LinkedIn
Instagram
WhatsApp
Telegrama
Gmail
Perspectivas
Google Agenda
Participe da comunidade do SlackhiQ contra LinkedIn: acordo no valor de $500.000, 6 de dezembro de 2022
O Scraping do LinkedIn é Legal? O Que o Registro Público Realmente Mostra
Pesquise "o scraping no LinkedIn é legal?" e a maioria das respostas se limita a uma única decisão de um tribunal de apelação de 2022. O mesmo caso foi encerrado oito meses depois com um acordo no valor de $500.000, uma liminar permanente e o encerramento definitivo das atividades do autor da ação. Essa discrepância entre a manchete e o desfecho é o tema central desta página.
A resposta curta
Comece com contas vinculadas, sem custo inicialSe a extração de dados do LinkedIn é legal não é uma questão, são três: se viola uma lei federal de acesso a computadores (o CFAA), se viola os próprios Termos de Serviço do LinkedIn e se o LinkedIn realmente aplica punições contra isso. A jurisprudência pública diz que acessar dados que não exigem login geralmente não constitui, por si só, uma violação do CFAA. Ela não diz nada sobre o contrato do LinkedIn, que é o caminho que o LinkedIn realmente utiliza para punir infrações. Esta página resume o que os registros judiciais públicos e a própria política do LinkedIn dizem. Isto não é aconselhamento jurídico.
Não é conselho jurídico
Esta página resume o que os registros judiciais públicos e a própria política publicada do LinkedIn dizem, a partir da data na parte inferior desta página. Não é uma recomendação sobre o que fazer na sua situação específica, nem é uma previsão do que um tribunal decidiria sobre seu produto, dados ou jurisdição específica. Leia as fontes diretamente e consulte um advogado qualificado antes de tomar qualquer decisão jurídica que dependa dos detalhes aqui abordados.
Índice
Definição e acesso
O que é considerado "scraping do LinkedIn"
"O "scraping do LinkedIn” é utilizado em configurações muito diferentes: um script que lê páginas de perfil renderizadas, uma extensão de navegador que lê o que já está na tela, uma ferramenta sem código conectada a uma conta ou um serviço que já criou um banco de dados dessa forma e agora revende consultas a ele. O que eles têm em comum não é a ferramenta, e sim o fato de que a coleta ocorre fora do uso que um membro autenticado faz de sua própria sessão, em um volume e padrão que nenhum ser humano conseguiria produzir navegando manualmente. Tratar todos eles como uma única questão do tipo “sim ou não” é o que gera as respostas genéricas e categóricas que esta página tenta evitar. As duas seções seguintes abordam o assunto separadamente: quais dados ficam atrás de qual barreira e qual método expõe você a quê.
A linha entre público e privado, por tipo de dado
Nem todos os dados do LinkedIn estão protegidos pela mesma barreira, e essa barreira é mais importante do que a ferramenta usada para acessá-los. Alguns campos ficam visíveis para qualquer pessoa que tenha o URL. Outros exigem que o usuário esteja conectado. Alguns poucos exigem o Sales Navigator ou o Recruiter, produtos pagos do próprio LinkedIn. Essa é a parte que a maioria dos guias ignora:
| Tipo de dado | Visível sem fazer login | Requer uma sessão iniciada | Requer o Sales Nav / Recruiter |
|---|---|---|---|
| Nome, título, foto | Normalmente | Sempre | Não |
| Empresa atual e cargo | Frequentemente | Sempre | Não |
| Histórico completo de trabalho e formação acadêmica | Raramente, visualização limitada | Detalhes completos | Não |
| Conexões e conexões mútuas | Não | Limitado, em termos de grau | Ampliado, entre redes |
| Postagens, artigos, atividades | Muitas vezes, se for público | Sempre | Não |
| Informações de contato (e-mail/telefone) | Não | Somente se for compartilhado | Sem acesso adicional |
| Filtros de pesquisa avançada, listas salvas | Não | Apenas pesquisa básica | Conjunto completo de filtros |
É também nesse ponto que a exposição é mal interpretada: o fato de um campo ser visível ao público não isenta a coleta automatizada desse campo das disposições da Seção 8.2 dos Termos de Serviço do LinkedIn. Isso afeta a questão relacionada à CFAA, abordada mais adiante, e não a questão contratual, que é aquela que o LinkedIn realmente aplica.
