LinkedIn has been covertly scanning visitors' browsers for installed extensions using hidden JavaScript deployed across its platform - a surveillance program that has grown more than sixfold from approximately 1,000 extensions in May 2025 to 6,236 extensions as of April 2026. Over 200 of the targeted extensions are direct competitors to LinkedIn's premium products.
KEY FACTS
- WhatLinkedIn deployed hidden JavaScript across its platform that scans visitors' browsers for 6,236 installed extensions and collects detailed device fingerprinting data - without user knowledge or consent.
- WhoLinkedIn Corporation (subsidiary of Microsoft, NASDAQ: MSFT, $281.7B FY2025 revenue). Affects all LinkedIn visitors globally - approximately 1.2 billion registered members and an estimated 310 million monthly active users.
- HowBrowser fingerprinting via JavaScript that probes for known extension resource paths using content-hashed bundle filenames. Standard extension enumeration technique that checks whether specific files exist within each extension's directory structure.
- DataInstalled browser extensions (6,236 scanned), CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio configuration, storage features.
- ActorLinkedIn Corporation (this is corporate surveillance, not a third-party breach).
- ImpactPrivacy violation affecting hundreds of millions of users globally. Competitive intelligence collection against 200+ rival products. Regulatory exposure under GDPR, ePrivacy Directive, CCPA, UK DPA 2018, and data protection laws across every jurisdiction where LinkedIn operates.
WHAT HAPPENED
In 2025, researchers first identified that LinkedIn's website was executing JavaScript code designed to detect approximately 1,000 browser extensions installed on visitors' machines. The technique is well-documented in browser fingerprinting research: JavaScript probes for specific resource files (icons, manifest files, CSS assets) that extensions install in predictable directory paths. If the resource loads, the extension is present. If it returns an error, it is not.
LinkedIn uses content-hashed bundle filenames that change with each deployment - making the scanning code harder to locate through static analysis or URL-based detection.
By December 2025, independent researchers documented that LinkedIn's scanning list had grown to 5,459 extensions. By April 2026, the list had reached 6,236 extensions - indicating active, ongoing expansion of the surveillance program.
" The report documented the full scope of the extension scanning, the device telemetry collection, and the competitive intelligence implications. LinkedIn responded by restricting the report author's account for "violating terms of service" - a retaliatory action that mirrors the platform's documented pattern of using account restrictions to suppress criticism. The researcher filed for a preliminary injunction through a German court (Case No. 37 O 104/26, Landgericht München I). The case status is pending.
BleepingComputer independently verified the scanning behavior, confirming that LinkedIn's JavaScript actively enumerates extensions and collects device telemetry from visitors' browsers. LinkedIn acknowledged the program's existence but framed it as a defensive measure. The company stated that the detection "protects the platform" by identifying extensions that "scrape data without members' consent or otherwise violate LinkedIn's Terms of Service." LinkedIn also stated it does "not use this data to infer sensitive information about members."
The "platform protection" justification does not explain why LinkedIn scans for grammar checkers, language tools, and tax preparation software. These extensions do not scrape LinkedIn data. Their presence in the scanning list indicates that LinkedIn's program is not limited to detecting unauthorized scrapers - it is a broad-spectrum software inventory of visitors' machines.
TECHNICAL ANALYSIS: EXTENSION ENUMERATION
Browser extension fingerprinting exploits a structural property of Chromium-based browsers. Each installed extension stores its resources (HTML, CSS, JavaScript, images) in a predictable directory path keyed to the extension's unique identifier. Web pages can attempt to load these resources via standard web APIs. If the resource loads successfully, the extension is installed. If it fails, it is not.
LinkedIn's implementation follows this established pattern but adds two layers of sophistication. First, the scanning code uses content-hashed bundle filenames and obfuscated variable names, making it resistant to detection by security tools that rely on signature matching or keyword analysis. Second, the scanning list of 6,236 extensions is comprehensive enough to function as a near-complete software inventory - far exceeding what would be necessary to detect a handful of unauthorized scraping tools.
LinkedIn internally refers to this system as APFC (Anti-fraud Platform Features Collection), also codenamed 'DNA.'
