California Online Privacy Protection Act Notice

LinkedIn · Official agreement

Read the agreement

10 of 10 cards

Data Access & Collection · Company practice

LinkedIn does not respond to browser Do Not Track signals

If your browser sends a Do Not Track (DNT) signal, LinkedIn does not use it or respond to it. The reason LinkedIn gives is that no DNT standard has been adopted. The notice describes this as LinkedIn's current practice, tied to the absence of a standard, not as a permanent rule.

Supporting quotations

A Do Not Track (DNT) standard has not been adopted to this day, and therefore LinkedIn doesn't use DNT signals.
With regard to DNT, LinkedIn currently doesn't respond to DNT signals in browsers because no DNT standard has been adopted, as noted above.
Last updated: 2 years ago

Qualifications & exceptions

  • Stated as current practice ("currently", "to this day") and tied to the lack of an adopted DNT standard.
  • The page shows only a relative date ("Last updated: 2 years ago"); no calendar date is given for when this was last true.

Not stated here

  • The notice does not say what tracking takes place on LinkedIn when a browser sends a DNT signal, or whether LinkedIn would respond if a standard were adopted.

Sharing & Disclosure · Restriction or exception

No collection of members' PII for third parties via ad technology without separate consent, except per Privacy Policy

LinkedIn says it does not authorize the collection of members' personally identifiable information (PII) on LinkedIn for third-party use through advertising technologies unless the member gives separate consent. This is limited by an exception: "Except as described in our Privacy Policy". The Privacy Policy is not part of this notice, so what that exception allows is not shown here.

Supporting quotations

Except as described in our Privacy Policy, LinkedIn doesn't authorize the collection of Personal Identifiable Information (PII) from our members on LinkedIn for third party use through advertising technologies without separate member consent.

Qualifications & exceptions

  • Opens with "Except as described in our Privacy Policy", so the Privacy Policy may permit such collection in cases this notice does not list.
  • Covers collection from members on LinkedIn for third-party use through advertising technologies; separate member consent lifts the restriction.

Not stated here

  • The Privacy Policy is referenced but not supplied with this notice, so the scope of the exception is unknown.
  • The notice does not say what counts as "separate member consent" or how it is given.

Sharing & Disclosure · Restriction or exception

Ads on LinkedIn: third parties not authorized to identify members through ad technology without separate consent

In the DNT context, LinkedIn says it does not authorize third parties to identify LinkedIn members through advertising technologies deployed in ads that may appear on LinkedIn, unless there is separate consent. The statement is about LinkedIn's authorization; the notice does not describe technical measures that stop such identification.

Supporting quotations

In the DNT context, however, LinkedIn doesn't authorize the identification of LinkedIn members by third parties through advertising technologies deployed in ads that may appear on LinkedIn without separate consent.

Qualifications & exceptions

  • Framed as applying "In the DNT context" and to advertising technologies deployed in ads that may appear on LinkedIn.
  • Separate consent lifts the restriction.

Not stated here

  • Whose consent and how it is obtained are not stated.

Sharing & Disclosure · Context

Much personal information on LinkedIn is visible to any visitor

LinkedIn describes itself as inherently a public place where a lot of personally identifiable information is viewable by any visitor. As a result, third parties can find out about you from the information you share on LinkedIn's services. This answers the question of whether LinkedIn shares members' PII with third parties such as advertisers by pointing to what members themselves make visible.

Supporting quotations

LinkedIn is, inherently, a public place, and there is a lot of PII on LinkedIn that is viewable by any visitor. In other words, third parties can find out about you from the info you share on our services.
Does LinkedIn share members' personally identifiable information with third parties (like advertisers and ad networks)?

Qualifications & exceptions

  • Concerns information members share on the services that is viewable by visitors; it is distinct from identification through advertising technologies, which a separate statement addresses.

Not stated here

  • The notice does not say which profile information is public by default or which visibility settings exist.

Cross-references

  • contrast (model-proposed): Ads on LinkedIn: third parties not authorized to identify members through ad technology without separate consent — contrast: The notice says third parties can learn about members from information they share, since much PII on LinkedIn is viewable by any visitor; it then says ('however') that in the DNT context LinkedIn does not authorize third parties to identify members through advertising technologies in ads on LinkedIn without separate consent. Read together: visible profile information is open to anyone, while identification through ad technology needs separate consent.

Data Access & Collection · Company practice

Share-button plugins: passive impression data depersonalized; active interaction data kept

When someone visits a website that contains LinkedIn JavaScript buttons ("plugins"), such as the Share button, LinkedIn receives plugin passive impression data and says it depersonalizes that data immediately. This applies to anyone visiting such a site, not only members. When members actively interact with a plugin, for example by sharing an article on LinkedIn, LinkedIn keeps that information to provide the function and to improve their and others' LinkedIn experience.