Cinco métodos, classificados por risco
A forma como você extrai dados do LinkedIn influencia mais o que você vê do que os próprios dados extraídos. Cinco métodos abrangem praticamente todas as configurações reais. Nenhum deles está isento de riscos, e esta tabela não recomenda uma frequência ou um limite; o LinkedIn não publica esses valores e nós também não. Ela mostra onde cada método se encaixa estruturalmente.
| Método | O que ele pode alcançar | Onde quebra primeiro | Perfil de risco |
|---|---|---|---|
| Navegação manual | Tudo o que a pessoa puder ler e clicar, um perfil por vez. | Your own time. It doesn't scale past casual research. | Mínimo |
| Browser extension | What's rendered on screen, inside one browser session, one account. | The extension itself: LinkedIn's own client-side detection and Google's Manifest V3 deprecation both target this layer, independently. | Elevated |
| No-code / SaaS automation tool | Whatever the vendor's shared infrastructure is built to reach, running against your linked account. | The vendor. If LinkedIn identifies the pattern once, every customer sharing that infrastructure is exposed at the same time. | Elevated |
| Custom code, independent index | Whatever your own infrastructure allows, collected outside any single member's session. | Nothing, technically, until it's caught. This is the exact structure every case below targeted. | Alta |
| API baseada em conta | What one authenticated, linked member's own account can already see. | Nothing structurally new: it removes one failure mode, a shared index taken down for every customer at once, not Section 8.2 from the linked account itself. | Different, not zero |
The last row is covered in detail in the guide to retrieving LinkedIn data through an API, and again further down under what changes with Unipile.
Você pode ser banido por isso?
Every method above carries some exposure to LinkedIn restricting the account behind it. What triggers a review isn't published, and this page won't guess. But the enforcement actions further down, and independent reporting on LinkedIn's own detection systems, point to a consistent set of signals rather than a single tripwire.
VelocityA pace of profile views, connection requests, or messages that doesn't match how a person browses, holds, reads, and pauses.
Behavioral patternThe same sequence repeated identically across sessions, without the variation a human introduces.
Browser & device fingerprintAutomation frameworks and headless browsers leave signatures a normal session doesn't. LinkedIn's own client-side scanning for known extension and automation signatures has been independently documented.
Connection wallsIdentity checkpoints or re-verification prompts LinkedIn triggers when an account's activity looks unusual, whether or not that activity is automated.
None of this is a checklist for staying under a radar, we're not publishing one. LinkedIn doesn't publish thresholds, and a "safe" cadence would be a guess dressed up as a fact. What's documented is that detection is layered, and the consequence, when it lands, ranges from a restricted account to the page removals and lawsuits covered next.
The three legal layers, and how hiQ actually ended
"Is LinkedIn scraping legal" is really three questions. Is it a crime under the Computer Fraud and Abuse Act (CFAA), a US federal statute? Case law says accessing data any visitor can already see without logging in generally isn't, by itself, unauthorized access. Is it a breach of contract, of LinkedIn's Terms of Service? Yes, without ambiguity, Section 8.2 prohibits automated collection regardless of the CFAA question. Will it actually be enforced? That's the question with real consequences, answered in the next section.
The CFAA finding above comes from a single case, hiQ Labs v. LinkedIn, and the part most summaries leave out is how it ended.
| Data | O que aconteceu |
|---|---|
| 2017 | hiQ Labs sues LinkedIn after LinkedIn sends a cease-and-desist letter and moves to block hiQ's access to public profile data. |
| April 2022 | The Ninth Circuit affirms that accessing publicly viewable LinkedIn profile data likely does not violate the CFAA. This is the ruling most "scraping is legal" articles stop at. |
| 1 August 2022 | The district court dissolves the preliminary injunction that had kept hiQ's access open, on separate grounds tied to LinkedIn's Terms of Service claim. |
| 6 December 2022 | Consent judgment: hiQ agrees to pay LinkedIn $500,000, a permanent injunction bars any further collection, and hiQ is ordered to destroy the code, data, and algorithms built on it. hiQ no longer operates. |
The April 2022 line is what most "scraping is legal" headlines cite. The ending is what they skip: the same case closed eight months later with the plaintiff paying LinkedIn and shutting its product down, on the contract theory the CFAA ruling never touched. Full docket history: hiQ Labs v. LinkedIn on Wikipedia, o Decisão de apelação de abril de 2022, and the December 2022 consent judgment coverage.
