- Automation is not a crime, but it breaks LinkedIn's User Agreement. The risk is to your account, not your freedom.
- Public data is still personal data. GDPR applies to every prospect record you keep.
- Legitimate interest works for B2B outreach if you document it, tell people, and stop when they object.
- The cases that ended badly were about building and selling databases, not one team messaging a relevant list.
Every outreach team gets the question eventually, usually from a new hire or a nervous client: is this actually allowed? The honest answer is that three different rulebooks apply, and they don't agree. A US court, LinkedIn's own terms, and European privacy law each look at a different part of what you do. You can be fine under one and exposed under another.
This is a practical guide, not legal advice. If you store data on people in the EU or UK at any scale, run your setup past whoever handles data protection for your company.
Three rulebooks, three different answers
| Rulebook | What it covers | What it means for outreach |
|---|---|---|
| US computer-access law (CFAA) | Whether getting the data counts as unauthorized access | Viewing public pages is unlikely to be a crime. Fake accounts and getting around blocks change that. |
| LinkedIn's User Agreement | What members agreed to when they signed up | Bans scraping and automated activity. Breaking it can cost you the account. |
| Privacy law (GDPR, UK GDPR, CCPA) | What you do with personal data once you have it | Needs a lawful basis, a notice, a retention limit and a working opt-out. |
What the hiQ case actually settled
hiQ Labs sold workforce analytics built from public LinkedIn profiles. When LinkedIn tried to cut off its access, hiQ sued, and in 2022 the Ninth Circuit held that scraping pages anyone can view is unlikely to be “access without authorization” under the Computer Fraud and Abuse Act. That ruling is where most “scraping is legal” headlines come from.
The headlines leave out the ending. Later that year the district court found that hiQ had breached LinkedIn's User Agreement, partly by using fake profiles. In December 2022 the two sides agreed to a $500,000 judgment against hiQ and a permanent injunction that made it stop scraping and destroy the code and data it had collected. Winning on criminal law didn't save the business.
What LinkedIn's User Agreement says
Section 8.2 of the User Agreement lists what members agree not to do. It covers scraping and copying profiles, and it also covers using bots or other automated methods to add contacts or send messages. That second part applies to every LinkedIn automation tool, Outvelo included.
So any vendor claiming to be “approved by LinkedIn” or “fully compliant with LinkedIn's terms” is not being straight with you. What a breach means in practice is account risk: LinkedIn can restrict or close accounts it believes are automated, sometimes without warning. The useful question is how much your activity looks like a real person working their own network.
GDPR: a public profile is still personal data
Once a name, title and company land in your lead list, GDPR applies if that person is in the EU or UK. It doesn't matter that the profile was public. You need a lawful basis for holding the data, you need to tell the person, and you need to respect their rights.
The case worth knowing is the €240,000 fine France's CNIL gave KASPR in December 2024. KASPR ran a browser extension that showed its users the contact details of LinkedIn members whose profiles they visited. The regulator found that it:
- collected contact details people had limited to their own connections,
- kept records for five years from every update, so the clock kept resetting,
- didn't tell people their data had been collected until years later, and then only in English,
- answered “where did you get my data?” with “publicly available sources”.
Each of those maps to a habit an outreach team can get right: take only what people chose to share, give records an expiry date, tell people where their details came from, and answer requests properly.
A GDPR checklist for LinkedIn prospecting
- Write down your legitimate interest. Article 6(1)(f) allows processing for legitimate interests, and Recital 47 says direct marketing can be one. A one-page balancing test covers it: why you contact this kind of person, why they'd reasonably expect it, and what you do to limit the impact.
- Keep the record small. Name, headline, company and profile URL are enough for a first message. Every extra field needs a reason.
- Say where you got their details. Under Article 14, when you collect data from somewhere other than the person, you have to tell them at the latest when you first contact them. A short line plus a link to your privacy notice usually does it.
- Make objecting easy and final. Article 21 gives people an absolute right to object to direct marketing. When someone says stop, stop across every campaign and every teammate, not just the one sequence.
- Pick a retention period. Match it to your sales cycle, write it down, and delete people who never replied when it runs out.
- Check before you switch channels. Moving a LinkedIn contact to cold email brings in national e-privacy rules, which vary by country.
Scraping and prospecting are not the same thing
Regulators and LinkedIn have gone after the same pattern every time: fake accounts, bulk profile collection, and data sold on to others. A sales team working a relevant list from its own accounts looks very different, even if both start from a LinkedIn search.
| Building a database | Prospecting | |
|---|---|---|
| Volume | Thousands of profiles at a time | A list your team can actually work |
| Source | Fake accounts, harvested pages, bought lists | Your own searches, in your own accounts |
| What's kept | Every field, indefinitely | The minimum, for a stated purpose |
| What it's for | Resold or reused elsewhere | A conversation with each person |
Lowering account risk
Legal risk and account risk come from the same place: activity that doesn't look like a person. A few habits cover most of it.
- Don't run anything in the browser. Extensions run inside the LinkedIn tab, where LinkedIn can see them.
- Start slow and stay under the weekly ceiling. Our guide to LinkedIn daily limits explains why the weekly number matters more than the daily one.
- Send during working hours in the sender's timezone, with gaps that vary.
- Watch your acceptance rate. A falling rate means your targeting is off, and LinkedIn notices ignored invitations.
- Stop on a reply. Nothing looks more automated than a follow-up to someone who already answered.
Where Outvelo fits
Outvelo runs outreach from your team's own LinkedIn accounts. We don't build, sell or rent a database of profiles, and we don't use fake accounts. Your audiences come from CSV files, lists of profile URLs, our API, or Sales Navigator searches run in your own account. Under GDPR you're the controller of that data and we're your processor, which our privacy policy explains, including what prospects can do if they want out.
If your team wants outreach that holds up when a client or a DPO asks how it works, see how Outvelo handles account safety.
Sources
Reviewed on 18 October 2026 against LinkedIn's User Agreement, the GDPR text and the CNIL's published decision.