LinkedIn
Instagram
WhatsApp
Telegramm
Google Mail
Ausblick
Google Kalender
Slack-Gemeinschaft beitretenhiQ v. LinkedIn: $500,000 settlement, 6 Dec 2022
Ist das Scraping von LinkedIn legal? Was die öffentlichen Aufzeichnungen tatsächlich zeigen
Search "is LinkedIn scraping legal" and most answers stop at a single 2022 appeals court finding. The same case closed eight months later with a $500,000 settlement, a permanent injunction, and the plaintiff shutting down for good. That gap between the headline and the ending is most of what this page is about.
Die kurze Antwort
Build on linked accounts, free to startWhether LinkedIn scraping is legal is not one question, it is three: whether it breaks a federal computer-access statute (the CFAA), whether it breaks LinkedIn's own Terms of Service, and whether LinkedIn actually enforces against it. Public case law says accessing data that does not require logging in generally is not, by itself, a CFAA violation. It says nothing about LinkedIn's contract, which is the track LinkedIn actually enforces on. This page summarizes what public court records and LinkedIn's own policy say. It is not legal advice.
Not legal advice
This page summarizes what public court filings and LinkedIn's own published policy say, as of the date at the bottom of this page. It is not a recommendation for what to do in your specific situation, and it is not a prediction of what a court would decide about your particular product, data, or jurisdiction. Read the sources directly, and talk to a qualified attorney before making a legal decision that depends on the details covered here.
Inhaltsübersicht
Definition & access
What counts as "LinkedIn scraping"
"LinkedIn scraping" gets used for very different setups: a script reading rendered profile pages, a browser extension reading what's already on screen, a no-code tool signed into an account, or a service that already built a database this way and now resells lookups against it. What they share isn't the tool, it's that the collection happens outside an authenticated member's own use of their own session, at a volume and pattern no single human produces browsing manually. Treating all of them as one yes-or-no question is what produces the confident, generic answers this page tries to avoid. The next two sections split it apart: which data sits behind which wall, and which method exposes you to what.
The public/private line, by data type
Not all LinkedIn data sits behind the same wall, and the wall matters more than the tool used to reach it. Some fields are visible to anyone with the URL. Others require a logged-in session. A handful require Sales Navigator or Recruiter, LinkedIn's own paid products. This is the line most guides skip past:
| Data type | Visible without login | Requires a logged-in session | Requires Sales Nav / Recruiter |
|---|---|---|---|
| Name, headline, photo | Usually | Immer | Nein |
| Current company & title | Often | Immer | Nein |
| Full work & education history | Rarely, capped view | Full detail | Nein |
| Connections & mutual connections | Nein | Limited, by degree | Extended, cross-network |
| Posts, articles, activity | Often, if public | Immer | Nein |
| Contact info (email/phone) | Nein | Only if shared | No added access |
| Advanced search filters, saved lists | Nein | Basic search only | Full filter set |
This is also where exposure gets misjudged: a field being publicly visible doesn't put automated collection of it outside Section 8.2 of LinkedIn's Terms of Service. It affects the CFAA question covered further down, not the contract question, which is the one LinkedIn actually enforces on.
Five methods, ranked by risk
How you retrieve LinkedIn data changes what you're exposed to more than what data you retrieve. Five methods cover almost every real setup. None is risk-free, and this table doesn't recommend a cadence or threshold, LinkedIn doesn't publish one and neither do we. It shows where each method sits structurally.
