Linked In beats "Browser Gate" lawsuits over scanning users' Chrome extensions - Ars Technica

Overview

Linked In beats “Browser Gate” lawsuits over scanning users’ Chrome extensionsvar abtest_2171376 = new ABTest(2171376, 'click');

Judge tosses lawsuits, says plaintiffs didn’t allege any real privacy violation.

Details

Linked In beat two lawsuits over its practice of scanning users’ browser extensions, with a judge granting the Microsoft subsidiary’s motion to dismiss the cases. The users who sued Linked In failed to adequately allege that they have standing to sue because neither asserted that they “had browser extensions installed that conveyed private information to Linked In,” ruled Judge Vince Chhabria in US District Court for the Northern District of California.

In his ruling on Tuesday, Chhabria gave the plaintiffs leave to amend their complaints but said he doubts they can make a plausible case. “Given Linked In’s further arguments that users voluntarily download browser extensions, which by their nature intentionally expose data to websites, it seems unlikely that the plaintiffs will ever be able to allege a privacy violation, much less prevail at the end of the day,” Chhabria wrote.

California residents Nicholas Farrell and Jeff Ganan separately filed class actions against Linked In in April, seeking to represent themselves and other Linked In users. Ganan’s attorney, J. R. Howell, said he is evaluating whether to bring the claims in a California state court, which has different requirements on standing, or to appeal the US district court ruling in the US Court of Appeals for the Ninth Circuit.

“The federal court determined that it lacked jurisdiction to hear the Linked In users’ claims,” Howell told Ars today. “The court did not adjudicate whether Linked In’s surveillance practices were lawful. The ruling is not a vindication of the mass surveillance program alleged in our complaint.”

The so-called “Browser Gate” report was issued by a German entity called Fairlinked, which describes itself as a trade association and advocacy group for commercial Linked In users. It appeared to be run by the same people behind Teamfluence, an Estonian software company that sued Linked In in Munich after its CEO was banned by Linked In.

Howell, Ganan’s lawyer, also serves as counsel for Fairlinked in the US. In a June court filing, Howell wrote that “my investigative work with Fairlinked e. V. and Browsergate occurred before my office filed the Ganan complaint.”

Linked In said in a motion to dismiss that it uses detection systems to identify the type of automated scraping and bot activity that Teamfluence was deploying. Linked In told the court:

Teamfluence, an Estonian platform, is one of those groups that traffics in scraping. It markets a Google Chrome browser plug-in designed to “[i]dentify 100% of your Linked In traffic.” Linked In caught it and banned its CEO from the platform, leading to a legal dispute in Germany. A German tribunal recently determined that “[t]he ‘Teamfluence’ software violates [Linked In’s User Agreement],” and that Linked In’s “suspending the Claimants’ user accounts is objectively justified overall and not arbitrary.”

Teamfluence, an Estonian platform, is one of those groups that traffics in scraping. It markets a Google Chrome browser plug-in designed to “[i]dentify 100% of your Linked In traffic.” Linked In caught it and banned its CEO from the platform, leading to a legal dispute in Germany. A German tribunal recently determined that “[t]he ‘Teamfluence’ software violates [Linked In’s User Agreement],” and that Linked In’s “suspending the Claimants’ user accounts is objectively justified overall and not arbitrary.”

After the German court order, the Teamfluence-linked group called Fairlinked emerged with the Browser Gate report, which attracted coverage on a number of tech news sites.

“No surprise: the founder of Teamfluence sits on Fairlinked’s board,” Linked In’s motion said. “Having been caught for scraping, and held to have violated Linked In’s terms, he has now embarked on an international retaliation campaign by manufacturing a fake privacy controversy. But it is Teamfluence that is scraping data without consent.” Teamfluence’s CEO and founder is named Steven Morell.

Chhabria’s ruling said that neither Farrell nor Ganan “alleges that they, specifically, had browser extensions installed that conveyed private information to Linked In. Ganan never alleges that he had any extensions installed at all. Farrell alleges that he ‘has long had several browser extensions installed,’ and that, in general, browser extensions ‘often reveal sensitive private information about its users,’ but he never alleges that one of his own browser extensions revealed such information.”

The judge said the “allegations are insufficient to confer standing because only ‘those plaintiffs who have been concretely harmed by a defendant’s statutory violation may sue that private defendant over that violation in federal court.’ Identifying categories of private information that hypothetically could be revealed by surveillance of browser extensions is not enough to allege standing ‘particularized to a plaintiff’s circumstances,’” as precedent requires.

Ganan argued in a filing that the harm is “the unpermitted probe, not its yield,” but Chhabria wrote that “a plaintiff must identify ’embarrassing, invasive, or otherwise private information collected by’ the defendant.”

Linked In’s motion to dismiss said it uses detection tools “to identify whether a visitor to the platform is operating a browser extension that could threaten the security and integrity of the platform,” and that “Linked In detects information that browser extensions openly provide to all websites in order to interact with them. The information is publicly available and in no way private. And Linked In’s right to detect this information is disclosed and agreed to by all its members. So is Linked In’s right to use security-focused vendors to detect and prevent potential abuse.”

Linked In said that some Chrome browser extensions extract job listings and related data from the company’s website, and that Linked In’s terms prohibit extensions that scrape or copy data from the site. Linked In’s “rich platform and robust community make Linked In a target for opportunistic software developers who seek to scrape its data for their own purposes,” the company said.

Howell told Ars today that the Ganan lawsuit “alleges that Linked In deployed code without users’ consent to surveil their internal computing environments, collect information, and route data to third parties.”

“The companies developing and deploying these technologies should not get to decide, on their own, the boundaries of our privacy,” Howell said. “As their ability to observe and profile people expands, meaningful consent and judicial scrutiny become more important. … We intend to pursue these claims in a forum that can adjudicate them on their merits.”

We also contacted Farrell’s lawyers about the judge’s ruling and will update this article if we get a response. Although Farrell’s lawyers don’t appear to have coordinated directly with Fairlinked, the claims in their lawsuit were based largely on the group’s Browser Gate report.

1.          Man told Chat GPT he was feeling delusional. Chat GPT insisted he was Jesus.
   

2.          Apple's long-rumored foldable becomes reality with the $2,000 i Phone Duo
   

3.          Europe may finally have found a space entrepreneur who is meeting the moment
   

4.          Apple's i Phone 18 Pro adds variable camera aperture and a more powerful chip
   

5.          Physicist does the math on Star Trek’s “Picard Maneuver”
   

Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don’t need to know everything, only what’s important.

Key Takeaways

• Linked In beats “Browser Gate” lawsuits over scanning users’ Chrome extensionsvar abtest_2171376 = new ABTest(2171376, 'click');

• Judge tosses lawsuits, says plaintiffs didn’t allege any real privacy violation

• Linked In beat two lawsuits over its practice of scanning users’ browser extensions, with a judge granting the Microsoft subsidiary’s motion to dismiss the cases

• In his ruling on Tuesday, Chhabria gave the plaintiffs leave to amend their complaints but said he doubts they can make a plausible case

• California residents Nicholas Farrell and Jeff Ganan separately filed class actions against Linked In in April, seeking to represent themselves and other Linked In users