On this page
The legal question, once per account
The US statute that would theoretically apply here is the Computer Fraud and Abuse Act (CFAA), aimed at unauthorized computer access. LinkedIn tested it against a company scraping public profile data at scale, and the result matters for anyone running outreach on behalf of clients.
hiQ Labs v. LinkedIn went to the 9th Circuit twice — 2019, then again in 2022 after the Supreme Court remanded it — and both times the court held that scraping data LinkedIn makes publicly visible isn't a CFAA violation. "Without authorization," the court said, means bypassing an access control, not violating a platform's terms of service.
The part agencies specifically should know: hiQ won that argument and lost the case anyway. LinkedIn's separate breach-of-contract claim held, and hiQ settled in November 2022 — a permanent injunction, forced deletion of the scraped data, and a $500,000 payment. Translate that to agency work: no criminal exposure for running automation on a client's behalf, but each account it runs on is individually exposed to LinkedIn's contract-enforcement mechanism, and that risk doesn't pool or average across your client roster — it applies per account.
What the User Agreement covers
LinkedIn's stated terms prohibit third-party automation of platform activity — connection requests, messages, profile scraping — without exception for who's operating the account or why. An agency running a tool on a client's account puts that specific account outside the agreement, not the agency's own accounts or business entity. The consequence is account-level: restriction, lock, or termination of that one account. There's no criminal liability attached, for the agency or the client.
If a client account gets flagged
LinkedIn hasn't published exact enforcement thresholds, but the visible pattern is graduated rather than an instant ban — worth knowing before you set expectations with a client:
- A warning — in-app or email notice about unusual activity on that account specifically.
- A temporary invitation restriction, typically clearing somewhere between a few hours and about a week.
- A quiet reduction in daily allowance — no notification, just reduced capacity.
- An identity or phone verification lock before access is restored.
- Permanent suspension, usually after repeated warnings on that account go unheeded.
Each of these applies to the individual account, not to every account you manage — unless several accounts share infrastructure that itself gets flagged, which is exactly the architectural risk the comparison table on this site is built around.
What LinkedIn is believed to track
Detection logic isn't public, so this is the working model automation vendors design around, not confirmed mechanics — relevant across every account an agency runs, not just one:
- Pace: the same monthly volume reads differently spread across a day than fired in bursts, on any given account.
- Acceptance rate: a high rate of ignored invitations is a known trigger, independent of which account it's happening on.
- Repeated phrasing: the same template sent from multiple client accounts is a pattern worth avoiding for exactly this reason.
- Network signals: shared infrastructure, datacenter IPs, or sudden location shifts across accounts you manage.
None of this is LinkedIn-confirmed, so treat it as the industry's best estimate rather than a specification.