LinkedIn profile visitor lists belong to the people, says Noyb

https://www.theregister.com/offbeat/2026/05/05/noyb-cries-foul-on-linkedin-withholding-profile-visitor-data/5225338

by robin_reala • 3 months ago

222 81 3 months ago

don't see the issue, the data of who visited my profile belongs first to the visitor and to me iff i pay for it. seems pretty clear, no?

throw_a_grenade3• 3 months ago

No, that's the point. If the data pertains to you, it's yours. No "iff I pay for it".

chasd00• 3 months ago

wouldn't that mean every piece of cctv footage that has me in it also belongs to me? i don't see it (no pun intended).

krystalgamer3• 3 months ago

exactly, but it doesn’t pertain to you until you pay.

if we assume there’s a directional graph with edges labeled as “visited”. what linkedin is offering is to traverse it backwards for a fee.

what they’re demanding is ludicrous. pure entitlement that would have horrible ramifications for all social media platforms.

should a gdpr export include who has unliked/unreposted your posts too? it definitely pertains to you.

phasefactor• 3 months ago

Love it, the article referring to a statement by a LinkedIn spokesperson: "The first part of that statement is false, as you can see from the screenshot above. Given the obvious untrustworthiness of that half of the statement, we didn't bother wasting any time trying to evaluate the second part."

noutella• 3 months ago

They do say they won’t bother, but the rest of the article is actually precisely covering this second point, aka Article 15 of LK Privacy Policy

loloquwowndueo• 3 months ago

Rhetorical argument is rhetorical?

SAI_Peregrinus2• 3 months ago

It's covering article 15 of the GDPR, not of LinkedIn's Privacy Policy.

elsjaako• 3 months ago

To be technically correct: if even a single non-premium member can, for some reason, see who viewed their profile, then the statement "only Premium members can see who has viewed their profile" is false.

So technically, you can't say that the first part of the statement is false from the screenshot.

huhkerrf• 3 months ago

But the statement wasn't false, was it? I'm not a paying member of LinkedIn, and I can see who visited my profile.

xerox13ster• 3 months ago

What you have is the ability to see every 5th person who entered your house.

thrance• 3 months ago

Seriously, this is what I miss the most in legacy media. Much too often "journalists" will simply relay politicians' statements uncritically, when they're obviously fallacious or straight lies. This is very refreshing on The Register's part.

noname120• 3 months ago

This is the ludicrous part:

LinkedIn rejected the request on the grounds that protecting that data took precedence.

Guess that implies that paying takes precedence on data protection

bee_rider4• 3 months ago

I wonder if they will be able to make any argument along the lines of: we’re much more confident about the identities of paying customers so we think there’s less privacy risk in that case.

I think they should lose the case but I’m curious if anyone can think of a good argument for their side, at all (in the European context where there are data laws, “it’s their website they do what they want” is the conventional US perspective but I don’t really see what that leaves us to discuss).

jmkd• 3 months ago

They should give the data to people who ask, which will be a snapshot in time presented in a spreadsheet. Then what you are paying for is the interface that shows you who clicked yesterday with a thumbnail and a link to their profile, and who will click tomorrow, as long as you keep paying. But refusing the download option is not on.

immanuwell• 3 months ago

Noyb basically built a logic trap linkedin can't squirm out of: either selling the visitor list to premium users is illegal or handing it over for free under article 15 is mandatory - pick one

menno-sh• 3 months ago

Oh I LOVE this, we can't have enough of these privacy-focused non-profits making tech companies' lives difficult. They have such a strong argument here, too. I can imagine that whoever came up with this is very pleased with theirselves, and rightfully so.

theturtlemoves3• 3 months ago

[flagged]

isodev• 3 months ago

Correction, we hate making money at the expense of other peoples rights and liberties. It's kind of frustrating to have to explain that to US folks over and over again... all that "freedom" in their things is apparently very decorative.

micromacrofoot• 3 months ago

"In Ireland, people have an interesting attitude toward success—they look down on it. In America, you look at the mansion on the hill and think, 'One day that will be me.' In Ireland, people say, 'One day, I'm going to get that bastard!'"

Anonbrit• 3 months ago

I'd say instead that we value the commons and don't like companies making money by externalising all their problems to the general public.

If company Foo leaks my personal data, I suffer, they don't, so without regulation there's no reason for them to invest in protecting it. Same with pollution and similar

lmf4lol• 3 months ago

I don’t agree. I run a startup in Europe for a couple of years. I never had once someone hating in me because we are successful. Literally everyone I talked with abiut it thinks its super cool what we do and supported the efforts and wished us best of luck or offered actual help.

