LinkedIn Web Scraping: What Section 8.2 Prohibits

LinkedIn's User Agreement contains a clause numbered 8.2, and it is the reason this article is not a tutorial. The clause prohibits developing, supporting or using software, devices, scripts, robots or any other means or processes, including crawlers, browser plugins and add-ons, to scrape or copy the Services, including profiles and other data. The same list prohibits bots and other unauthorized automated methods, so the official answer to whether LinkedIn's terms prohibit scraping and automation is yes, on both counts.

Plenty of pages will teach you to do it anyway. We are not going to, and the reason is practical rather than moralistic: the accounts that get restricted belong to the reader, and we spend our working life keeping client LinkedIn accounts alive.

Here is what LinkedIn's own documents say, what enforcement actually looks like, and what you can do instead that stays inside the terms.

Does LinkedIn's User Agreement prohibit scraping and automation?

Yes. In section 8.2 of LinkedIn's User Agreement, effective on November 3, 2025, members agree not to use software, scripts, robots, crawlers, browser plugins or add-ons to scrape or copy the Services, and not to use bots or other unauthorized automated methods to access them. LinkedIn's help page on prohibited software says such tools violate the agreement. This page quotes the published terms and is not legal advice.

If the question you arrived with was simply how to scrape LinkedIn, the answer above is the whole answer: section 8.2 prohibits it whether you run the scraper yourself, buy the output from a broker, or install an extension that does it inside your own session.

LinkedIn lead scraping is the same activity under a sales label, and the clause does not soften because the output is a prospect list rather than a dataset.

People search this as LinkedIn terms of service scraping, and the operative document is the User Agreement rather than a separate scraping policy: section 8.2 is where the prohibition lives, with the prohibited-software help page supplying the consequence.

The same reasoning covers hosted crawling APIs such as Firecrawl. Section 8.2 names software, devices, scripts, robots or any other means or processes, so where the code runs is not the test, and pointing a general-purpose scraping API at LinkedIn sits in the same clause as a browser extension.

The tools sold for scraping LinkedIn data differ in interface and in nothing that matters here: whether a browser extension, a hosted actor or a Python library drives the session, Section 8.2 covers all of them by naming crawlers, plugins, add-ons and any other technology.

LinkedIn profile scraping is the most common form of this, and it is the form Section 8.2 names most directly: the prohibition covers scraping or copying the Services including profiles and other data from the Services.

Teams that still target commenters rather than full profiles will find notes on scraping post comments useful for seeing what engagement data actually returns and what it costs the account.

What the User Agreement prohibits, verbatim

Section 8.2 is a list of "Don'ts" that opens "You agree that you will not". Four of its clauses bear on data collection, and they are broader than most people expect.

The first reads: "Develop, support or use software, devices, scripts, robots or any other means or processes (such as crawlers, browser plugins and add-ons or any other technology) to scrape or copy the Services, including profiles and other data from the Services". The second reads: "Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages, create, comment on, like, share, or re-share posts, or otherwise drive inauthentic engagement".

The third is the one that catches buyers rather than builders: "Copy, use, display or distribute any information (including content) obtained from the Services, whether directly or through third parties (such as search tools or data aggregators or brokers), without the consent of the content owner (such as LinkedIn for content it owns)".

The fourth reads: "Override any security feature or bypass or circumvent any access controls or use limits of the Services (such as search results, profiles, or videos)".

That third-party clause matters commercially. Buying a list somebody else scraped, running a scraper yourself and distributing the data onward all sit inside the same text. A team that buys a LinkedIn-derived dataset rather than scraping it has not stepped outside the clause as written, and "our vendor collected it" is not the exemption it feels like.

LinkedIn's enforcement page is equally direct

Separately from the User Agreement, LinkedIn publishes a page on prohibited software and extensions. It states that LinkedIn does not permit any third-party software, including crawlers, bots, browser plug-ins or browser extensions, that scrape, modify the appearance of, or automate activity on the site, and that all such tools violate the User Agreement.

Then it names the consequences. Any member using tools for those purposes is in violation and risks having their account restricted or shut down. Members also risk the tools themselves becoming non-operational without notice, because LinkedIn says it is continuously improving its technical defences against scraping and automation.

The Ninth Circuit's 2022 opinion in hiQ Labs v. LinkedIn records the scale from LinkedIn's side: LinkedIn "blocks approximately 95 million automated attempts to scrape data every day, and has restricted over 11 million accounts suspected of violating its User Agreement", including through scraping.

That second consequence is the one worth planning around even if you are relaxed about the first. A prospecting programme whose data supply depends on a prohibited tool has a dependency that can disappear mid-quarter with no warning, no support path and no refund.

The legal position, stated accurately

The most-cited case here is hiQ Labs versus LinkedIn, and it is routinely summarised as "scraping public data is legal". The primary source most of those summaries lean on says something narrower.

The case's path is on the record. hiQ filed its complaint on June 7, 2017. The Ninth Circuit first upheld a preliminary injunction in hiQ's favour, and then, in the court's own words, "The Supreme Court granted LinkedIn's petition for writ of certiorari, vacated the judgment, and remanded this case for further consideration in light of Van Buren v. United States".

