Security1 publisher2 min readPublished
Federal judge orders ProAPIs and Netswift to delete the LinkedIn data they scraped
LinkedIn sued last October over a network of bogus accounts it said numbered in the millions. A California judge has now finalized a consent judgment requiring the two firms to stop scraping, stop selling, and destroy what they took.
The Watch · Security desk
What happened
- A California federal judge on Thursday finalized a deal between LinkedIn, ProAPIs and joint business operator Netswift that requires the two firms to stop scraping LinkedIn user data on a mass scale.
- A senior LinkedIn executive said the agreement also bars selling or transferring the data and access through fake accounts, and requires the firms to delete what they scraped.
- LinkedIn's complaint, filed last October against the companies and their CEO, alleged a network of bogus accounts numbering in the millions that scraped member data constantly.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Deletion falls on the defendants, so an enrichment or training corpus already sold on carries data a court has ordered destroyed at source. The buyer has no attestation to point to.
- constraint Blocking accounts hours after creation did not stem the collection. Platforms are left litigating identity-abuse at volume instead of engineering it away.
- precedent Two publicized LinkedIn wins in five months raise the commercial cost of reselling platform data, though a consent judgment binds only the named firms and sets no precedent other courts must follow.
LinkedIn told the court it routinely located and blocked the phony profiles within hours of creation, and that even inside that window the operators could scrape hundreds of profiles [7]. The complaint puts new account creation at hundreds or even thousands a day, and says that volume made the scraping impossible to stop [8].
Take one hundred as the floor for each of those "hundreds": a hundred accounts a day at a hundred profiles apiece is 10,000 profiles a day, roughly 3.65 million in a year [1]. Those are the smallest numbers the pleading supports, and LinkedIn alleged the collection ran on a constant basis [5]. The data pulled included member, company and school information along with reactions, comments and posts [6].
The settlement terms come from LinkedIn's side of the case. Sarah Wright, who oversees litigation and enforcement at the company, described them in a post on Thursday: stop scraping, stop selling and transferring the data, stop reaching LinkedIn through fake accounts, and delete what was taken [2][3]. "Your profile is yours," Wright said. "What you choose to share on LinkedIn is meant for the professional community you're building, not for an outside company to scrape and use in ways you never agreed to." [11]
ProAPIs, which describes itself as a "data pipeline platform", posted a comment on its own website saying it "does not offer tools to scrape LinkedIn" [9]. The same post said the company "has agreed to a consent judgment in United States federal court that it will cease scraping LinkedIn and will never scrape LinkedIn in the future" [10]. A customer reading both sentences learns that the seller denies the product category and has promised a federal court never to do the thing again.
The judgment reaches ProAPIs and Netswift, the joint business operator, and requires them to destroy their copy [1][2]. Records already shipped to paying customers sit outside the terms LinkedIn described.
This is the second enforcement win LinkedIn has publicized in five months. Wright announced the earlier one against a firm accused of distributing a browser extension that scraped user data without consent [12]. The Record's account of the ProAPIs settlement is silent on payment or damages [13]. The company's own post leaves out the case against the CEO, a defendant since LinkedIn sued in October [4].
What to watch
- Whether ProAPIs and Netswift publish a deletion attestation, and whether LinkedIn accepts it as satisfying the judgment.
- Any LinkedIn action against downstream purchasers of scraped profiles. That would extend liability past the scraper itself.
- How the claims against the companies' CEO, a named defendant since October, are resolved.