| Methode | What it can reach | Where it breaks first | Risk profile |
|---|---|---|---|
| Manual browsing | Whatever a person can read and click, one profile at a time. | Your own time. It doesn't scale past casual research. | Minimal |
| Browser extension | What's rendered on screen, inside one browser session, one account. | The extension itself: LinkedIn's own client-side detection and Google's Manifest V3 deprecation both target this layer, independently. | Elevated |
| No-code / SaaS automation tool | Whatever the vendor's shared infrastructure is built to reach, running against your linked account. | The vendor. If LinkedIn identifies the pattern once, every customer sharing that infrastructure is exposed at the same time. | Elevated |
| Custom code, independent index | Whatever your own infrastructure allows, collected outside any single member's session. | Nothing, technically, until it's caught. This is the exact structure every case below targeted. | Hoch |
| Account-basierte API | What one authenticated, linked member's own account can already see. | Nothing structurally new: it removes one failure mode, a shared index taken down for every customer at once, not Section 8.2 from the linked account itself. | Different, not zero |
The last row is covered in detail in the guide to retrieving LinkedIn data through an API, and again further down under what changes with Unipile.
Can you get banned for this
Every method above carries some exposure to LinkedIn restricting the account behind it. What triggers a review isn't published, and this page won't guess. But the enforcement actions further down, and independent reporting on LinkedIn's own detection systems, point to a consistent set of signals rather than a single tripwire.
VelocityA pace of profile views, connection requests, or messages that doesn't match how a person browses, holds, reads, and pauses.
Behavioral patternThe same sequence repeated identically across sessions, without the variation a human introduces.
Browser & device fingerprintAutomation frameworks and headless browsers leave signatures a normal session doesn't. LinkedIn's own client-side scanning for known extension and automation signatures has been independently documented.
Connection wallsIdentity checkpoints or re-verification prompts LinkedIn triggers when an account's activity looks unusual, whether or not that activity is automated.
None of this is a checklist for staying under a radar, we're not publishing one. LinkedIn doesn't publish thresholds, and a "safe" cadence would be a guess dressed up as a fact. What's documented is that detection is layered, and the consequence, when it lands, ranges from a restricted account to the page removals and lawsuits covered next.
The three legal layers, and how hiQ actually ended
"Is LinkedIn scraping legal" is really three questions. Is it a crime under the Computer Fraud and Abuse Act (CFAA), a US federal statute? Case law says accessing data any visitor can already see without logging in generally isn't, by itself, unauthorized access. Is it a breach of contract, of LinkedIn's Terms of Service? Yes, without ambiguity, Section 8.2 prohibits automated collection regardless of the CFAA question. Will it actually be enforced? That's the question with real consequences, answered in the next section.
The CFAA finding above comes from a single case, hiQ Labs v. LinkedIn, and the part most summaries leave out is how it ended.
| Datum | Was ist passiert |
|---|---|
| 2017 | hiQ Labs sues LinkedIn after LinkedIn sends a cease-and-desist letter and moves to block hiQ's access to public profile data. |
| April 2022 | The Ninth Circuit affirms that accessing publicly viewable LinkedIn profile data likely does not violate the CFAA. This is the ruling most "scraping is legal" articles stop at. |
| 1 August 2022 | The district court dissolves the preliminary injunction that had kept hiQ's access open, on separate grounds tied to LinkedIn's Terms of Service claim. |
| 6 December 2022 | Consent judgment: hiQ agrees to pay LinkedIn $500,000, ein permanent injunction bars any further collection, and hiQ is ordered to destroy the code, data, and algorithms built on it. hiQ no longer operates. |
The April 2022 line is what most "scraping is legal" headlines cite. The ending is what they skip: the same case closed eight months later with the plaintiff paying LinkedIn and shutting its product down, on the contract theory the CFAA ruling never touched. Full docket history: hiQ Labs v. LinkedIn on Wikipedia, der / die / das Berufungsurteil vom April 2022, and the December 2022 consent judgment coverage.
The criminal terrain: CFAA
The Ninth Circuit held that accessing publicly viewable pages, without logging in, isn't unauthorized access under the CFAA.
That answers a federal computer-access statute question. It says nothing about LinkedIn's own contract.
The contractual terrain: Terms of Service
Section 8.2 of LinkedIn's User Agreement prohibits automated collection, regardless of whether the data was public.
