The short answer: LinkedIn data privacy is weaker than the professional register suggests. Your profile bundles your name, job history, employer, location, connections, and inferred salary into structured, sellable data. In 2021, a scraper packaged 700 million such records and sold them on a hacking forum. You cannot undo that. You can shrink what LinkedIn holds going forward. Audit your profile, hide your connections list, block the cross-site Insight Tag, and turn off the AI-training and ad-tracking settings below.
In June 2021, a user with the handle “GOD User TomLiner” posted a sample of one million records harvested from LinkedIn on a forum called RaidForums. They advertised the remainder — 700 million entries in total — for sale at an undisclosed price. Researchers at Privacy Sharks verified the sample within days. The records held full names, email addresses, phone numbers, physical addresses, geolocation data, employment histories, and inferred salary ranges. LinkedIn, owned by Microsoft since 2016, acknowledged the collection existed but maintained that no security breach had occurred. The data, it said, had been scraped from public-facing profiles using LinkedIn’s own API and publicly accessible pages.
That statement was accurate in a narrow technical sense. It was also nearly beside the point.
Seven hundred million people had published professional information for one reason. They expected recruiters to view it, colleagues to connect, and hiring managers to reach out. They had not consented to having that information packaged into a commercial dataset. Nobody had vetted the buyers on a criminal marketplace. LinkedIn’s legal position did not change what those buyers could now do with the data.
What LinkedIn Actually Knows About You
A LinkedIn profile created in good faith holds a remarkable amount of structured personal data. At the most basic level, that means your full legal name, a photograph, and your current location. It also holds your complete employment history with employer names and dates, your educational history, and a list of professional skills. If you have held multiple roles at the same company, LinkedIn records that progression too. Your connections list is a map of your professional relationships: who you know, in which industries, and how recently you interacted with them.
Go a layer deeper and it becomes more granular. If you use LinkedIn Recruiter, the platform logs which company profiles you have researched and how long you spent on them. LinkedIn Learning is the training library Microsoft acquired from Lynda.com. If you use it, LinkedIn knows which skills you are trying to develop, which courses you started and never finished, and which certifications you are pursuing. The gap between your listed skills and your learning activity is a reasonable proxy for where you feel professionally inadequate. That data has commercial value.
Apply for jobs through LinkedIn’s “Easy Apply” function and the data expands again. You may have entered your desired salary range, your notice period, or whether you are open to relocation. LinkedIn retains all of it. It feeds a model of your career trajectory that the platform sells to recruiters as a premium targeting product called LinkedIn Recruiter.
Then there is the Insight Tag, which we will come back to.
Is a data scrape different from a data breach?
LinkedIn’s defence in 2021 was that scraping is not breaching. The company repeated this framing in its statement: “Our teams have investigated a set of alleged LinkedIn data that has been posted for sale. We want to be clear that this is not a data breach and no private LinkedIn member data was exposed.”
The legal position is contested. In the United States, LinkedIn had been fighting this battle in the courts for years before the 2021 incident. The case of hiQ Labs v. LinkedIn turned on whether scraping publicly accessible pages violated the Computer Fraud and Abuse Act, the 1986 federal law against unauthorised computer access. The Ninth Circuit ruled that it did not, because the data was publicly available without any authentication barrier. LinkedIn petitioned the Supreme Court for review. The Supreme Court declined.
In Europe, the picture is different and more favourable to data subjects. In September 2022, the European Data Protection Board issued guidelines on scraping under GDPR. The EDPB’s position was unambiguous. The fact that a user has made personal data publicly accessible does not strip that data of its protected status. A person who publishes their employment history for professional networking has not authorised unlimited third-party collection, aggregation, and commercial resale of it. The GDPR’s lawful-basis requirements apply regardless of whether the data is technically public.
