GDPR Challenge Questions LinkedIn’s Control Over Profile Visitor Data
A legal dispute in the European Union is challenging LinkedIn’s handling of user data under the General Data Protection Regulation (GDPR). The case, supported by privacy advocacy group Noyb, argues that LinkedIn users should have the right to access a complete list of people who have viewed their profiles, free of charge, under Article 15 of the GDPR. This article grants individuals the right to obtain a copy of personal data that companies process about them.
Currently, LinkedIn offers more detailed profile visitor information as part of its Premium subscription service, while free users receive only limited insights. Noyb contends that this practice may violate GDPR principles, as companies should not be allowed to monetize access to personal data that users are legally entitled to receive. According to Noyb lawyer Martin Baumann, the law is clear that individuals have the right to their data regardless of whether providing it undermines a company’s business model.
The central legal question is whether profile visitor data qualifies as personal data concerning the user requesting it. Noyb argues that it does, and that LinkedIn cannot justify restricting access behind a paywall while simultaneously claiming privacy concerns. The only potential exception under GDPR would be if releasing such data negatively affected the rights and freedoms of other users—namely, those who viewed the profile. However, Noyb disputes this defense, pointing out that LinkedIn already provides similar information to paying users, which weakens any claim that disclosure would be harmful or unlawful.
LinkedIn has responded by stating that it complies with GDPR requirements and that some visitor information is already available to all users, not just Premium subscribers. The company also maintains that its Privacy Policy satisfies its legal obligations.
If successful, the case could set an important precedent across industries, clarifying whether companies can charge users for access to their own personal data. Similar disputes exist in other sectors, such as banking, where institutions may charge for records that could fall under GDPR access rights. The outcome could significantly impact how digital platforms structure their data access and monetization strategies in the future.