Federal Judge Dismisses Class Actions Against LinkedIn Over Browser Extension Scanning

A federal judge in the U.S. District Court for the Northern District of California has dismissed two class-action privacy lawsuits accusing LinkedIn of illegally scanning its users' web browser extensions. District Judge Vince Chhabria ruled that the plaintiffs lacked legal standing to pursue the matter in federal court because neither demonstrated that LinkedIn actually extracted private details from their specific browser add-ons.

The decision delivers a victory to the Microsoft subsidiary, which argued that its extension-detection capabilities are necessary security tools used to identify unauthorized scraping and automated bots. In his ruling, Judge Chhabria granted the plaintiffs leave to amend their claims but expressed strong doubts about their ability to mount a viable case, noting that browser extensions by their very design intentionally expose operational data to visited websites.

The class actions were initiated separately in April by California residents Nicholas Farrell and Jeff Ganan. According to the court order, Ganan failed to allege that he even had any browser extensions installed on his computer. While Farrell stated he maintained several add-ons, Chhabria pointed out that he failed to show that any of his specific extensions had actually passed sensitive personal information to LinkedIn, falling short of the federal requirement to show concrete and individualized harm.

The legal dispute originated from a report published by Fairlinked, a German advocacy organization that labeled LinkedIn's security practices "BrowserGate," as first reported by Ars Technica. LinkedIn revealed in court documents that Fairlinked maintains close ties to Teamfluence, an Estonian software developer whose CEO, Steven Morell, was previously banned from LinkedIn for operating automated web-scraping software. A tribunal in Germany had earlier upheld LinkedIn's right to suspend Teamfluence's accounts for breaching its terms of service.

In court filings contesting the lawsuits, LinkedIn stated that its platform routinely attracts third-party developers seeking to harvest member data without permission. The professional networking company argued that its privacy policy clearly informs users that it gathers information regarding web browsers and add-ons, and that detecting publicly broadcasted technical data is vital to protecting site integrity and preventing automated scraping.

J.R. Howell, an attorney representing Ganan who also serves as legal counsel for Fairlinked, argued that the privacy infraction occurs during the unauthorized scanning itself, regardless of what information is uncovered. Speaking to Ars Technica, Howell noted that the federal court's dismissal rested purely on jurisdictional standing rather than an evaluation of whether LinkedIn's scanning systems are legal, adding that his team is considering whether to refile in California state court or appeal the decision to the U.S. Court of Appeals for the Ninth Circuit.

The case highlights an ongoing struggle between web platforms enforcing protections against automated data extraction and privacy advocates questioning broad corporate surveillance. While the plaintiffs may attempt to submit revised complaints, the court's stance suggests that establishing federal standing will remain a significant challenge due to the baseline mechanics of how browser extensions operate on the web.