CNIL, France’s data protection authority, has pursued enforcement on this basis. In 2022, CNIL issued guidance requiring companies that run mass scraping operations on French residents’ data to comply with GDPR obligations, including legitimate purpose and proportionality. Several enforcement actions followed against data broker operations built on scraped professional data. Ireland’s Data Protection Commission is LinkedIn’s lead EU supervisory authority, because Microsoft’s European headquarters are in Dublin. In 2021, it found that LinkedIn had been processing behavioural data for advertising without an adequate lawful basis. LinkedIn had to update its processing for European users as a result.
The scraping-versus-breach distinction is useful for LinkedIn’s communications team. It is less useful for the 700 million people whose data was sold.
How does scraped LinkedIn data enable targeted attacks?
The 2021 LinkedIn dataset was not just a privacy violation in the abstract. It was a toolkit.
Spear phishing is the most immediate risk. A generic phishing email — “Dear Customer, your account requires attention” — converts well below one percent of the time. Now picture a different email. It addresses you by your full name, references your employer and job title, names a specific former colleague, and purports to come from your IT department. That is a fundamentally different threat. The 2021 dataset gave attackers every element they needed to personalise attacks at scale. They did not have to research individual targets; the dataset had done it for them. (See our guide to spear phishing attacks for how these are built.)
Business email compromise is more targeted and more lucrative. The FTC documented cases in 2021 and 2022 where attackers used LinkedIn data as a starting point for CEO fraud. The method is simple. Identify a company’s finance team and CEO from LinkedIn. Use a phone number from the dataset to impersonate the CEO calling the CFO. Instruct a wire transfer on some urgent pretext. These attacks succeed when the caller shows familiarity with internal structures, and professional networks document those structures in fine detail. The FBI’s Internet Crime Complaint Center reported $2.4 billion in losses to business email compromise in 2021 alone.
The dataset’s use for physical-world harm is less discussed but serious. Domestic abuse situations often involve an abuser trying to locate someone who has left. A profile listing “Greater London Area” plus an employer name, combined with a residential postcode from another breach, narrows a search dramatically. Researchers described the geolocation data in the 2021 dataset as coarse. Coarse for an attacker is not the same as coarse for a determined one.
What do other job platforms collect?
LinkedIn is the most prominent professional data collector, but it is not alone. The ecosystem around it is worth understanding.
Indeed and Glassdoor are both owned by Recruit Holdings, a Japanese firm with roughly £2.5 billion in annual revenue. Indeed tracks every search query you run, every filter you apply, every job description you open, and every company you research. Its privacy policy permits sharing data with employers. That includes the fact that you have been actively searching, which can affect salary negotiations if your current employer is paying attention. Apply to fifty jobs over six months, and that pattern becomes commercially useful to HR technology firms and, indirectly, to credit-assessment firms that buy data about financial-instability signals.
Glassdoor’s review system creates a different problem. Reviews are posted under pseudonyms, but Glassdoor requires a verified email to post. The pseudonym does not fully protect the reviewer. In several US cases, employers who suspected negative reviews came from former staff obtained subpoenas to compel Glassdoor to disclose reviewer identities. Glassdoor has contested some of these subpoenas and complied with others. If you are considering a negative review of a former employer, understand that your anonymity is conditional, not guaranteed.
ZipRecruiter, Monster, and CareerBuilder all feed data into the broader HR technology ecosystem. Candidate profiles are commercially valuable, especially those showing frequent applications, career pivots, or salary expectations. Buyers include firms that sell talent intelligence and financial-services providers assessing creditworthiness. The link between job searching and credit-risk assessment is not hypothetical. It is documented in the data brokerage industry’s product catalogues.
What does the LinkedIn Insight Tag track off the platform?
The LinkedIn Insight Tag is a JavaScript pixel, a snippet of code, that LinkedIn gives companies to measure advertising effectiveness. The premise is reasonable. A company runs a LinkedIn ad campaign and wants to know whether members who saw the ad later visited its website. The Insight Tag makes that connection. Over 300,000 websites currently have it installed.
The implication is significant. Every time a LinkedIn member visits any site carrying the Insight Tag, LinkedIn receives a signal that the member was there. LinkedIn knows you visited a mental health clinic’s website. It knows you visited a fertility treatment provider. It knows you spent three sessions reading about cancer treatment options. LinkedIn classifies this as “B2B marketing intelligence,” but the behavioural inferences available from such a dataset go well beyond campaign attribution.