This is the terrain LinkedIn actually enforces on: account restriction, page removal, or a lawsuit.
hiQ won the first, lost the second. The second is what ended the company, and it's the terrain nearly every case in the next section runs on.
What LinkedIn actually does
Whatever the legal analysis says on paper, the risk that shapes a product decision is what LinkedIn has actually done. Five actions across roughly two years, including two lawsuits, show a pattern rather than an isolated exception.
| Datum | Was ist passiert |
|---|---|
| Januar 2025 | LinkedIn files a federal suit against Nubela, the company behind Proxycurl, alleging hundreds of thousands of fake accounts were used to collect millions of LinkedIn profiles, resold through Proxycurl's API. Full detail in our Proxycurl shutdown breakdown. |
| 6 March 2025 | LinkedIn blocks platform access and removes the company pages of Apollo.io and Seamless.AI. Apollo's CEO states the company is "actively working with LinkedIn to understand the nature of our brand page restriction." |
| 4. Juli 2025 | Proxycurl shuts down after settling. Founder Steven Goh writes publicly that "there is no winning in fighting this." |
| 3 October 2025 | LinkedIn sues ProAPIs and its CEO, alleging an "industrial-scale fake account mill" reselling access for up to $15,000 a month per client. LinkedIn says it detected the operation "within hours." |
| 25 March 2026 | LinkedIn removes HeyReach's company page, then followed by roughly 16,400 people, and restricts the personal profiles of its CEO, CTO, CRO, and CMO, with no prior notice. |
Not every automated tool touching LinkedIn data gets sued. But the pattern runs on the contract terrain above, not the CFAA. LinkedIn's own Help Center page on prohibited software and extensions states that accounts using unauthorized tools "risk having their accounts restricted or shut down" without notice. The lawsuits above are the visible end of that policy; account and page restrictions are how it plays out for everyone else.
And with Unipile, what do I risk
The account-based row above is the model Unipile runs on: each request executes on behalf of one authenticated, linked account, scoped to what that member can already see. What that changes, and what it doesn't:
Hinweis zur DatenverarbeitungNo independent index behind the API
Live-Abruf im Auftrag des authentifizierten Benutzers: profile and message data moves through the linked account's own session, scoped to what that member already sees.
Kein paralleles Archiv: Unipile doesn't build or resell a database of LinkedIn profiles. What moves through the API reaches your product, not a separate archive.
Wie Unipile funktioniertKeine gemeinsam genutzten Zugangsdaten, keine Erhöhung der Zugriffsrechte
Unabhängiger technischer Vermittler Unipile agiert im Namen jedes authentifizierten Benutzers innerhalb einer Sitzung, die ihm gehört, nicht als Datenhändler und nicht im Namen von LinkedIn.
Nicht verbunden mit, unterstützt von oder gefördert durch LinkedIn. Each linked account is isolated; no credentials are shared across your customers.
Plattformbeschränkungen und verantwortungsvolle NutzungUnipile relays LinkedIn's own limits, it does not lift them
Grenzen werden verlagert, nicht aufgehoben: retrieval and messaging stay inside the same limits a member would hit inside LinkedIn's own interface.
Cadence stays a customer-side decision: the API executes what your product and your users decide to send, on a per-user basis. It doesn't set a pace on their behalf.
None of this removes exposure, it changes its scope. LinkedIn's Terms of Service still apply to every linked account exactly as if that member used LinkedIn directly. This narrows one failure mode, a single shared index taken down for every customer at once. It does not put any customer outside those terms, and this page isn't a substitute for reading them.
Eine Integration, ein Schema über LinkedIn, WhatsApp, Instagram, Telegram, E-Mail und Kalender. Hosted authentication and retrieval on behalf of each linked account, instead of an index built outside it.
Beginnen Sie mit dem BauDrei Orte, um tiefer einzutauchen: die Leitfaden zum Abrufen von LinkedIn-Daten in Ihre eigene Software, wie die wichtigsten LinkedIn-API-Optionen im Vergleich dastehen, and the Proxycurl shutdown, in full.
