LinkedIn has successfully defended itself against two lawsuits concerning its practice of scanning users’ browser extensions, with a judge dismissing both cases. The judge ruled that the plaintiffs failed to establish standing to sue, as neither plaintiff asserted that they had browser extensions installed that conveyed private information to LinkedIn. The judge granted the plaintiffs leave to amend their complaints but expressed doubt about their ability to form a plausible case, noting that users voluntarily download extensions that intentionally expose data to websites, making a privacy violation claim unlikely.
Two separate class-action lawsuits were filed in April by California residents Nicholas Farrell and Jeff Ganan. Ganan's attorney, J.R. Howell, is considering whether to refile the claims in a California state court, which has different standing requirements, or to appeal the US district court's ruling to the US Court of Appeals for the Ninth Circuit. Howell stated that the federal court lacked jurisdiction and did not rule on the lawfulness of LinkedIn's surveillance practices.
"BrowserGate" Lawsuits Stem from Scraping Dispute
The lawsuits were initiated following a report alleging that LinkedIn was illegally searching users' computers. LinkedIn acknowledged scanning browsers to identify extensions and stated in its privacy policy that it collects information about users' web browsers and add-ons using cookies and similar technologies.
The "BrowserGate" report was published by Fairlinked, a German trade association and advocacy group for commercial LinkedIn users, which appeared to be operated by the same individuals behind Teamfluence, an Estonian software company that had previously sued LinkedIn in Germany.
Howell, who represents Ganan, also serves as counsel for Fairlinked in the US. He indicated that his investigative work with Fairlinked and Browsergate preceded the filing of the Ganan complaint.
LinkedIn argued in its motion to dismiss that its detection systems are designed to identify automated scraping and bot activity, such as that employed by Teamfluence. The company stated that Teamfluence markets a Chrome browser plug-in to identify LinkedIn traffic, and that LinkedIn identified and banned its CEO, leading to a German legal dispute where a tribunal found Teamfluence's software violated LinkedIn's User Agreement.
Judge Finds Plaintiffs Alleged No Concrete Harm
Following the German court order, Fairlinked released the BrowserGate report. LinkedIn's motion highlighted that the founder of Teamfluence is on Fairlinked's board, suggesting a retaliatory campaign. LinkedIn asserted that Teamfluence was the entity scraping data without consent.
Judge Chhabria's ruling emphasized that neither Farrell nor Ganan specifically alleged that their own browser extensions conveyed private information to LinkedIn. Ganan did not allege having any extensions, while Farrell only generally stated that his extensions "often reveal sensitive private information" without specifying if his own did.
The judge concluded that these allegations were insufficient to confer standing, as federal courts require plaintiffs to demonstrate concrete harm. Identifying hypothetical categories of private information that could be revealed was not enough to establish standing particularized to the plaintiffs' circumstances.
While Ganan argued that the harm was the "unpermitted probe" itself, the judge cited precedent requiring plaintiffs to identify "embarrassing, invasive, or otherwise private information collected by" the defendant.
Lawyer Vows to Continue Legal Action
LinkedIn's motion to dismiss stated that its detection tools identify browser extensions that could threaten the platform's security and integrity. The company asserted that the information detected is openly provided by extensions to all websites for interaction and is not private. LinkedIn also claimed its right to detect this information and use security vendors is disclosed and agreed to by its members.
LinkedIn further argued that some Chrome extensions extract data from its website, which is prohibited by its terms of service. The company stated that its platform is a target for opportunistic developers seeking to scrape its data.
Howell stated that the Ganan lawsuit alleges LinkedIn deployed code without user consent to surveil internal computing environments and collect data. He emphasized the importance of meaningful consent and judicial scrutiny as companies' surveillance capabilities expand, and vowed to pursue the claims in a forum that can adjudicate them on their merits.
Ars Technica also reached out to Farrell's lawyers for comment and will update the article if a response is received. Farrell's lawsuit, while not appearing to be directly coordinated with Fairlinked, was largely based on the BrowserGate report.
