Is LinkedIn Scraping Legal? How to Do Outreach Without Breaking Privacy Laws or Getting Banned

The answer to “is LinkedIn scraping legal” changes with the rulebook: collecting public profile data is unlikely to be a US federal crime. Yet it breaks LinkedIn’s User Agreement, and GDPR governs every record you store on people in the EU or UK. 

We traced the main scraping lawsuits and fines since December 2024, and the companies hit were building and selling profile databases. 

Sales leaders and RevOps teams running targeted outreach from their own accounts face smaller risks: with small lists, minimal records and a human pace, a ban is unlikely, though no setup removes the risk entirely.

Here’s what we’ll cover:

• The three legal questions behind LinkedIn scraping, and how the hiQ case ended.
• What GDPR asks of you, with a seven-step checklist grounded in a real €240,000 fine.
• LinkedIn’s lawsuits, judgments and bans since 2025, in one timeline.
• Why scraping tools get accounts banned, and five steps to build prospect lists more safely.

Not legal advice: court records, regulator decisions and LinkedIn’s User Agreement are cited as they stood in October 2026. If your team stores personal data from LinkedIn, check your setup with your data protection officer (DPO) or legal counsel.

Key Takeaways

• Whether LinkedIn scraping is legal comes down to three questions: US computer-access law, LinkedIn’s User Agreement and privacy law. Each one gives a different answer.
• Scraping public profiles is unlikely to be a crime under the US Computer Fraud and Abuse Act (CFAA), yet it still breaches LinkedIn’s User Agreement. hiQ won the 2022 ruling and still ended up with a $500,000 judgment against it and its data deleted.
• Under GDPR, public data is still personal data. You need a legal basis, a notice to the person, a retention limit and a way to honor objections.
• LinkedIn’s lawsuits since 2025 target fake accounts and resold databases, while machine-like tools get accounts restricted. Small, purposeful lists worked at a human pace lower both risks.
• Expandi runs outreach on your own account from a dedicated, country-matched IP, with a 14-day warm-up and limits you set, on lists you build and control.

Is LinkedIn Scraping Legal? How to Do Outreach Without Breaking Privacy Laws or Getting Banned

Is LinkedIn scraping legal? The three questions behind it

Whether LinkedIn scraping is legal depends on which law you ask. 

Under US computer-access law, collecting public pages is unlikely to be a crime, while LinkedIn’s User Agreement, the contract every member accepts, prohibits scraping outright.

Privacy law, GDPR above all, sets the rules for what you do with the data once you have it. Scraping public pages can clear the first layer and still fail the other two.

Each legal layer treats LinkedIn scraping differently:

What the hiQ case decided about LinkedIn scraping

hiQ won the headline ruling and still lost the case. 

hiQ Labs, a startup that sold workforce insights built on public LinkedIn profiles, sued after LinkedIn tried to cut off its access. 

In April 2022, the Ninth Circuit held that scraping public profiles likely doesn’t break the CFAA, because a page anyone can open has no password gate to get past. 

That’s the ruling behind every “scraping is legal” headline. However, the headlines stop there.

Later in 2022, the court found hiQ had broken LinkedIn’s User Agreement by scraping and by using fake profiles. In December 2022, hiQ and LinkedIn settled: hiQ accepted a $500,000 judgment and a permanent injunction against scraping LinkedIn, and it had to destroy its code and the data it had collected. 

The company is now defunct.

What LinkedIn’s User Agreement says about scraping and automation

LinkedIn’s User Agreement bans both scraping and automation, public data included, and every member agrees to it at sign-up. Section 8.2 rules out using “software, devices, scripts, robots” or browser plugins “to scrape or copy” profiles, and using “bots or other unauthorized automated methods” to add contacts or send messages.

That second rule covers automation tools too, Expandi included. So no vendor can honestly claim to be compliant with LinkedIn’s User Agreement. 

For anyone using automation, the question that counts is account risk: how much the activity looks like a person working their own profile.

Is LinkedIn scraping legal under GDPR?

Under GDPR, LinkedIn scraping is legal only if you handle the data the way the law requires, because a public profile is still personal data. 

Once a name or title lands in your spreadsheet or CRM, you need a legal basis, you have to tell the person, and you have to delete the record on schedule and answer their requests. The UK GDPR works the same way, and US state laws such as California’s CCPA add notice and opt-out rights of their own.

France’s data protection regulator, the CNIL, showed what that means in practice. In December 2024, it fined a contact-data Chrome extension €240,000, in a decision agreed with all its EU counterparts. 

