A federal judge has dismissed two class-action lawsuits accusing LinkedIn of secretly scanning users' browsers for installed extensions, ruling that the plaintiffs never alleged a concrete privacy harm.
Judge Vince Chhabria of the US District Court for the Northern District of California tossed the cases on Tuesday, finding that neither plaintiff "alleges that they, specifically, had browser extensions installed that conveyed private information to LinkedIn." One plaintiff, Jeff Ganan, never said he had extensions installed at all; the other, Nicholas Farrell, said only that he "has long had several browser extensions installed" and that extensions in general can reveal sensitive information.
The suits were filed in April, weeks after a report dubbed "BrowserGate" claimed LinkedIn runs hidden JavaScript that scans visitors' Chrome browsers against a catalog of thousands of extensions. LinkedIn did not deny scanning, and its privacy policy already discloses that it collects information about users' "web browser and add-ons." The company told the court the practice is a security measure to detect scraping and bot activity — pointing to Teamfluence, an Estonian firm whose CEO was banned from LinkedIn after it marketed a Chrome plug-in to "identify 100% of your LinkedIn traffic." LinkedIn's filing notes that Fairlinked, the German group behind the BrowserGate report, shares personnel and legal counsel with Teamfluence and describes the campaign as retaliation.
Chhabria gave the plaintiffs leave to amend but sounded skeptical, writing that because users voluntarily install extensions that "by their nature intentionally expose data to websites," a privacy violation may never be plausible. Identifying categories of private information that surveillance could hypothetically reveal is not enough for standing, he said; a plaintiff must identify "embarrassing, invasive, or otherwise private information collected by" the defendant.
Ganan's lawyer, J.R. Howell — who also serves as US counsel for Fairlinked — said the court "did not adjudicate whether LinkedIn's surveillance practices were lawful," called the ruling "not a vindication of the mass surveillance program alleged in our complaint," and told Ars Technica he is weighing a refiling in California state court, which has different standing rules, or an appeal to the Ninth Circuit. The dispute's origin in a scraping fight rather than a privacy complaint is likely to matter if it continues.