Audit your own product
This isn't a legal test, only a lawyer reviewing your setup can give you that. It's the checklist we can actually publish: five questions mapping roughly to the difference between structures enforcement has targeted, and the ones it hasn't, so far.
01
KontenDoes every LinkedIn account your product touches belong to a real member who authenticated it themselves, or does your product create accounts that don't belong to anyone?
02
IndexDoes data stay scoped to what one authenticated member's session can see, or does your product build and retain an index that exists independent of any single member's access?
03
AttributionFor any given action your product takes on LinkedIn, can you point to the one authenticated user who triggered it, or could you not say?
04
GrenzenDoes your product relay LinkedIn's own connection, search, and messaging limits to the end user, or does it try to push past them on the user's behalf?
05
RechtsgrundlageDo you have a documented legal basis for processing this data, and, if you or your users are in the EU, a DPA in place with whichever provider sits underneath?
If you get a letter, or your page disappears
None of the cases on this page involved a warning. Apollo and Seamless lost their company pages, with a note from LinkedIn after the fact. HeyReach's team wrote about its own removal:
"No notice, no communication. We just couldn't get in anymore."
A handful of documented patterns, not legal advice, on what companies in this spot have actually done:
1
Don't respond in writing before counsel reviews itThe clearest public account of a cease-and-desist response, an HN thread from a Chrome extension developer, converges on one point: what you say before a lawyer reviews it can matter more than what you did.
2
Check what's actually restrictedIn the documented cases, the product kept working, HeyReach's customer accounts and campaigns continued, Apollo's product stayed operational, while the company page or founders' personal profiles were what got hit.
3
Preserve the notice and the timelineWhat changed, when, and what the notice actually said, not a summary of it, is what counsel will ask for first.
4
Revisit the architecture, not just the letterIf more than one answer in the self-check above points the wrong way, the letter is a symptom, not the problem.
Is LinkedIn scraping legal: your questions answered
The CFAA question, the Terms of Service question, detection, and what LinkedIn has actually enforced.
It depends which question is being asked. Case law such as hiQ Labs gegen LinkedIn establishes that accessing data any visitor can view without logging in generally does not violate the CFAA. That same case still ended in a $500,000 settlement and a permanent injunction under a separate breach-of-contract theory, and hiQ no longer exists. This page summarizes public case law and policy; it is not legal advice for your specific situation.
It depends on the jurisdiction, whether the data required logging in, and what contract governs the account collecting it. US case law treats publicly viewable data differently from data behind a login wall, and both are separate from a breach of LinkedIn's Terms of Service, its own track.
Not automatically, and not automatically legal either. US case law says collecting publicly visible data doesn't, by itself, violate the CFAA. It says nothing about LinkedIn's Terms of Service, which separately prohibit automated collection and which LinkedIn enforces through lawsuits, page removals, and account restrictions.
Yes. Section 8.2 of LinkedIn's User Agreement prohibits third-party software, crawlers, bots, and browser extensions that collect data or automate activity, regardless of whether that data is publicly visible. LinkedIn's Help Center page on prohibited software and extensions states that accounts using such tools risk being restricted or shut down without notice.
A US case in which the Ninth Circuit found, in April 2022, that collecting data visible without logging in likely doesn't violate the CFAA. It didn't end there: on 6 December 2022, a consent judgment ordered hiQ to pay LinkedIn $500,000, imposed a permanent injunction, and required it to destroy its code and data. hiQ no longer operates.
Each lawsuit covered here targets companies LinkedIn alleges built large-scale fake account networks to collect data at volume and resell it through an API. The suits against Nubela (Proxycurl, January 2025) and ProAPIs (October 2025) both make this allegation, on breach-of-contract grounds tied to LinkedIn's Terms of Service.