The Europeans are very aware of the externalities of businesses. This translates to more bureacracy and often also into pretty dumb “solutions” (cookie banner). Gdpr is not one of those dumb solutions btw. Its annoying to implement, true, and it puts EU business at a disadvantage compared to US businesses, but it gives also power to the people. And that is what counts in the end.

Ask yourself: do you really want to live in a Jarvinian techno-monarchy, where companies are the ultimate power holders? I am not so sure I want that.

My hope for the future is that Europeans will eventually build proper alternatives to US companies and escape the chokehold. Then we all play by our own rules and no one is at a disadvantage. Seems like a pipe dream now, but then I remember that England ruled the world not so long ago and China was a third world country nit worth mentioning. Things can turn quickly!

One more thing: Brussel really goes too far, too often. So I am always crossing my fingers for more market liberal parties to gain influence. I dont like a huge government. Not at all. But i dont believe in the nightwatch government idea either.

weezing• 3 months ago

Being an European doesn't make your arguments less ridiculous.

Snow_Falls2• 3 months ago

I'm european (what a vague term...) and I disagree completely. I have never seen this attitude you apparently have. I've seen lots of celebration of innovation and entrepreneurship, I've seen less appreciation for the american style "anything goes as long as the stock price goes up" business environment.

dang2• 3 months ago

Please don't post national/regional slurs to HN. I agree that it's different when you're part of the group, but from a moderation point of view the effect on the threads ends up being bad anyway.

https://news.ycombinator.com/newsguidelines.html

scosman2• 3 months ago

Not sure I follow the logic. The list of profiles I visit feels like it’s my data, not the owners of target profile. By that logic can I GDPR chrome for the browsing history of anyone who has visited my site? IANAL but I thought GDPR is about getting a copy of your data, not others.

zkmon• 3 months ago

Going by that logic, they shouldn't be selling your data to their premium users. Either way, LinkedIn is on the wrong footing.

nananana9• 3 months ago

They can spin it as "the list of profiles you visit is your data", this list they'll probably give you if requested, but in addition they're also willing to sell you others' data (the list of people who visit you).

Not precisely a nice way to put it, but it seems consistent to me.

scosman2• 3 months ago

I believe GDPR says you can access a copy of data they store about you, not that they can't sell it.

ajdude• 3 months ago

I think it's more like if you owned a blogspot site, and you're gdpr'ing the list of users who visited your site (given Google logged every single user who visited, and associated that visit specifically with you).

Linkedin is recording every person who visits your profile and keeps that in your user records, and they are already selling it back to you. The argument is that you have a right to that data.

Linkedin is arguing that this data needs to be protected for the privacy of those visiting your profile and the argument is that if they really believed that, they wouldn't sell it back to you, compromising that privacy anyway.

Macha• 3 months ago

The problem for linkedin is they try to simultaneously claim that it’s the visitors data and therefore they can’t disclose it at the same time as claiming its linkedin’s data so they can sell access to it

treis• 3 months ago

They claim they don't have to disclose it not that they can't.

Hamuko• 3 months ago

If Google approached me and offered me Chrome Premium that allows me to see the identities of everyone who has visited my site, I feel like we wouldn't be having this discussion right now.

Fokamul• 3 months ago

Linkedin, aka premium database for spear-phishing?

Linkedin is the best thing what happened for phishing since 4ever.

If you have a profile there, you're already lost. They gather your data and even network layout if you just open linkedin.

duxup• 3 months ago

I'm not a fan of how LinkedIn operates ... or the culture there in general.

At the same time I wonder what happens when users realize everything they look at is now more visible than ever? People just make fake accounts for browsing?

Maybe it should be that way, but there's an interesting dynamic to "what you look at (even if not a full picture) is visible to some people".

rusk• 3 months ago

Like a reverse panopticon - a truly terrifying concept if you tease it out …

therobots927• 3 months ago

I’m interested in hearing your thoughts further on this…

lokar• 3 months ago

Easy, sell people the option to hide their profile viewing

boothby• 3 months ago

That's so last week; we need micro-auctions between people who want to see and people whose data is involved.

pllbnk2• 3 months ago

Also have those fake accounts verified for a good measure, just like all the scammer accounts on LinkedIn.

dec0dedab0de2• 3 months ago

Interesting, does that mean if you use google analytics you can demand the details google has about every user that hits your site?

codethief3• 3 months ago

No, because your site is not a person, so data related to it is not protected under GDPR.

dec0dedab0de2• 3 months ago

what if the site is just a personal blog?

nkmnz• 3 months ago

I think the key point here is that LinkedIn distributes personal data of the profile owner to the visitor. That data is subject to GDPR, so the plaintiff assumes that they have the right to know who received that data from LinkedIn.

