LinkedIn is silently scanning your employees' browsers. Every extension, every device detail, tied to their real name and job title. None of it is disclosed in their privacy policy.
We ran a Secureless scan on linkedin.com last week. It flagged a critical finding: a third-party service called PerimeterX dropping a persistent tracking cookie with a one-year expiry. Before the consent banner loads. Before anyone clicks anything.
Then BrowserGate broke. And that finding got a lot heavier.
BrowserGate
Fairlinked e.V., a European association of commercial LinkedIn users, published an investigation into what LinkedIn runs inside every authenticated session. The findings were independently confirmed by BleepingComputer. LinkedIn has not denied the scanning.
LinkedIn injects a 2.7MB JavaScript bundle (internally called "Spectroscopy") on every page load. The script silently probes the browser for 6,236 Chrome extensions and collects 48 device attributes: CPU cores, screen resolution, battery status, memory, installed fonts.
It encrypts everything with RSA and attaches the fingerprint to every API request during the session. Every search, every message, every profile view.
In 2024, LinkedIn scanned for roughly 461 extensions. By February 2026, that number had grown to 6,167. It tripled in under a year.
The alleged destination for that data: PerimeterX, now called HUMAN Security. The same service our scan flagged for pre-consent cookie placement.
The extension list
This is where it stops being a technical curiosity and starts being a workforce risk. The scanned extensions include:
- 500+ job search tools, resume builders, and salary comparison extensions
- Prayer time reminders for Islamic and Jewish observance
- ADHD focus aids and dyslexia reading tools
- Political content filters and news blockers
- 200+ competitive intelligence tools like Apollo, Lusha, and ZoomInfo
Because LinkedIn accounts are tied to real names, real employers, and real job titles, this is not anonymous telemetry. It is behavioural profiling attached to professional identities.
Religion. Neurodivergence. Political orientation. Job search intent. All inferable from the extension list. All arguably special-category personal data under GDPR Article 9.
The workforce risk
Most companies tell employees to use LinkedIn. For recruiting, employer branding, sales outreach. Some require it.
That means you are directing your workforce to a platform that fingerprints their browsers without disclosure. If someone on your team installs a job search extension, LinkedIn could know before their manager does.
LinkedIn already received a EUR 310 million GDPR fine in 2024. Scanning for 6,000 extensions, many of which reveal religion, health conditions, or political views, without explicit consent, is exactly the kind of question European regulators have shown they will pursue.
The thread we pulled
Our scan flagged PerimeterX setting a persistent cookie before any user interaction, before the consent banner renders. That alone is a GDPR compliance question worth raising in a security review.
Combined with BrowserGate, that cookie becomes the visible edge of a much larger data collection operation. The infrastructure that drops tracking cookies pre-consent is the same infrastructure allegedly receiving browser fingerprints from a billion users without disclosure.
One finding. One thread. A completely different risk conversation.
What to do now
If LinkedIn is in your vendor stack (and if you recruit, it is):
- Raise it in your next security review. The BrowserGate allegations are public, independently confirmed, and not denied by LinkedIn. Ask LinkedIn directly how extension scanning data is processed and retained.
- Review your browser extension policy. If employees use LinkedIn on managed devices, their extension data is being collected. Your endpoint management should account for this.
- Talk to your DPO. If you operate in the EU and encourage LinkedIn use as part of job duties, the co-controller question is worth asking. This is not legal guidance, but it is a conversation your legal team should be having.
- Scan the rest of your stack. If LinkedIn raises these questions, what does every other vendor look like?