The criminal terrain: CFAA
The Ninth Circuit held that accessing publicly viewable pages, without logging in, isn't unauthorized access under the CFAA.
That answers a federal computer-access statute question. It says nothing about LinkedIn's own contract.
The contractual terrain: Terms of Service
Section 8.2 of LinkedIn's User Agreement prohibits automated collection, regardless of whether the data was public.
This is the terrain LinkedIn actually enforces on: account restriction, page removal, or a lawsuit.
hiQ won the first, lost the second. The second is what ended the company, and it's the terrain nearly every case in the next section runs on.
O que o LinkedIn realmente faz
Whatever the legal analysis says on paper, the risk that shapes a product decision is what LinkedIn has actually done. Five actions across roughly two years, including two lawsuits, show a pattern rather than an isolated exception.
| Data | O que aconteceu |
|---|---|
| Janeiro de 2025 | LinkedIn files a federal suit against Nubela, the company behind Proxycurl, alleging hundreds of thousands of fake accounts were used to collect millions of LinkedIn profiles, resold through Proxycurl's API. Full detail in our Proxycurl shutdown breakdown. |
| 6 March 2025 | LinkedIn blocks platform access and removes the company pages of Apollo.io and Seamless.AI. Apollo's CEO states the company is "actively working with LinkedIn to understand the nature of our brand page restriction." |
| 4 de julho de 2025 | Proxycurl shuts down after settling. Founder Steven Goh writes publicly that "there is no winning in fighting this." |
| 3 October 2025 | LinkedIn sues ProAPIs and its CEO, alleging an "industrial-scale fake account mill" reselling access for up to $15,000 a month per client. LinkedIn says it detected the operation "within hours." |
| 25 March 2026 | LinkedIn removes HeyReach's company page, then followed by roughly 16,400 people, and restricts the personal profiles of its CEO, CTO, CRO, and CMO, with no prior notice. |
Not every automated tool touching LinkedIn data gets sued. But the pattern runs on the contract terrain above, not the CFAA. LinkedIn's own Help Center page on prohibited software and extensions states that accounts using unauthorized tools "risk having their accounts restricted or shut down" without notice. The lawsuits above are the visible end of that policy; account and page restrictions are how it plays out for everyone else.
E, com o Unipile, quais são os riscos que corro?
The account-based row above is the model Unipile runs on: each request executes on behalf of one authenticated, linked account, scoped to what that member can already see. What that changes, and what it doesn't:
Observação sobre Manipulação de DadosNo independent index behind the API
Recuperação em tempo real, em nome do usuário autenticado: profile and message data moves through the linked account's own session, scoped to what that member already sees.
Nenhum arquivo paralelo: Unipile doesn't build or resell a database of LinkedIn profiles. What moves through the API reaches your product, not a separate archive.
Como a Unipile OperaSem credenciais compartilhadas, sem elevação de acesso
Intermediário técnico independente: A Unipile age em nome de cada usuário autenticado, dentro de uma sessão que pertence a ele, não como um revendedor de dados e não em nome do LinkedIn.
Não afiliado, endossado ou patrocinado pelo LinkedIn. Each linked account is isolated; no credentials are shared across your customers.
Limites da Plataforma e Uso ResponsávelUnipile relays LinkedIn's own limits, it does not lift them
Os limites são repassados, não removidos: retrieval and messaging stay inside the same limits a member would hit inside LinkedIn's own interface.
Cadence stays a customer-side decision: the API executes what your product and your users decide to send, on a per-user basis. It doesn't set a pace on their behalf.