The device telemetry collection runs alongside the extension scanning. estimate() (available storage). This combination of data points produces a device fingerprint with high entropy - meaning it can uniquely identify most visitors even without cookies. The Electronic Frontier Foundation's research on browser fingerprinting has demonstrated that the combination of screen resolution, timezone, installed plugins, and hardware characteristics can uniquely identify over 94% of browsers.
This is the same class of surveillance technique that eBay deployed in 2020, when the company was caught running port scans against visitors' computers to detect remote access tools and fraud indicators. eBay's port scanning generated significant backlash and regulatory scrutiny.
TECHNICAL ANALYSIS: COMPETITIVE INTELLIGENCE AT SCALE
Of the 6,236 extensions LinkedIn scans for, over 200 are products that directly compete with LinkedIn's premium offerings - Sales Navigator, Recruiter, and LinkedIn Learning. The targeted competitor products include:
Apollo.io - a sales intelligence platform that enriches LinkedIn profile data with email addresses and phone numbers for outbound prospecting. Lusha - a contact data provider that overlays direct dial numbers and email addresses on LinkedIn profiles. ZoomInfo - an enterprise B2B intelligence platform that aggregates professional contact data from multiple sources including LinkedIn. Additional categories include CRM integration tools, email finder extensions, recruiter workflow tools, and professional networking assistants.
By detecting which visitors use competitor products, LinkedIn gains intelligence on competitor adoption rates, user demographics, geographic distribution, and usage patterns - all without those companies' knowledge or consent. A user who has Apollo installed is a sales professional likely paying for a LinkedIn alternative. A user with Lusha installed is circumventing LinkedIn's paywall for contact data. This intelligence has direct commercial value for LinkedIn's product strategy, pricing decisions, and competitive positioning.
The remaining 6,000+ extensions in the scanning list include categories entirely unrelated to LinkedIn's platform: grammar and writing assistants (Grammarly, LanguageTool), translation tools, password managers, ad blockers, accessibility tools, developer utilities, and tax preparation software. LinkedIn has not explained why detecting a tax professional's browser extensions constitutes "platform protection."
WHAT WAS EXPOSED
- Installed browser extensions - a software inventory of 6,236 programs, revealing professional tools (CRM, sales intelligence, recruiting), personal tools (grammar, translation, accessibility), security tools (password managers, VPNs, ad blockers), and specialized software (tax preparation, developer tools). Extension data reveals occupation, employer type, professional function, disability status (accessibility tools), language proficiency, and security practices.
- CPU core count - hardware specification revealing device age, capability, and price tier.
- Available memory - hardware specification enabling device classification (budget vs. professional vs. enterprise).
- Screen resolution - display configuration revealing device type (mobile, laptop, desktop, multi-monitor), manufacturer, and model range.
- Timezone - geographic location to the regional level.
- Language settings - native language and additional languages, indicating national origin, immigration status, and multilingual capability.
- Battery status - reveals whether the device is mobile, current charge level, and charging state - a known high-entropy fingerprinting vector that Firefox removed entirely in 2017 and Chrome restricted to secure contexts due to its fingerprinting potential - the W3C added privacy mitigations to the specification but did not deprecate it.
- Audio configuration - hardware audio properties that vary by device, providing additional fingerprinting entropy.
- Storage features - available disk space and storage quotas, varying by device and contributing to unique identification.
The combination of these data points creates a device fingerprint that persists across browsing sessions, survives cookie deletion, and can be used to track users across websites if the fingerprint data is shared with or accessible to third parties. LinkedIn collects this data from every visitor to its platform without explicit consent, without a visible privacy disclosure at the point of collection, and without providing an opt-out mechanism.
TECHNICAL FAILURE CHAIN
LinkedIn does not display a consent banner, pop-up, or in-page disclosure informing users that their browser extensions are being enumerated. The scanning occurs silently on page load. Under the ePrivacy Directive Article 5(3) and GDPR Article 6, accessing information stored on a user's terminal equipment (which includes querying installed extensions) requires informed consent unless it is strictly necessary for the service the user has requested. Extension scanning is not necessary to display a LinkedIn profile or feed.
