On this page
What the law actually says
The relevant US statute is the Computer Fraud and Abuse Act (CFAA), an anti-hacking law that prohibits accessing a computer system "without authorization." For years, platforms including LinkedIn argued that scraping their public data without permission counted as unauthorized access under the CFAA.
That argument lost. In hiQ Labs v. LinkedIn, the 9th Circuit Court of Appeals ruled — first in 2019, then again in April 2022 after a remand from the Supreme Court — that scraping publicly accessible data does not violate the CFAA, because "without authorization" refers to bypassing access controls, not to breaking a website's terms of service. That's the ruling automation vendors point to when they say scraping is "legal."
What most summaries of this case leave out: hiQ still lost. Winning the CFAA argument didn't win the lawsuit. In November 2022 a district court found hiQ had breached LinkedIn's User Agreement, and the parties settled — hiQ agreed to a permanent injunction, had to delete the data and code built from its scraping, and paid LinkedIn $500,000. So the accurate reading is narrower than "scraping LinkedIn is legal": the CFAA can't be used to criminalize it, but a straightforward breach-of-contract claim still can, and LinkedIn used exactly that against the company that won the CFAA argument.
LinkedIn's User Agreement
This is the part that isn't ambiguous. LinkedIn's official policy states plainly that third-party software which automates activity on the platform — sending connection requests, messages, or scraping profile data — is not permitted. Using any tool covered on this site means operating outside that agreement. The consequence for breaking it is contractual, not criminal: LinkedIn can restrict or terminate your account. It cannot have you arrested, and no individual has been criminally prosecuted for using a consumer LinkedIn automation tool.
What actually happens if LinkedIn flags your account
LinkedIn doesn't publish its enforcement ladder in detail, but its own help pages and observed behavior point to an escalating pattern rather than an instant ban:
- A warning notice — an in-app or email message about "unusual activity." This is the point to stop and reassess, not push through.
- A temporary restriction on sending invitations, typically lifted after a period ranging from hours to about a week.
- A reduced daily allowance that isn't announced — your account can simply do less than it used to.
- An account lock requiring identity or phone verification to restore access.
- Permanent suspension — generally reserved for repeated or ignored warnings, or accounts already flagged for unrelated policy issues.
LinkedIn's own invitation-restrictions page states you cannot send or buy your way around a restriction once it's active, and that most restrictions clear automatically within about a week.
What LinkedIn is believed to look at
LinkedIn does not publish its detection logic, so treat the following as commonly cited operational signals — patterns automation vendors and practitioners design around — rather than a confirmed algorithm:
- Action velocity: the same volume spread across a full day reads differently than the same volume compressed into minutes.
- Acceptance rate: a large share of ignored or rejected invitations is a documented trigger for LinkedIn's own restriction system.
- Message uniformity: identical opening lines sent to many people are easy to fingerprint.
- Session and network signals: automation frameworks, datacenter IPs, and sudden geographic jumps are all plausible detection inputs.
None of this is LinkedIn-confirmed in public documentation, so we present it as the working model the industry uses, not as verified fact.