None of this removes exposure, it changes its scope. LinkedIn's Terms of Service still apply to every linked account exactly as if that member used LinkedIn directly. This narrows one failure mode, a single shared index taken down for every customer at once. It does not put any customer outside those terms, and this page isn't a substitute for reading them.
Uma integração, um esquema, no LinkedIn, WhatsApp, Instagram, Telegram, e-mail e calendários. Hosted authentication and retrieval on behalf of each linked account, instead of an index built outside it.
Comece a construirTrês lugares para ir mais fundo: o guia para recuperar dados do LinkedIn em seu próprio software, como as principais opções da API do LinkedIn se comparam, and the Proxycurl shutdown, in full.
Audite seu próprio produto
This isn't a legal test, only a lawyer reviewing your setup can give you that. It's the checklist we can actually publish: five questions mapping roughly to the difference between structures enforcement has targeted, and the ones it hasn't, so far.
01
ContasDoes every LinkedIn account your product touches belong to a real member who authenticated it themselves, or does your product create accounts that don't belong to anyone?
02
IndexDoes data stay scoped to what one authenticated member's session can see, or does your product build and retain an index that exists independent of any single member's access?
03
AttributionFor any given action your product takes on LinkedIn, can you point to the one authenticated user who triggered it, or could you not say?
04
LimitesDoes your product relay LinkedIn's own connection, search, and messaging limits to the end user, or does it try to push past them on the user's behalf?
05
Base legalDo you have a documented legal basis for processing this data, and, if you or your users are in the EU, a DPA in place with whichever provider sits underneath?
If you get a letter, or your page disappears
None of the cases on this page involved a warning. Apollo and Seamless lost their company pages, with a note from LinkedIn after the fact. HeyReach's team wrote about its own removal:
"No notice, no communication. We just couldn't get in anymore."
A handful of documented patterns, not legal advice, on what companies in this spot have actually done:
1
Don't respond in writing before counsel reviews itThe clearest public account of a cease-and-desist response, an HN thread from a Chrome extension developer, converges on one point: what you say before a lawyer reviews it can matter more than what you did.
2
Check what's actually restrictedIn the documented cases, the product kept working, HeyReach's customer accounts and campaigns continued, Apollo's product stayed operational, while the company page or founders' personal profiles were what got hit.
3
Preserve the notice and the timelineWhat changed, when, and what the notice actually said, not a summary of it, is what counsel will ask for first.
4
Revisit the architecture, not just the letterIf more than one answer in the self-check above points the wrong way, the letter is a symptom, not the problem.
Is LinkedIn scraping legal: your questions answered
The CFAA question, the Terms of Service question, detection, and what LinkedIn has actually enforced.
It depends which question is being asked. Case law such as hiQ Labs v. LinkedIn establishes that accessing data any visitor can view without logging in generally does not violate the CFAA. That same case still ended in a $500,000 settlement and a permanent injunction under a separate breach-of-contract theory, and hiQ no longer exists. This page summarizes public case law and policy; it is not legal advice for your specific situation.
It depends on the jurisdiction, whether the data required logging in, and what contract governs the account collecting it. US case law treats publicly viewable data differently from data behind a login wall, and both are separate from a breach of LinkedIn's Terms of Service, its own track.
Not automatically, and not automatically legal either. US case law says collecting publicly visible data doesn't, by itself, violate the CFAA. It says nothing about LinkedIn's Terms of Service, which separately prohibit automated collection and which LinkedIn enforces through lawsuits, page removals, and account restrictions.
Yes. Section 8.2 of LinkedIn's User Agreement prohibits third-party software, crawlers, bots, and browser extensions that collect data or automate activity, regardless of whether that data is publicly visible. LinkedIn's Help Center page on prohibited software and extensions states that accounts using such tools risk being restricted or shut down without notice.
A US case in which the Ninth Circuit found, in April 2022, that collecting data visible without logging in likely doesn't violate the CFAA. It didn't end there: on 6 December 2022, a consent judgment ordered hiQ to pay LinkedIn $500,000, imposed a permanent injunction, and required it to destroy its code and data. hiQ no longer operates.