LinkedIn claims the program detects extensions that "scrape data without members' consent." Identifying 200+ competitor products and 6,000+ unrelated extensions - including grammar tools and tax software - is not anti-scraping enforcement. It is a comprehensive software inventory with no legitimate proportionality defense under GDPR Article 5(1)(c) (data minimization).
Content-hashed bundle filenames and obfuscated JavaScript are defensive measures against detection. A legitimate security program does not need to hide from its own users. The obfuscation suggests LinkedIn anticipated that users, researchers, and regulators would object to the program if they discovered it.
Restricting the Fairlinked e.V. report author's LinkedIn account for "violating terms of service" after publishing the BrowserGate report is a retaliation pattern. Using platform access as leverage to suppress security research violates the principles of responsible disclosure and creates a chilling effect on future research.
LinkedIn stated it does "not use this data to infer sensitive information about members." This is not a denial of collection - it is a denial of one specific use case. LinkedIn has not disclosed what the device fingerprinting data is used for, how long it is retained, whether it is shared with Microsoft or third parties, or whether it is combined with LinkedIn's existing profile data to enhance user tracking.
Users cannot disable the extension scanning or device fingerprinting without using technical countermeasures such as browser profiles with no extensions installed, extension-isolation browsers, or script-blocking tools. LinkedIn provides no in-platform setting to disable this data collection.
INDICATORS OF COMPROMISE
No threat actor IOCs - this is a corporate surveillance program operated by LinkedIn Corporation.
- Scanning mechanismJavaScript extension enumeration via resource path probing
- ObfuscationContent-hashed bundle filenames, obfuscated variable names
- Extensions scanned6,236 (as of April 2026)
- Competitor extensions targeted200+ (including Apollo, Lusha, ZoomInfo)
- Growth trajectory~1,000 (May 2025) to 5,459 (December 2025) to 6,236 (April 2026)
- navigator.hardwareConcurrency (CPU cores)
- navigator.deviceMemory (RAM)
- screen.width / screen.height (resolution)
- Intl.DateTimeFormat().resolvedOptions().timeZone (timezone)
- navigator.language (language)
- navigator.getBattery() (battery status)
- AudioContext (audio hardware fingerprint)
- navigator.storage.estimate() (storage)
- eBay browser port scanning (2020) - analogous corporate fingerprinting program that scanned visitors' computers for remote access tools
- linkedin[.]com - all pages, all logged-in and logged-out visitors
REGULATORY EXPOSURE
European Union:
- ePrivacy Directive Article 5(3)Accessing information stored on a user's terminal equipment requires prior informed consent unless strictly necessary for the requested service. Browser extension enumeration and device fingerprinting are not necessary to provide LinkedIn's social networking service. This is the same legal basis CNIL used to fine Google EUR 150 million and Facebook EUR 60 million for cookie consent violations in 2022. Every EU member state's transposition of the ePrivacy Directive applies.
- GDPR Article 5(1)(c)Data minimization. Scanning for 6,236 extensions and collecting device telemetry when the stated purpose is detecting unauthorized scrapers violates the principle that personal data shall be "adequate, relevant and limited to what is necessary." Scanning for grammar tools and tax software to detect data scrapers is disproportionate on its face.
- GDPR Article 5(1)(a)Lawfulness, fairness, and transparency. Covert collection using obfuscated JavaScript violates the transparency requirement. Users are not informed that extension scanning occurs.
- GDPR Article 6 - No valid legal basis. Consent was not obtained. Legitimate interest cannot apply because the data subject's fundamental rights override LinkedIn's commercial interest in competitive intelligence gathering. Performance of a contract does not apply because extension scanning is not necessary to provide the LinkedIn service.
- GDPR Article 13 - LinkedIn's privacy policy does not specifically disclose browser extension enumeration or the scope of device fingerprinting. Failure to provide required information at the point of data collection.
- Fines - Up to EUR 20 million or 4% of annual global turnover, whichever is higher. Microsoft's FY2025 revenue was $281.7 billion. Four percent equals approximately $11.3 billion.
United Kingdom:
- UK GDPR / DPA 2018 - Mirrors EU GDPR obligations. ICO enforcement powers include fines up to GBP 17.5 million or 4% of global turnover.
