{"id":719918,"date":"2026-04-05T18:45:11","date_gmt":"2026-04-05T15:45:11","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/"},"modified":"2026-04-05T18:45:11","modified_gmt":"2026-04-05T15:45:11","slug":"linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/","title":{"rendered":"LinkedIn secretly scans 6,000+ browser extensions and fingerprints your device"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_84 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a29021fccde5\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a29021fccde5\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/#What_the_script_does\" >What the script does<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/#What_it_is_looking_for\" >What it is looking for<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/#LinkedIns_defence_and_the_source_of_the_report\" >LinkedIn\u2019s defence and the source of the report<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/#The_regulatory_backdrop\" >The regulatory backdrop<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/linkedin-secretly-scans-6000-browser-extensions-and-fingerprints-your-device-2\/#What_this_means_for_users\" >What this means for users<\/a><\/li><\/ul><\/nav><\/div>\n<div id=\"article-main-content\">\n<p><em><strong>In short:<\/strong><span>\u00a0<\/span>Every time you visit LinkedIn in a Chrome-based browser, a hidden Java<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">Script<\/a> routine silently probes your browser for more than 6,000 installed extensions, collects 48 hardware and software characteristics about your device, encrypts the resulting fingerprint, and attaches it to every API request you make during your session. The practice, labelled \u201cBrowserGate\u201d by researchers, is not disclosed in LinkedIn\u2019s privacy policy. LinkedIn says it is a security measure; critics say it is covert surveillance of a billion users\u2019 browsing behaviour at industrial scale.<\/em><\/p>\n<p>There is a routine that runs on your computer every time you open LinkedIn. You cannot see it, you were not told about it, and it is not described in the company\u2019s privacy policy. According to an investigation published in early April 2026 by Fairlinked e.V., a European association of commercial LinkedIn users, the platform injects a 2.7-megabyte JavaScript bundle into its website that silently scans visitors\u2019 browsers for the presence of more than 6,000 specific Chrome extensions, assembles a detailed fingerprint of their hardware, encrypts it, and transmits the result to LinkedIn\u2019s servers, where it is attached to every subsequent action taken during the session.<\/p>\n<p>The investigation, independently <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/linkedin-secretly-scans-for-6-000-plus-chrome-extensions-collects-data\/\" target=\"_blank\" rel=\"nofollow noopener\">confirmed by BleepingComputer<\/a>, which verified the scanning behaviour through its own testing, has been dubbed \u201cBrowserGate.\u201d LinkedIn disputes many of the report\u2019s characterisations. The technical facts are not in dispute.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_the_script_does\"><\/span>What the script does<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>LinkedIn calls its scanning system \u201cSpectroscopy.\u201d When a user loads the LinkedIn website, the script fires off up to 6,222 simultaneous requests, each one probing for a specific browser extension by attempting to access files associated with that extension\u2019s ID. The presence or absence of a file in the response indicates whether the extension is installed. The entire operation runs silently in the background, without a visible prompt or notification of any kind.<\/p>\n<div class=\"inarticle-wrapper latest channel-cta hs-embed-tnw\">\n<div id=\"hs-embed-tnw\" class=\"channel-cta-wrapper\">\n<div class=\"channel-cta-img\"><img decoding=\"async\" class=\"js-lazy\" src=\"https:\/\/s3.eu-west-1.amazonaws.com\/tnw.events\/hardfork-2018\/uploads\/visuals\/tnw-newsletter.png\"\/><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/s3.eu-west-1.amazonaws.com\/tnw.events\/hardfork-2018\/uploads\/visuals\/tnw-newsletter.png\"\/><\/p>\n<div class=\"channel-cta-input\">\n<p class=\"channel-cta-title\">The \ud83d\udc9c of EU tech<\/p>\n<p class=\"channel-cta-tagline\">The latest rumblings from the EU tech scene, a story from our wise ol&#8217; founder Boris, and some questionable AI art. It&#8217;s free, every week, in your inbox. Sign up now!<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p>Beyond extensions, the script collects 48 distinct characteristics of the user\u2019s device: CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio hardware information, and storage capacity, among others. Individually, these attributes are unremarkable. Combined, they form a device fingerprint specific enough to identify a user even after cookies are cleared.<\/p>\n<p>Once compiled, the data is serialised to JSON and encrypted using an RSA public key, LinkedIn\u2019s internal identifier for the key is \u201capfcDfPK\u201d, \u00a0before being transmitted to telemetry endpoints including li\/track and \/platform-telemetry\/li\/apfcDf. The fingerprint is then permanently injected as an HTTP header into every API request made during the session, meaning LinkedIn receives it with every search, every profile view, every message sent.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_it_is_looking_for\"><\/span>What it is looking for<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The question of which extensions LinkedIn is scanning for makes the surveillance more sensitive than simple fraud detection would require. According to the BrowserGate report, LinkedIn\u2019s list includes more than 200 products that compete directly with its own sales tools, among them Apollo, Lusha, and ZoomInfo. Because LinkedIn knows the employer of each registered user, systematically scanning for the presence of a competitor\u2019s tool gives the platform visibility into which companies are evaluating or deploying rival products.<\/p>\n<p>The list also reportedly includes tools associated with neurodivergent conditions, religious practice, political interests, and job-hunting activity, categories that, in the European Union, qualify as sensitive personal data subject to heightened protection under the <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/general\/\" data-internallinksmanager029f6b8e52c=\"3\" title=\"General\" target=\"_blank\" rel=\"noopener\">General<\/a> Data Protection Regulation. Knowing that a user is running a job-search extension, for instance, is a meaningful inference about their employment intentions, drawn without consent.<\/p>\n<p>The scale of the operation has grown substantially over time. LinkedIn began scanning for 38 specific extensions in 2017. By 2024, that number had grown to 461. By February 2026, the list had reached 6,167, a 1,252% increase in two years. BleepingComputer\u2019s testing confirmed the scanning was active as of early April 2026.