Is LinkedIn scraping legal? hiQ v. LinkedIn, the User Agreement and GDPR

There is no single yes or no. In hiQ v. LinkedIn the Ninth Circuit twice upheld an injunction that kept LinkedIn from blocking a company scraping public profiles, but that was a preliminary ruling on specific claims, and the case later ended with a finding that hiQ breached LinkedIn's User Agreement. LinkedIn's terms forbid scraping, and data protection law applies to the personal data you collect. Scraping can be defensible in one respect and still be risky in another.

This is not legal advice. It summarises public documents as we read them on 25 October 2026. Courts, terms and regulators change their positions, so read the originals and ask a lawyer who knows your jurisdiction if the decision matters to your business.

People ask "is LinkedIn scraping legal?" as if the law were one rule. It is at least four: the computer access statutes, contract law (LinkedIn's terms), data protection law, and the platform's own enforcement. A scraper can pass one and fail another.

What did hiQ v. LinkedIn decide?

hiQ was a data analytics company that collected public LinkedIn profiles for products that told employers which staff might leave. LinkedIn sent a cease and desist letter and blocked hiQ, and hiQ sued. The key steps:

The 2022 opinion is worth reading in its own terms. The court affirmed an order preliminarily enjoining LinkedIn from denying hiQ access to publicly available member profiles. It concluded that Van Buren reinforced its view that hiQ had raised serious questions about whether LinkedIn may use the Computer Fraud and Abuse Act to pre-empt hiQ's possibly meritorious tortious interference claim. In plain terms: at the preliminary stage, the court doubted that the federal computer crime law was the right tool to stop access to profiles anyone can see.

Three limits on what that means:

• It was a preliminary ruling. It did not finally decide the merits.
• It concerned one statute, the CFAA, and a state law claim. It did not decide whether scraping is lawful under contract law or data protection law.
• It concerned public profiles. The court's reasoning leaned on the idea that, for the CFAA's "without authorization" clause, some form of gate such as password authentication is generally required, and public pages have none. Data behind a login is a different question. The ruling binds courts in the Ninth Circuit's region; elsewhere it is persuasive at most.

The later outcome matters as much. According to a law firm report (Proskauer Rose, 8 December 2022), the district court ruled on 4 November 2022 that hiQ had breached LinkedIn's User Agreement through its scraping and its creation of fake accounts, and in December 2022 the parties filed a proposed consent judgment that would have hiQ pay $500,000, stop scraping LinkedIn and delete the data. Winning a point on the CFAA did not protect hiQ from a contract claim.

What does LinkedIn's User Agreement say?

LinkedIn's User Agreement, in the version effective 3 November 2025, lists things members must not do in section 8.2. The relevant items:

LinkedIn's Help page on prohibited software adds that it does not permit third party software, including browser extensions, that scrapes, changes the look of or automates activity on the site, and that members who use such tools risk having their accounts restricted or shut down. Our LinkedIn terms and automation post goes through these clauses in full.

So even if a court would not call scraping a crime, LinkedIn treats it as a contract breach that can cost you the account, and the hiQ outcome shows the contract claim can succeed.

What does GDPR add?

Public availability does not switch off data protection law. If you collect personal data about people in the EU, the GDPR generally applies. Three points from the official text:

• You need a legal basis for processing. Which one fits depends on your purpose, and this is where a lawyer is useful.
• Article 14 covers data you did not collect from the person. You must give them information such as your identity, the purposes, the categories of data and the source. The deadline is within a reasonable period and at the latest within one month, or at the latest at the first communication if you will contact them. There are exceptions, such as where it would involve a disproportionate effort.
• Article 21 gives individuals the right to object to direct marketing at any time.

Our post on how to answer "how did you get my data" shows what a compliant answer looks like in practice, and the cold email legality post compares the main regimes.

Where does that leave a business that wants LinkedIn leads?

A way to think about it, labelled as our view, not a rule:

You will notice this avoids running your own scraper. Scraping at scale puts you in conflict with the terms, risks your account and creates data protection duties for data you hold in bulk.

How does Sellinger work with LinkedIn?

From our fact register: you connect your own LinkedIn account through a hosted login, and Sellinger does not store your LinkedIn password. Each account has a daily invitation limit (default 20, varied by a few each day), a weekly cap (default 150) and a quiet window with no sending. You can connect through your own proxy. Before every send the platform checks the team's suppression list, and when a contact replies with an opt out, the agent stops. An erasure function anonymizes matching leads and adds the identifiers to the suppression list.

This post does not make claims about how any third party data source was compiled. Ask any data provider that question in writing. LinkedIn's rules on automation apply to the account you connect, and no tool can guarantee that LinkedIn will never restrict an account. The automation safety post explains the risks in detail.

A short checklist

1. Read section 8.2 of the User Agreement before you choose a tool.
2. Do not run scrapers against your own account.
3. Ask every data vendor where its data comes from and how it handles objections.
4. Record the source of every lead.
5. Honour opt outs everywhere, at once.
6. Take legal advice for the countries you target.

This is not legal advice.