LinkedIn, a Microsoft subsidiary, discloses its data practices through a public privacy policy, a CCPA-specific disclosure, and cookie/tag documentation for advertisers, describing collection of member and visitor data used for personalization, analytics, and AI model development. LinkedIn has been the subject of a €310 million GDPR fine by Ireland's Data Protection Commission (2024) over its legal basis for behavioral advertising, a $13 million U.S. class-action settlement (2015) over its Add Connections email feature, and a 2021 incident in which data corresponding to roughly 700 million profiles was scraped and offered for sale, which LinkedIn characterized as not a data breach. Corporate ownership (LinkedIn Ireland Unlimited Company, LinkedIn Corporation, and parent Microsoft Corporation) is disclosed in the privacy policy, though the underlying advertising data flows were found by regulators to lack adequate transparency to users.
TRACK RECORD
2 BREACHES
[2021-04-08] · BREACH
Have I Been Pwned lists a breach record for LinkedIn: "LinkedIn Scraped Data (2021)".
Approximately 125,698,496 accounts affected, per HIBP.
Exposed: Education levels, Email addresses, Genders, Geographic locations, Job titles, Names, Social media profiles.
LinkedIn's privacy policy states that member data may be used to 'develop and train artificial intelligence (AI) models' in addition to providing, supporting, and personalizing its services.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
LinkedIn's California Privacy Disclosure organizes the personal information it collects according to CCPA statutory categories and describes the corresponding sources of that information.
LinkedIn's privacy policy defines its corporate affiliates to include LinkedIn Ireland, LinkedIn Corporation, LinkedIn Singapore, and parent company Microsoft Corporation and its subsidiaries such as GitHub.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes, including audits.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.
The Irish Data Protection Commission's 2024 decision found that the personal data LinkedIn processed for behavioral analysis and targeted advertising included data obtained via third-party partners relating to its members, not only data provided directly by members.
LinkedIn's California Privacy Disclosure states that while it does not sell personal information, it may engage in 'sharing' as defined under the CCPA for purposes of cross-context behavioral advertising.
Have I Been Pwned's breach catalog lists the "LinkedIn" incident (linkedin.com), breach date 2012-05-05, affecting approximately 164,611,595 accounts. Data classes exposed per HIBP: Email addresses, Passwords. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In 2015, LinkedIn agreed to pay $13 million to settle a class-action lawsuit (Perkins v. LinkedIn Corp.) alleging that its 'Add Connections' feature used members' names and contact data to send unauthorized follow-up email invitations, and the company updated related disclosures as part of the settlement.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, within 72 hours.
Have I Been Pwned's breach catalog lists the "LinkedIn Scraped Data (2021)" incident (linkedin.com), breach date 2021-04-08, affecting approximately 125,698,496 accounts. Data classes exposed per HIBP: Education levels, Email addresses, Genders, Geographic locations, Job titles, Names, Social media profiles. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In June 2021, data corresponding to approximately 700 million LinkedIn profiles was scraped and offered for sale on a hacking forum; LinkedIn stated in response that the incident did not constitute a data breach.