The Irish DPC’s 2021 finding, that LinkedIn processed behavioural advertising data without an adequate lawful basis, was partly about this cross-site collection. LinkedIn updated its processing for European users afterward. Users outside Europe have fewer protections.
The Insight Tag also shows why the scraping-versus-breach framing obscures more than it reveals. Here, LinkedIn is not the victim of scraping. It is conducting the collection. The question is not whether your data was taken without permission. When you created a LinkedIn account to find a job, did you understand what else you were signing up for? You were also enrolling in cross-site behavioural tracking, across every website your employer’s marketing team happens to have instrumented.
How do you lock down LinkedIn data privacy?
None of this requires abandoning LinkedIn entirely, though some people will make that choice. The more practical response is to reduce your exposure step by step and make bulk matching harder.
Turn off AI-training use. LinkedIn added a “Data for generative AI improvement” setting for US members in September 2024, switched on by default. It lets LinkedIn train its AI on your profile, posts, and activity. Turn it off under Settings & Privacy > Data privacy > Data for generative AI improvement. For the full company-by-company AI-training picture, see our guide to opting out of AI training.
Audit your profile data. Remove any information you do not need to be professionally discoverable. Personal phone numbers do not belong on LinkedIn; use a work number or nothing at all. Specific home addresses have no place on a professional profile. Review whether exact employment dates (month and year) are necessary, or whether year-only is enough for you.
Lock down your connections list. Your professional network is intelligence. Under Settings → Privacy → Profile Privacy, find “Who can see your connections” and set it to “Only you.” Leaving it visible hands scrapers a ready-made social graph attached to your profile.
Opt out of LinkedIn’s advertising data processing. Under Settings → Ads → Ad Settings, disable all targeted advertising options. That includes “LinkedIn’s partners can show you ads off LinkedIn.” This limits some of the cross-platform tracking, though it does not stop the data collection itself.
Block the Insight Tag at the browser level. Install uBlock Origin on your browser. Its default filter lists include the LinkedIn Insight Tag domain (snap.licdn.com). Once installed, the Insight Tag cannot fire when you visit websites that have it embedded. This is a more reliable protection than LinkedIn’s own opt-out controls, which operate at the policy level rather than the technical level.
Use a dedicated email address for LinkedIn. Create an address used only for LinkedIn and job applications. Do not reuse the address tied to your bank, your NHS patient portal, or your pension account. When a scraper harvests your LinkedIn email, they get an address that cannot be cross-referenced to your financial accounts. Services like SimpleLogin or Proton’s aliases make this easy to manage.
Consider using a name variant. Some professionals use a middle initial or a name variant on LinkedIn — “J. Smith” rather than “John William Smith” — making bulk automated matching against other datasets harder. This is a privacy technique, not a deception; it does not affect your discoverability to recruiters who are searching for your skills and experience.
Enable Private Mode for job searching. If you are actively searching while employed, turn on LinkedIn’s Private Mode (Settings → Privacy → Profile viewing options). It stops your current employer from seeing that you have viewed competitor companies or recruiter profiles. It does not make you invisible to LinkedIn, but it reduces the visible signals.
Request your LinkedIn data. Under Settings → Data Privacy → Get a copy of your data, LinkedIn allows you to download an archive of what it holds. Review it. The data categories may include things you did not know LinkedIn had logged, including your past search history and messages sent.
The 2021 dataset is already in circulation. You cannot retroactively remove your data from it. What you can do is control the data surface you present going forward. Limit what LinkedIn accumulates about your behaviour across the web. Reduce how easily the data you do share can be cross-referenced. Perfection is not available. Meaningful reduction of exposure is.
The same professional details that leak from LinkedIn also feed the people-search brokers, which resell your name, employer, and address. Broker pages like Spokeo and Whitepages show what that looks like and how to opt out.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.