Each lawsuit covered here targets companies LinkedIn alleges built large-scale fake account networks to collect data at volume and resell it through an API. The suits against Nubela (Proxycurl, January 2025) and ProAPIs (October 2025) both make this allegation, on breach-of-contract grounds tied to LinkedIn's Terms of Service.
O LinkedIn processou a Nubela, a empresa por trás do Proxycurl, em janeiro de 2025, alegando que centenas de milhares de contas falsas foram criadas para coletar milhões de perfis do LinkedIn para revenda por meio da API do Proxycurl. O caso foi resolvido em acordo, e o Proxycurl foi desativado em 4 de julho de 2025.
Public reporting and LinkedIn's own policy point to a layered approach: unusual velocity, repeated identical patterns across sessions, browser and device fingerprinting, and identity checkpoints triggered when activity looks unusual. LinkedIn doesn't publish a specific threshold, and this page doesn't estimate one.
This is not legal advice for your situation, but documented cases show a pattern: don't respond in writing before a lawyer reviews it, confirm what's actually restricted (the product often keeps working while a page or personal profile is what's hit), and preserve the notice and timeline for counsel.
An API retrieving data on behalf of an authenticated member's own linked account, scoped to what that member can already see, is structurally different from the independent, bulk-collected indexes targeted in the cases here. That difference doesn't remove LinkedIn's Terms of Service from applying to the linked account.
No. It narrows one failure mode, a single shared index that can be targeted once and taken down for every customer at once, but it doesn't put any account outside LinkedIn's Terms of Service or make an integration immune to limits, restrictions, or review.
Não. O Unipile é um intermediário técnico independente, não afiliado, endossado ou patrocinado pelo LinkedIn. Ele atua em nome de cada usuário autenticado dentro de uma sessão que pertence a ele, e não em nome do LinkedIn. O LinkedIn é uma marca comercial da LinkedIn Corporation.
Ainda tem dúvidas? Nossa equipe está aqui para ajudar.
Build a LinkedIn data layer scoped to each linked account
Construa sua primeira integraçãoAutenticação hospedada, recuperação em nome de cada conta vinculada e um único esquema para LinkedIn, WhatsApp, Instagram, Telegram, e-mail e calendários. Não é necessário cartão de crédito para começar.
Fontes
12 references, September 2026Every date and figure here traces to the source below. Cases settle and policies update without notice, so treat this as a snapshot, not a permanent status, and not legal advice.
Ajuda do LinkedInSoftware e extensões proibidos, the official policy referenced throughout.
Contrato do Usuário do LinkedInSeção 8.2, o base contratual para as ações de imposição do LinkedIn.
hiQ Labs v. LinkedInHistórico do caso via Wikipédia.
Nono CircuitoO Decisão de apelação de abril de 2022 on the CFAA question.
Privacy WorldCoverage of the Sentença por acordo de dezembro de 2022 that ended hiQ's case.
NubelaO próprio fundador Proxycurl shutdown announcement, 4 July 2025.
O RegistroLinkedIn v. ProAPIs, protocolado em 3 de outubro de 2025.
MartechApollo.io and Seamless.AI removed from LinkedIn, 6 March 2025.
HeyReachHeyReach's own account of its 25 March 2026 company page removal.
Hacker NewsO Browserflow cease-and-desist thread, 30 January 2023.
BleepingComputerReporting on LinkedIn's client-side extension scanning, April 2026.
Documentos do desenvolvedor da UnipileCompleto Referência de API e guia de introdução para a integração com o LinkedIn.
Last updated September 2026. This page is not legal advice; it summarizes public court records and platform policy as of the date above, and you should consult a qualified attorney for guidance specific to your situation. Unipile is an independent technical intermediary and is not affiliated with, endorsed by, or sponsored by LinkedIn. Volume, cadence, and content of any action taken through the API remain a customer-side decision, consistent with LinkedIn's Terms of Service and applicable data protection regulations (GDPR).
BR 
EN 
FR 
ES 
DE 
IT 
NL 
PL 
TR