Supporting quotations

When someone visits websites that contain JavaScript buttons ("plugins"), like LinkedIn's Share button, we receive plugin passive impression data that we depersonalize immediately.
When members actively interact with our plugins (for example, sharing articles on LinkedIn), we keep this information to provide respective functionality and improve their, and others' LinkedIn experience.

Qualifications & exceptions

  • Passive impression data is depersonalized "immediately"; information from active interactions by members is kept.
  • The stated purposes for kept interaction data are providing the plugin's functionality and improving members' and others' LinkedIn experience.

Not stated here

  • The notice does not define "depersonalize" or say how long interaction data is kept.
  • The page for "how we use and protect plugin data" is mentioned but not supplied.

Legal Rights & Agreement Rules · Context

Why this notice exists: California's A.B. 370 amendment to CalOPPA

The notice explains that California A.B. 370, signed on September 27, 2013, amended the California Online Privacy Protection Act (CalOPPA) to require website operators like LinkedIn to disclose how they respond to DNT signals and whether third parties collect personally identifiable information about users when they visit LinkedIn. This is LinkedIn's description of the law; the law itself is not part of this notice.

Supporting quotations

On September 27, 2013, California Governor Jerry Brown signed into law A.B. 370, amending the California Online Privacy Protection Act (CalOPPA) to require website operators like LinkedIn to disclose how LinkedIn responds to DNT Signals; and whether third parties collect personally identifiable information (PII) about users when they visit LinkedIn.

Qualifications & exceptions

  • The description of A.B. 370 and CalOPPA is LinkedIn's summary; the statute's text is not supplied.

Legal Rights & Agreement Rules · Company commitment

LinkedIn says it also complies with the CCPA; details are in a separate CCPA Notice

Besides CalOPPA, LinkedIn states that it complies with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CCPA). It points to a separate CCPA Notice for details. That notice is not part of this document, so the CCPA rights and practices it describes are not covered here.

Supporting quotations

In addition to complying with CalOPPA, LinkedIn also complies with the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) (“CCPA”).

Qualifications & exceptions

  • The CCPA details are in a linked CCPA Notice that is not supplied with this document.

Not stated here

  • The content of LinkedIn's CCPA Notice, including any California privacy rights it offers, is not shown here.

Data Access & Collection · Context

What DNT is and how a browser sends the signal

DNT is a concept promoted by regulators, in particular the U.S. Federal Trade Commission, for the internet industry to build a way for users to control tracking of their online activities across websites. Several browsers offer a DNT option that sends a header signal to websites about the user's DNT preference, usually set in the browser's preferences. Because LinkedIn says it does not respond to DNT signals, this notice gives no effect on LinkedIn to turning the option on.

Supporting quotations

DNT is the concept that has been promoted by regulatory authorities, in particular the U.S. Federal Trade Commission (FTC), for the Internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites.
Currently, various browsers (including Internet Explorer, Firefox, and Safari) offer a DNT option that relies on a technology known as a DNT header that sends a signal to websites visited by the browser user about the user's DNT preference.
You can usually access your browser's DNT option in your browser's preferences.

Qualifications & exceptions

  • The browser list (Internet Explorer, Firefox and Safari) is given as examples and reflects the notice's own date.

Data Access & Collection · Company commitment

No DNT standard adopted; LinkedIn commits only to keep track of W3C work

The notice says the World Wide Web Consortium (W3C) has been working on a DNT technology standard but progress has been slow and no standard has been adopted. Without one, users cannot know how any company handles a DNT signal. LinkedIn commits to remaining apprised of the W3C's efforts; the notice does not say LinkedIn will adopt or honor a standard if one is adopted.

Supporting quotations

While some progress has been made on this issue, it has been slow, and to date no standard has been adopted.
Without an industry standard for DNT, users cannot know how any given company abides by a DNT signal they receive from browser headers.
LinkedIn is committed to remaining apprised of the W3C efforts to develop a DNT standard.

Qualifications & exceptions

  • The commitment is to stay informed of W3C efforts, not to change LinkedIn's DNT practice.

Not stated here

  • The notice gives no date for its statement that no standard has been adopted beyond the relative "Last updated" line.

Legal Rights & Agreement Rules · Context

Privacy Policy uses California Civil Code §1798.83's definition of "direct marketing"

LinkedIn notes that its Privacy Policy uses the definition of "direct marketing" from California Civil Code §1798.83, which the notice describes as marketing directly to individuals by mail, phone or e-mail for personal purposes. This notice does not itself say whether or how LinkedIn shares information for others' direct marketing.

Supporting quotations

Please note, that our Privacy Policy uses the definition of "direct marketing" provided by the California Civil Code §1798.83, to include marketing directly to individuals by means of mail, phone, or e-mail for personal purposes.

Qualifications & exceptions

  • The definition is applied in the Privacy Policy, which is not supplied with this notice; the Civil Code text is not supplied either.

Not stated here

  • How the Privacy Policy uses this definition is not shown here.