The extension showed users the contact details of people whose LinkedIn profiles they visited, pulled from a database of about 160 million contacts.

The CNIL found four problems:

• It collected contact details people had limited to their connections.
• It kept records for five years after every update, so the clock kept resetting.
• It waited four years to tell people their data had been collected, and then wrote to them in English.
• When people asked where their data came from, it only said “publicly accessible sources.”

The company was ordered to stop collecting contact details people had restricted, delete what it had gathered that way, stop resetting its retention clock, and fix how it informs people and answers their requests. 

For a sales team, two rules follow: a visible profile still has fields you can’t take, and every record needs an expiry date.

The 7-step GDPR checklist for prospecting from LinkedIn

To prospect from LinkedIn under GDPR, work through these seven steps:

1. Document your legal basis. B2B prospecting can rely on legitimate interest under Article 6(1)(f) of the GDPR. To use it, write down a balancing test that weighs your interest against the person’s rights and reasonable expectations.
2. Respect visibility settings. Leave out contact details people have limited to their connections, which was the core of the CNIL fine.
3. Keep the minimum. Name, role, company and profile URL cover a first message, so skip any field you can’t justify for the outreach itself.
4. Tell people where their data came from. For data you didn’t collect from the person directly, Article 14 requires a notice within one month, or with your first message if that comes sooner, and that message must also flag their right to object. A short source line, a separate opt-out line and a privacy-notice link are a practical way to cover both.
5. Set a retention period. Pick a window that fits your sales cycle, write it down, and delete non-responders when it ends.
6. Honor objections and access requests on time. Stop outreach as soon as someone objects, answer access requests within one month, and keep a do-not-contact list so an opt-out sticks across every campaign and teammate.
7. Check e-privacy rules before switching channels. Moving a LinkedIn contact to another channel brings in national e-privacy laws, the rules that govern electronic marketing, and they differ by country. Confirm them for each market you sell into.

If you’re a sales leader, RevOps lead or agency owner clearing a vendor with legal, our compliance checklist for enterprise buyers covers the vendor side: data processing agreements (DPAs), privacy policies and the safeguards for moving data outside the EU.

LinkedIn data scraping lawsuits and bans since 2025

Since 2025, LinkedIn has responded to data scraping with lawsuits, final judgments and platform bans. The lawsuits share a pattern: 

• Fake accounts. 
• Bulk databases.
• Resale of scraped profiles. 

Tools and accounts that pull data or automate in bulk get restricted or removed, sometimes with no stated reason.

Six enforcement events since March 2025 show where LinkedIn draws its lines, newest first:

The founder of the shut-down API put the economics bluntly, writing that “there is no winning in fighting this.” 

The founder gave two reasons: 

• A court win would not have recovered the company’s legal fees. 
• LinkedIn, owned by Microsoft, could outspend it.

LinkedIn scraping vs prospecting: why the specific wording matters

LinkedIn data scraping means extracting profiles in bulk to build a database. 

Prospecting means finding the right people and starting a relevant conversation with each one.

The two can start from the same search results, but they differ in volume, storage and purpose, and those differences decide your legal and account risk.

Scraping and prospecting differ on five points that matter to regulators and to LinkedIn:

An SDR or founder who says “scrape” may only mean “build a list from a search.” 

The verb matters less than what happens next: how much you take, what you store, and whether each record leads to a real conversation. Teams prospecting with AI get judged the same way, since an AI agent that enriches thousands of profiles is still building a database.

Michael Kamleitner, CEO of Walls.io, a platform that aggregates user-generated content, explained in a GTM Society interview how the Walls.io team works a trade show’s attendee list:

“We really do care a lot about filtering down to our ICP… And then we are putting that into a customized outreach campaign.”
Michael Kamleitner, Walls.io

Why LinkedIn scraping tools can get accounts banned

A LinkedIn scraping tool gets accounts banned because a scraper’s activity looks nothing like a person’s. 

LinkedIn watches for code in the browser, page-view volumes no human produces, and logins that jump between locations. Any one of these can trigger a restriction, sometimes without warning.

Five triggers sit behind a LinkedIn scraper ban:

• Browser extensions. An extension runs inside the LinkedIn tab, where LinkedIn’s own page code can inspect it. The BrowserGate report, published in March 2026 by Fairlinked e.V., a European association of commercial LinkedIn users, found that LinkedIn scans for browser extensions, checking visitors against a list of 6,222.
• Bulk page views. A scraper opens profiles at a pace and volume no person reading LinkedIn could match.
• Over-limit volume. LinkedIn caps weekly invitations without publishing a fixed number, and our guidance on LinkedIn’s weekly connection limit is to stay within about 100 requests a week. Volume well above that stands out on its own.
• Shared infrastructure and fake accounts. Tools that route multiple users through the same IPs, or run pools of fake profiles, let LinkedIn connect every account that shares them.
• Mismatched logins. An account that logs in from one country while a tool acts from another looks compromised.

