LinkedIn is facing legal action in the United States over allegations that it secretly monitored users’ browsers by scanning thousands of installed extensions without clear consent.

Two class-action lawsuits, filed in a California federal court, accuse the platform of violating privacy and anti-hacking laws by deploying code that detects browser extensions and transmits that data back to its servers.

At the centre of the claims is a hidden script that allegedly scanned for more than 6,000 Chrome extensions during user sessions. Investigators say the tool ran silently, collecting detailed device and behavioural data and linking it to users’ identities on the platform.

The lawsuits stem from findings by Fairlinked e.V., a European association of LinkedIn users, which described the practice as “BrowserGate”. The group argues that the scale of the data collection goes far beyond legitimate security measures.

Independent cybersecurity outlet BleepingComputer later confirmed that the scanning activity was active across Chromium-based browsers, including Chrome, Edge, Brave and Opera, as recently as April 2026.

Plaintiffs Nicholas Farrell and Jeff Ganan claim the practice breaches several laws, including the Computer Fraud and Abuse Act and the Electronic Communications Privacy Act, as well as California privacy regulations.

According to the complaints, the data gathered could reveal sensitive personal information. Certain browser extensions may indicate religious practices, political affiliations, health-related conditions or even whether a user is searching for a new job.

Because LinkedIn accounts are tied to real identities, including names, employers and job titles, critics argue that such data cannot be considered anonymous.

Under European data protection standards, particularly GDPR rules on sensitive data, such information would require explicit user consent and a clear legal basis for processing. The lawsuits contend that LinkedIn did not provide sufficient disclosure.

LinkedIn has defended its actions, stating that it monitors extensions primarily to detect tools that scrape data or violate its terms of service. A company spokesperson said the platform does not use the data to infer sensitive personal characteristics.

However, the lawsuits challenge that position, arguing that the breadth of extensions scanned suggests a wider purpose beyond fraud prevention.

The complaints also raise concerns about competitive intelligence. They allege that LinkedIn may detect the use of third-party business tools, allowing it to infer which companies rely on rival platforms and potentially use that insight for commercial advantage.

Further scrutiny has focused on data sharing practices. Investigators claim some of the collected data may have been transmitted to HUMAN Security, a firm specialising in bot detection and online fraud prevention. LinkedIn has disputed aspects of these findings.

The case adds to growing global concern over how major platforms collect and use personal data, particularly as regulators in Europe tighten enforcement under laws such as the Digital Markets Act.

For professionals who rely on LinkedIn for visibility and career growth, the issue raises deeper questions about consent and control. In many industries, maintaining a LinkedIn presence is no longer optional, which critics say creates an imbalance in how users engage with the platform’s terms.

Legal proceedings could take time to resolve. In the meantime, the controversy highlights the widening gap between what platforms disclose about data collection and what their underlying systems may actually do.

As scrutiny intensifies, the outcome of the case could shape how digital platforms handle user data, particularly where personal identity and behavioural tracking intersect.