- Privacy and Electronic Communications Regulations (PECR)UK transposition of the ePrivacy Directive. Regulation 6 requires consent for storing or accessing information on a user's device.
United States:
- CCPA/CPRA - California residents have the right to know what personal information is collected and the purpose of collection. Browser fingerprinting data constitutes personal information under the CCPA's broad definition. Statutory damages of $100-$750 per consumer per incident.
- FTC Act Section 5 - LinkedIn's public claim that it does "not use this data to infer sensitive information about members" while collecting data that inherently reveals sensitive information (accessibility tool use indicates disability, language tools indicate national origin) could constitute a deceptive practice under Section 5.
Germany:
- TTDSG Section 25 - Germany's transposition of ePrivacy Article 5(3) explicitly requires consent for accessing information stored on a user's terminal equipment.
France:
- CNIL enforcement precedent - CNIL fined Google EUR 150 million and Facebook EUR 60 million in December 2021 for cookie consent violations under Article 82 of the Loi Informatique et Libertes. LinkedIn's extension scanning without consent is directly analogous.
Saudi Arabia:
- PDPL - Collection of device fingerprinting data from Saudi residents without consent may violate the PDPL's consent requirements. Fines up to SAR 5 million.
UAE:
- Federal Decree-Law No. 45/2021 (PDPL)Applies to processing of personal data of UAE residents. Fines up to AED 10 million.
Switzerland:
- revFADP - Imposes personal liability on individuals responsible for data protection violations. LinkedIn executives responsible for authorizing the extension scanning program could face individual fines up to CHF 250,000.
INTELLIGENCE GAPS
LinkedIn states it does "not use this data to infer sensitive information about members" - but has not disclosed what the data is used for, how long it is retained, or whether it is shared with Microsoft, advertisers, or other third parties.
If LinkedIn links extension detection results with user profiles - creating records showing that a specific named individual uses specific competitor products, accessibility tools, or other extensions - the privacy impact escalates from anonymous fingerprinting to named surveillance.
The earliest public documentation dates to 2025, but the program's maturity suggests it may have been operational for significantly longer.
LinkedIn is a wholly owned subsidiary of Microsoft. Whether the extension scanning data flows into Microsoft's broader advertising, analytics, or enterprise intelligence platforms has not been addressed.
37 O 104/26, Landgericht München I) filed by Teamfluence Signal Systems OU against LinkedIn Ireland/LinkedIn Germany has not been publicly reported. Whether the preliminary injunction was granted or denied is unknown.
The technique works identically in Edge, Brave, Opera, and other Chromium derivatives.
Whether any EU data protection authority has opened a formal investigation is unknown.
Two of its three board members are executives at Teamfluence Signal Systems OU - the same company that filed the German court case and operates a LinkedIn browser extension that LinkedIn's terms prohibit. Fairlinked is effectively Teamfluence's advocacy arm. The technical findings remain independently verified by BleepingComputer and multiple GitHub researchers, but the legal framing, commercial impact claims, and advocacy narrative originate from a party with direct financial interest in the outcome. This conflict does not invalidate the evidence but should inform how the non-technical claims are weighted.
ZERO|TOLERANCE Advisory
Any employee who visits LinkedIn on a corporate device is having that device's installed extensions inventoried and its hardware fingerprinted - without their knowledge or consent.
Use a browser profile with no extensions installed when accessing LinkedIn. This prevents extension enumeration from returning meaningful results.
If your organization's web properties execute similar JavaScript, verify that you have obtained valid consent under ePrivacy Article 5(3) and GDPR Article 6.
EU-based organizations can file complaints with their national DPA under GDPR Article 77.
Organizations with enterprise LinkedIn contracts should use contractual leverage to demand written disclosure of what data is collected from their employees.
SOURCES
BleepingComputer, Fairlinked e.V. (BrowserGate Report), Cybernews, PiunikaWeb, Hacker News (community discussion), mdp/linkedin-extension-fingerprinting (GitHub), dandrews/nefarious-linkedin (GitHub, 2017 original discovery), Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting (NDSS 2020), CNIL (Google/Facebook cookie enforcement decisions), Irish DPC (LinkedIn EUR 310M fine for transparency failures)