LinkedIn filed suit against Nubela, the company behind Proxycurl, in January 2025, alleging hundreds of thousands of fake accounts were created to collect millions of LinkedIn profiles for resale through Proxycurl's API. The case settled, and Proxycurl shut down on 4 July 2025.
Public reporting and LinkedIn's own policy point to a layered approach: unusual velocity, repeated identical patterns across sessions, browser and device fingerprinting, and identity checkpoints triggered when activity looks unusual. LinkedIn doesn't publish a specific threshold, and this page doesn't estimate one.
This is not legal advice for your situation, but documented cases show a pattern: don't respond in writing before a lawyer reviews it, confirm what's actually restricted (the product often keeps working while a page or personal profile is what's hit), and preserve the notice and timeline for counsel.
An API retrieving data on behalf of an authenticated member's own linked account, scoped to what that member can already see, is structurally different from the independent, bulk-collected indexes targeted in the cases here. That difference doesn't remove LinkedIn's Terms of Service from applying to the linked account.
No. It narrows one failure mode, a single shared index that can be targeted once and taken down for every customer at once, but it doesn't put any account outside LinkedIn's Terms of Service or make an integration immune to limits, restrictions, or review.
Nein. Unipile ist ein unabhängiger technischer Vermittler, der nicht mit LinkedIn verbunden, von LinkedIn unterstützt oder gesponsert wird. Es handelt im Auftrag jedes authentifizierten Benutzers innerhalb einer Sitzung, die diesem gehört, und nicht im Auftrag von LinkedIn. LinkedIn ist eine Marke der LinkedIn Corporation.
Haben Sie noch Fragen? Unser Team ist für Sie da.
Build a LinkedIn data layer scoped to each linked account
Erstelle deine erste IntegrationGehostete Authentifizierung, Datenabruf im Auftrag jedes verknüpften Kontos und ein einziges Schema über LinkedIn, WhatsApp, Instagram, Telegram, E-Mail und Kalender hinweg. Keine Kreditkarte erforderlich, um zu beginnen.
Quellen
12 references, September 2026Every date and figure here traces to the source below. Cases settle and policies update without notice, so treat this as a snapshot, not a permanent status, and not legal advice.
LinkedIn HilfeVerbotene Software und Erweiterungen, the official policy referenced throughout.
LinkedIn-NutzervereinbarungAbschnitt 8.2, der Vertragsgrundlage für die Durchsetzungsmaßnahmen von LinkedIn.
hiQ Labs gegen LinkedInAnamnese über Wikipedia.
Neunter US-BerufungsgerichtshofDie Berufungsurteil vom April 2022 on the CFAA question.
Privacy WorldCoverage of the Vergleichs- und Einigungsurteil vom Dezember 2022 that ended hiQ's case.
NubelaDes Gründers eigener Proxycurl shutdown announcement, 4 July 2025.
Der RekordLinkedIn gegen ProAPIs, eingereicht am 3. Oktober 2025.
MartechApollo.io and Seamless.AI removed from LinkedIn, 6 March 2025.
HeyReachHeyReach's own account of its 25 March 2026 company page removal.
Hacker NewsDie Browserflow cease-and-desist thread, 30 January 2023.
BleepingComputerReporting on LinkedIn's client-side extension scanning, April 2026.
Unipile Entwickler-DokumenteVoll API-Referenz und Leitfaden für den Einstieg für die LinkedIn-Integration.
Last updated September 2026. This page is not legal advice; it summarizes public court records and platform policy as of the date above, and you should consult a qualified attorney for guidance specific to your situation. Unipile is an independent technical intermediary and is not affiliated with, endorsed by, or sponsored by LinkedIn. Volume, cadence, and content of any action taken through the API remain a customer-side decision, consistent with LinkedIn's Terms of Service and applicable data protection regulations (GDPR).
DE 
EN 
FR 
ES 
IT 
BR 
NL 
PL 
TR