What kind of personal data of the website owner does google analytics distribute that makes that analogy work?

ChrisArchitect• 3 months ago

[dupe] Some more on source: https://noyb.eu/en/linkedin-locks-your-gdpr-rights-behind-pa... (https://news.ycombinator.com/item?id=48019775)

tensegrist• 3 months ago

isn't this also a thing on dating apps

codethief3• 3 months ago

I was going to raise this question here. Then again, the only thing you might get is an identifier of the person that swiped left/right on you. You won't really be able to do much with that, though, unless you reverse-engineer the dating site's API and invoke it directly to access dating profiles. …which apps might be able to prevent by using device attestation / Google SafetyNet etc. (You can't easily extract the auth key required for the API.)

strictnein• 3 months ago

I don't quite get the "GDPR requires you to share with someone the personal details of people who happened to visit a webpage that you setup on a free website" angle here. I don't get how that's your data and not the data of the people who visited the page?

That seems to violate the GDPR more than the current state, no? If I accidentally click on your profile you're entitled to my name and employer and that's your data now? Makes no sense, other than from a "GDPR good, US tech bad!" angle, I guess.

camillomiller• 3 months ago

I believe that the case here is different. That would be true, say, for your substack page. But in this case, your "profile" is more than just a web page, it contains personal information, which albeit public, is your property according to the law. Therefore any interaction with it falls under article 15. Personally I would find it fantastic if LinkedIn is forced to make this feature available to all users. I can't see it but as a win for consumers and a loss for inducing payment through extraction of interrelational value.

jjouett• 3 months ago

Agree, I don't fully understand the argument that this would be the owning profiles data, and not either Linkedin's or the viewer's. Would you be entitled to search query data from Google because your website is in some query results, and Google has to provide you that metadata for free?

buzer2• 3 months ago

It's both your data and that person's data.

(copied from my earlier comment) I think it's very close to C-579/21 which was about audit logs. In that one CJEU ruled that audit logs are personal data of you and the person who performed the action. They did allow censoring the person's name in that case (and exact timestamp), but given that in this case LI is selling this information to same person then "protecting others" rings pretty hollow.

miki123211• 3 months ago

Dating apps do this too; one of the major selling points of Tinder's premium plan is that you can see who swiped right on you.

They're not at as much of a risk though, as it's much more difficult to begin a chat with a Tinder user than it is on Linked In. Knowing the profile ID or whatever won't help you, if you can't open their profile in-app and swipe right on it, you can't begin a conversation.

archleaf• 3 months ago

Wouldn't this apply to every social network? Or is this because LinkedIn shows a teaser for free and more detail for paid?

victorbjorklund2• 3 months ago

If you mean that Meta probably has a list of which users visited which other users and that they use it for internal stuff? Well, then Meta could argue they won’t tell you who visited you because they need to protect their privacy (harder for LinkedIn since they are selling that data so clearly they don’t care)

drfloyd51• 3 months ago

Wait…

LinkedIn shared a public profile a user filled out for the purposes of sharing.

Someone viewed the profile.

How exactly is it “personal data” who viewed the profile?

If I put my resume on my website, is my ISP required to tell me who visited my website? (The logs give technical data, but not the name of the person viewing.)

buzer2• 3 months ago

Personal data is data that relates to to you. What relates to you is the list of users who viewed your profile.

I think it's very close to C-579/21 which was about audit logs. In that one CJEU ruled that audit logs are personal data of you and the person who performed the action. They did allow censoring the person's name in that case (and exact timestamp), but given that in this case LI is selling this information to same person then "protecting others" rings pretty hollow.

victorbjorklund2• 3 months ago

Lots of things are like that. A list of things you have bought. Well, the things themselves are not personal data. The relationship is.

pllbnk2• 3 months ago

I think SaaS pricing model has long been abusive. So, you have a platform, which takes real money to build and maintain. But then you build features on top of that platform, where some features are build-once and require not a lot of maintenance and no additional expenses - the code is just sitting there doing the stuff. Then you request additional money for that feature, which is effectively free for you.

Unlike physical goods where a higher price reflects higher production cost, SaaS companies have to engineer scarcity into a product that is naturally abundant.

In this LinkedIn example, they already collect the profile visitors for everyone. Instead, they spent additional engineering resources building the restriction layer and then charge the users to undo the sabotage.

mvrckhckr• 3 months ago

The price of something is not necessarily the function of the cost of producing it. It is the value to the buyer. Of course, you have edge cases on both sides of the scale, some things are of less value (to some markets) than the cost of producing them, and some things are of high value when producing them costs almost nothing. That's part of why free markets are so great, they are value-oriented and not only cost-based.

LinkedIn profile visitor lists belong to the people, says Noyb

Related Stories