on a profile your sales team depends on.

Yes, when the data relates to people in the EU. Public availability does not remove the need for a lawful basis, transparency and a balancing test if you rely on legitimate interest. France’s CNIL fined a contact-data company €240,000 for collecting details people had restricted to their connections.

Is using LinkedIn data for cold email allowed?

Using a prospect’s business contact details to send a relevant, honest message can be lawful when you follow the rules for your market, including opt-outs and sender identification in the US. How you obtained the data and where the person lives change the analysis. Verify addresses and keep records of your sources.