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"LinkedIns_defence_and_the_source_of_the_report\"><\/span>LinkedIn\u2019s defence and the source of the report<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>LinkedIn\u2019s response to BleepingComputer was pointed. \u201c<em>The claims made on the website linked here are plain wrong<\/em>,\u201d a spokesperson said. \u201c<em>The person behind them is subject to an account restriction for scraping and other violations of LinkedIn\u2019s Terms of Service. To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members\u2019 consent or otherwise violate LinkedIn\u2019s Terms of Service<\/em>.\u201d The company added that it does not use the data to \u201c<em>infer sensitive information about members.<\/em>\u201d<\/p>\n<p>The platform\u2019s characterisation of the source matters. Fairlinked e.V. is connected to Teamfluence Signal Systems O\u00dc, an Estonian company whose managing directors include Steven Morell and Jan Liebling. Teamfluence makes a Chrome extension, also called Teamfluence, that LinkedIn restricted for alleged terms of service violations. The company subsequently filed a preliminary injunction against LinkedIn Ireland Unlimited Company and LinkedIn Germany GmbH at the Regional Court of Munich, alleging violations of the Digital Markets Act, EU competition law, and German data protection rules. In January 2026, the Munich court denied the injunction, finding that LinkedIn\u2019s actions did not constitute unlawful obstruction or discrimination.<\/p>\n<p>The financial dispute between the parties does not change the technical findings, which were verified independently. It does mean the framing of those findings is contested, and readers should weigh both the substance of the claim and its provenance.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_regulatory_backdrop\"><\/span>The regulatory backdrop<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This is not LinkedIn\u2019s first serious encounter with European data protection enforcement. In October 2024, the Irish Data Protection Commission, which regulates LinkedIn in the EU through its Irish subsidiary, fined the company \u20ac310 million, approximately $334 million , for processing users\u2019 personal data for targeted advertising without a valid legal basis. The decision found that LinkedIn\u2019s consent mechanisms did not meet GDPR\u2019s requirement that consent be \u201c<em>freely given<\/em>.\u201d LinkedIn was ordered to bring its data processing into compliance.<\/p>\n<p>The BrowserGate investigation drops into that context. The legal question of whether scanning for 6,000 browser extensions constitutes processing of special-category personal data, and whether users\u2019 lack of awareness of the practice renders any implied consent invalid, \u00a0is exactly the kind of question the Irish Data Protection Commission has already shown it is willing to adjoin in court.<span>\u00a0<\/span>Europe\u2019s evolving digital regulation framework<span>\u00a0<\/span>has been moving steadily toward requiring explicit disclosure of all significant data collection, and a scanning operation of this scale, conducted without any mention in a privacy policy, appears difficult to square with that direction of <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/trip-and-travel\/\" data-internallinksmanager029f6b8e52c=\"10\" title=\"Trip &amp; Travel\" target=\"_blank\" rel=\"noopener\">travel<\/a>.<\/p>\n<p>LinkedIn is a Microsoft subsidiary, acquired in 2016 for $26.2 billion.<span>\u00a0<\/span>Microsoft has been aggressively expanding its AI capabilities in 2026, with LinkedIn\u2019s vast dataset of professional identity and employment history forming a significant part of the data infrastructure on which those capabilities rest. The relationship between LinkedIn\u2019s data collection practices and Microsoft\u2019s broader AI ambitions is not addressed in LinkedIn\u2019s privacy policy either.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_this_means_for_users\"><\/span>What this means for users<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>LinkedIn has more than one billion registered users. The majority access the platform through Chrome-based browsers, meaning the Spectroscopy scan runs routinely on the devices of a significant fraction of the global professional workforce, collecting a fingerprint that is precise enough to persist across cookie resets and potentially across devices.<\/p>\n<p>Short of using a non-Chromium browser such as Firefox, which would limit but not necessarily eliminate LinkedIn\u2019s fingerprinting capabilities, there is no user-facing setting that prevents the scanning. The platform does not offer an opt-out, because it does not disclose the practice in the first place.<span>\u00a0<\/span>The 2026 push for governed and transparent AI and data practices<span>\u00a0<\/span>is built on precisely the premise that invisible data collection of this kind should not be the default.<\/p>\n<p>Whether regulators move quickly enough to change that default at LinkedIn\u2019s scale remains to be seen.<span>\u00a0<\/span>Security firms increasingly built to detect exactly this kind of covert data harvesting<span>\u00a0<\/span>are becoming a growth sector in their own right, a market indicator that the gap between what platforms collect and what users understand is still very wide.<span>\u00a0<\/span>The year 2025 normalised AI-powered data collection<span>\u00a0<\/span>at a pace that regulation has yet to match. BrowserGate is a case study in what that lag looks like from the inside of a browser.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/linkedin-browsergate-extension-scanning-privacy-fingerprint\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In short:\u00a0Every time you visit LinkedIn in a Chrome-based browser, a hidden JavaScript routine silently probes your browser for more than 6,000 installed extensions, collects 48 hardware and software characteristics about your device, encrypts the resulting fingerprint, and attaches it to every API request you make during your session. The practice, labelled \u201cBrowserGate\u201d by researchers,&#8230;<\/p>\n","protected":false},"author":1,"featured_media":719919,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/cdn0.tnwcdn.com\/wp-content\/blogs.dir\/1\/files\/2026\/04\/linkedin-browsergate-extension-scanning-privacy-fingerprint.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-719918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/719918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=719918"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/719918\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/719919"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=719918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=719918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=719918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}