For recovery steps, see what to do if your LinkedIn account is restricted.

How to build prospect lists on LinkedIn more safely

Safer LinkedIn prospecting comes down to two habits: build small, purposeful lists from your own account, and run outreach at a pace a person could keep up. 

Every automation tool carries some restriction risk, and Expandi is no exception, so the goal is lowering the odds. 

Five steps cover both habits, in the order you’d set them up.

Step 1: Strengthen your profile before outreach

Prospects check your profile before they accept, and a complete, active profile reads as a real person. Fill every section, post or comment regularly, and track your Social Selling Index as a rough health score.

Step 2: Build lists from your own searches and engaged people

Start with LinkedIn or Sales Navigator searches you run yourself, then add people who’ve already shown interest: profile visitors, post engagers and event attendees. 

Before you connect, view each contact’s profile and like a recent post, so your connection request arrives from a name they’ve already seen.

Step 3: Keep only the fields you need, and document why

Set your CRM or list export to carry only the fields a first conversation needs, then write down why you hold each one. 

That note doubles as the start of your balancing test.

Step 4: Run outreach from the cloud at a human pace

Run outreach from a cloud-based tool, so nothing sits in your browser for LinkedIn to scan, and give each account one dedicated IP. When you warm up an account, ramp activity gradually and keep daily and weekly limits conservative. 

Then watch your acceptance rate as a safety metric: across 13.2 million connection requests in our State of LinkedIn Outreach H2 2026 report, 28.5% were accepted, a useful reference point until you have a baseline of your own. A sustained drop below that baseline is a signal to slow down and fix targeting before it turns into a restriction.

Step 5: Set a retention period and honor opt-outs

Put the retention window into your CRM as a scheduled cleanup that deletes non-responders when it ends, and sync your do-not-contact list to every campaign before launch.

Where Expandi fits in a safer LinkedIn prospecting workflow

Expandi is an outreach automation platform that runs actions on your own LinkedIn account. 

It doesn’t build, sell or rent a database of LinkedIn profiles, and it creates no fake accounts. Lists come from searches you run in your own account, people who engaged with you, or files you import, and you decide what to keep and why. 

Under GDPR, that makes the data your responsibility.

Five Expandi features shape how outreach runs on your account:

• Cloud execution with one dedicated, country-matched IP per account. Nothing runs in your browser, so there’s no extension for LinkedIn to detect.
• A 14-day gradual warm-up that starts at 5 actions a day and rises to 21, followed by daily limits you set: a safe preset, or custom ranges per action.
• Signals campaigns that start from a person’s own action, such as a profile visit, a company page visit, or a like or comment on a post, so outreach goes to people who have already shown interest in you or your company.
• Condition-based Campaign Builder that checks whether a connection request was accepted before the next step, with delays you set between actions.
• Workspaces where each teammate or client connects their own LinkedIn account and access is shared by invite, with roles and permissions that control who can view or manage each account.

These are the same five factors we check when we score LinkedIn tools on safety (including Expandi), where the tool runs, the IP setup, warm-up and limits, pacing, and vendor transparency. No tool is zero-risk, but the right setup lowers the odds.

Prospecting on LinkedIn with less legal and account risk

Whether LinkedIn scraping is legal splits three ways: 

• Collecting public pages is unlikely to be a US crime.
• Scraping still breaks LinkedIn’s User Agreement. 
• GDPR governs every record you store. 

Lowering your legal and account risk comes down to prospecting with a purpose. 

Build lists from your own searches, keep a minimal record with a documented reason, tell people where their data came from, and run outreach at a human pace. 

See how a warm-up and per-account limits work on one account: try Expandi free for 7 days.

Frequently asked questions

Irakli Zviadadze

Professional content, copy, and everything-in-between writer. Irakli has been writing words for money for a while now. Words that have generated $$$, traffic, clicks, leads, and more. Started with content mills and product descriptions. Ended up doing content, SEO, landing pages, advertorials, ghostwriting, and whole bunch of other stuff. Firm believer in 'jack of all trades master of none, though oftentimes better than master of one'. Loves writing about himself in the third person. He definitely didn't use ChatGPT to help with this.