On this page
The actual legal question: contract, not crime
US law does have a statute that sounds relevant — the Computer Fraud and Abuse Act (CFAA), which criminalizes accessing a computer system "without authorization." LinkedIn once tried to use it against a company scraping public profile data. The attempt failed, and the failure is worth understanding before deciding how much risk a cheap automation tool is actually buying you.
In hiQ Labs v. LinkedIn, the 9th Circuit ruled twice — 2019, then again in 2022 after the Supreme Court sent the case back — that scraping data LinkedIn makes publicly visible doesn't violate the CFAA. The court's reasoning: "without authorization" means bypassing a login wall or access control, not ignoring a website's terms of service.
Here's the part that changes the calculation: hiQ won that argument and still lost the case. LinkedIn's separate breach-of-contract claim — that hiQ violated the User Agreement — held up. hiQ settled in November 2022 for a permanent injunction, forced deletion of everything built from the scraped data, and a $500,000 payment. The CFAA can't touch you for this. A contract claim can, and LinkedIn has already proven it will use one.
What you're actually agreeing to
LinkedIn's terms are unambiguous about this: third-party automation — sending connections, sending messages, scraping profiles — isn't permitted. Every tool priced and reviewed on this site operates outside those terms. What that costs you is contractual, not criminal: account restriction or termination, never legal exposure. Nobody has faced criminal charges for running a consumer LinkedIn automation tool.
What actually happens to a flagged account
LinkedIn doesn't publish exact thresholds, but the pattern its own help pages and user reports describe is graduated, not instant:
- A warning — an in-app or email notice about unusual activity. The right move here is to stop, not push through.
- A temporary invitation restriction, usually clearing somewhere between a few hours and about a week.
- A silent cut to daily limits — no notice, the account simply allows less than before.
- A verification lock, requiring identity or phone confirmation before access returns.
- Permanent suspension, generally after repeated warnings go unheeded.
LinkedIn states plainly that an active restriction can't be paid or messaged around, and most lift on their own within roughly a week.
What LinkedIn is thought to track
Detection logic isn't published, so this is the working model the automation industry designs around — informed inference, not confirmed fact:
- Speed: the same volume looks different spread across a day versus fired in a burst.
- Acceptance rate: a high share of ignored or declined invitations is a known trigger for LinkedIn's own limits.
- Repeated wording: identical opening messages sent widely are easy to fingerprint.
- Network signals: automation frameworks, datacenter IPs, and sudden location changes are plausible inputs.
None of it is LinkedIn-confirmed, so treat it as an estimate the industry works from, not a spec sheet.