The Ninth Circuit's opinion filed April 18, 2022, on remand from the Supreme Court, affirmed a preliminary injunction that stopped LinkedIn from denying hiQ access to publicly available member profiles. On the Computer Fraud and Abuse Act, the court concluded that "hiQ has raised a serious question as to whether the reference to access 'without authorization' limits the scope of the statutory coverage to computers for which authorization or access permission, such as password authentication, is generally required." That is a ruling on an injunction record about a statute, and it stops short of a finding that scraping is lawful.

The contract is the other half, and it is the half this page can state from LinkedIn's own documents: section 8.2 is part of the User Agreement a member accepts, and LinkedIn's help page calls prohibited tools a violation of it. How the hiQ litigation ended in the district court is not characterised here, because the later rulings could not be read at a primary source. None of this is legal advice.

What this means for an outbound programme

The risk is not evenly distributed, and understanding where it lands changes the decision.

Three things are exposed, in rising order of cost. The tool can stop working without notice, which loses a product. The member account running it can be restricted or shut down, and that account belongs to a real person on your team. And a shut-down account takes its connections and history with it, which took years to build.

That third step is why we treat this differently from a normal compliance question. A sending domain can be replaced in a fortnight. A senior person's LinkedIn account, with a decade of connections and history, cannot be replaced at all, and it is usually attached to someone whose goodwill you need.

What works instead

None of this means LinkedIn data is off limits. It means using the routes LinkedIn actually sanctions.

Inside the terms

• Sales Navigator as a licensed product, used through its own interface
• LinkedIn's official API
• LinkedIn's export of your own data and connections
• Email addresses from a finding and verification waterfall, off LinkedIn

Outside the terms

• A browser extension that harvests profiles in bulk
• A dataset somebody else scraped
• Any tool that circumvents a use limit such as search result caps

Sales Navigator is the licensed answer to most of what people want scraping for. It is a paid product whose entire purpose is finding and filtering prospects, and using it through its own interface is unambiguously permitted. Its published pricing is covered in our Sales Navigator pricing guide, and how to work it is in Sales Navigator lead generation.

Email addresses do not have to come from LinkedIn at all. This is the substitution most teams miss. LinkedIn is a good place to identify who you want to reach and a poor place to obtain contact details, since it does not hand out verified work emails anyway. Identify the person on LinkedIn, then resolve the address through a dedicated finding and verification waterfall. That is a different data supply chain entirely, and it is not covered by section 8.2.

Exports of your own data are explicitly available. LinkedIn provides a route to export your own information and connections, which covers the common case of getting your existing network into a CRM.

Teams that already plan to pull their own network into a CRM should see exactly which fields the export contains and where the email column stays blank in this guide to exporting LinkedIn contacts.

The question to ask a vendor

Tool vendors in this space have a standard set of reassurances, and each has a specific answer worth knowing.

"We only collect public data." True and not responsive. The hiQ opinion above concerned a statute at the preliminary injunction stage, while section 8.2 binds members whatever the data's visibility, and its third-party clause names aggregators and brokers. Public is not the distinction the clause draws.

"We are cloud-based, not a browser extension." The clause covers software, devices, scripts, robots and any other means or processes, which is drafted to be architecture-neutral. Where the code runs is not the test.

"Thousands of users and nobody has been banned." A statement about enforcement frequency, not about whether the activity is permitted, and enforcement frequency is the thing LinkedIn says it is actively working to increase. It also cannot be verified, since the users who did get restricted are not the ones leaving reviews.

"You are not scraping, we are." The third-party clause covers information obtained through data aggregators and brokers, so receiving it is addressed directly rather than left as a loophole.

None of these answers means a vendor is dishonest. They mean the reassurance offered is about a different question from the one you asked, and the useful follow-up is always the same: if LinkedIn restricts the account, whose account is it and what is your remedy.

Where we stand

We run LinkedIn outreach for clients through HeyReach and we do not scrape. Our email addresses come from a dedicated finding and verification waterfall rather than from LinkedIn profiles, which keeps the contact-data supply entirely outside the User Agreement question.

That is a commercial choice as much as a compliance one. We are paid on attended qualified meetings, so an account restriction costs us the engagement, and the arithmetic of risking a client's team accounts to save some sourcing time has never worked out. Our LinkedIn automation tools guide covers what can be automated safely, and the connection limit page covers the restriction triggers that automation makes worse.

If someone is pitching you a LinkedIn data tool, the question worth asking is not whether it works. It is what happens to the account running it, and who owns that account.

The short version

LinkedIn's User Agreement section 8.2 prohibits scraping and copying the Services, using bots or unauthorised automated methods, obtaining data through third-party aggregators and brokers without consent, and circumventing use limits. Its prohibited-software page says such tools violate the agreement and that members risk having accounts restricted or shut down, and that the tools themselves may stop working without notice. The hiQ case is often summarised as making public scraping legal, but the Ninth Circuit's 2022 opinion found only that hiQ had raised a serious question under the CFAA at the preliminary injunction stage, and the User Agreement is a separate matter. The sanctioned routes cover most real needs: Sales Navigator as a licensed product, the official API, LinkedIn's own data export, and sourcing email addresses through a verification waterfall rather than from profiles.

You can also see what a campaign would look like for your market, run entirely inside the terms.

Quotations are from the LinkedIn User Agreement, effective November 3, 2025, section 8.2, and LinkedIn's Help Center page on prohibited software and extensions. The hiQ Labs versus LinkedIn material is from the Ninth Circuit's opinion filed April 18, 2022. None of it is legal advice. Verify current terms with LinkedIn, and take your own legal advice before relying on any characterisation of them here.