Is Scraping LinkedIn Legal? What the hiQ Case Actually Decided
The hiQ v. LinkedIn headline said scraping public profiles is legal. The footnote is that hiQ still lost. Here's what the ruling really settled, where the line sits, and how to collect public data on the right side of it.
Ask whether scraping LinkedIn is legal and you'll get a confident yes from half the internet and a confident no from the other half. Both are half right. The case everyone points to - hiQ Labs v. LinkedIn - did rule that scraping public profiles isn't a computer-crime violation. It also ended with hiQ losing. Understanding why is the difference between collecting LinkedIn data safely and building a business on a misread headline. This is an informational overview, not legal advice - check your own facts with counsel.
What hiQ v. LinkedIn actually decided
hiQ built products on data scraped from public LinkedIn profiles. In 2017 LinkedIn sent a cease-and-desist citing the Computer Fraud and Abuse Act (the CFAA, 18 U.S.C. § 1030, a 1986 anti-hacking law). hiQ sued. The Ninth Circuit granted an injunction in 2019, the Supreme Court sent the case back in June 2021 to reconsider it in light of Van Buren v. United States - which had just narrowed what "exceeds authorized access" means - and in April 2022 the Ninth Circuit reaffirmed its position: scraping data that's publicly available, with no login required, is not "unauthorized access" under the CFAA. That's the good headline, and it's real.
The part that gets left out: hiQ still lost
Later in 2022, on remand, the court found hiQ had breached LinkedIn's User Agreement - the contract you accept by using the platform - and the matter resolved in a settlement. So the CFAA (criminal-style computer-access law) didn't stop the scraping, but contract law did. This is the split that matters: winning on the CFAA is not the same as winning overall. Terms of Service are a separate, enforceable layer. A related case saw a firm settle with LinkedIn after using fake payment details to get behind the paywall - a reminder that how you access data is as legally loaded as what you collect.
Public vs behind-the-wall is the whole game
The dividing line the courts drew is access. Data you can see logged out, with no account, sits in the lower-risk zone the Ninth Circuit addressed. The moment you log in, you've accepted the User Agreement and its no-scraping clause - and you're now in contract territory, where LinkedIn has won. LinkedIn also enforces technically: logged-out browsing hits a login wall or a challenge quickly, and abusive automation gets an HTTP 999 block response that isn't a standard status code at all - it's LinkedIn's own signal that it thinks you're a bot. If your plan depends on logging in and hammering, both the law and the platform are against you.
How to collect public LinkedIn data on the right side of the line
For legitimate B2B research - firmographics, company pages, public role information - the safer pattern is narrow and boring on purpose:
- Collect only logged-out, publicly visible pages. No account, no fake logins, no paid credentials to slip behind the paywall.
- Prefer business and firmographic data over personal profiles; minimise anything that identifies an individual.
- Respect robots directives and keep request rates polite - aggressive crawling both invites blocks and weakens any legitimate-interest argument.
- Store aggregates, not dossiers. Don't rebuild private profiles or enrich individuals across sources.
- If you touch EU residents' data, treat it as personal data under the GDPR from the first byte.
Clean, geographically coherent access helps here too. Public pages localise, and a request that comes from a plausible residential IP in the right country reads as an ordinary visitor rather than a datacenter bot - which keeps you seeing the same public pages a normal user would, without the login wall firing early. Our guide to B2B lead-generation scraping covers building that pipeline responsibly.
Rate discipline matters as much as IP quality. Aggressive crawling isn't just a technical risk - it undercuts any argument that you're acting like a reasonable visitor, which is exactly the framing a legitimate-interest or fair-use position depends on. Space requests out from clean residential IPs, cache what you've already seen, and never try to accelerate past the login wall with automation designed to look like many separate users. Slow, transparent and public-only is not just the compliant posture; it's also the one that keeps working, because it doesn't give the platform's anti-abuse systems a reason to escalate against you in the first place.
Get clean residential IPs for public-data collection
The privacy layer sits on top of the access question
Even when access is fine, the data itself can carry obligations. Names, roles and photos are personal data, and in the EU the GDPR applies whether or not the profile was public - so you need a lawful basis, data minimisation, and a way to honour deletion requests. US state privacy laws are moving the same direction. "Publicly available" answers the access question; it doesn't switch off privacy law. Our overviews of GDPR and scraped personal data and web scraping legality in 2026 go deeper on both layers.
Frequently asked questions
Is it legal to scrape LinkedIn?
Scraping public, logged-out LinkedIn data was held in hiQ v. LinkedIn not to violate the CFAA. But hiQ still lost on breach of LinkedIn's User Agreement, so scraping while logged in - which accepts those Terms - carries real contract risk. Public data is the lower-risk zone; behind-the-login data is not. This is general information, not legal advice.
What did the hiQ ruling really change?
It established that accessing publicly available web data isn't "unauthorized access" under the CFAA - a meaningful narrowing of that anti-hacking statute. It did not make all LinkedIn scraping legal: Terms of Service, copyright, and privacy law are separate layers, and hiQ was ultimately found to have breached LinkedIn's contract.
Can I scrape LinkedIn without logging in?
Logged-out public pages are the safer path, but LinkedIn shows a login wall and challenges quickly, and blocks aggressive automation with a non-standard HTTP 999 response. Collecting only what a signed-out visitor can see, at polite rates from clean residential IPs, keeps you in the zone the courts addressed. Don't use fake accounts to get further.
Does GDPR apply to public LinkedIn profiles?
Yes. Under the GDPR, personal data stays personal data even when it's publicly visible, so collecting EU residents' names, roles or photos needs a lawful basis, minimisation, and a route to honour deletion. "Public" resolves the access question, not the privacy one - treat profile data as regulated from the start.
The honest summary: hiQ made public-data scraping defensible against computer-crime claims, but the contract and privacy layers are still live, and hiQ itself lost on the contract. Stay logged out, stay aggregate, respect the Terms and robots, and treat personal data as regulated - and you're collecting on the right side of the line the courts actually drew.