LinkedIn profile visitor lists belong to the people, says Noyb

Original Article ↗ Hacker News Discussion ↗

Privacy advocates are challenging LinkedIn’s practice of paywalling the list of people who view a user’s profile, arguing that under the EU’s GDPR this information is personal data that must be provided for free via data access requests. Commenters debate whether profile visit logs “belong” to the visitor, the profile owner, or both, and point out the inconsistency of LinkedIn claiming privacy concerns while simultaneously selling this data to premium subscribers. The outcome could affect not just LinkedIn but other platforms that monetize visibility into user interactions, such as dating apps and social networks.

Scope of “personal data” and ownership

  • Major debate over whether profile visit logs “belong” to:
    • The visitor (their browsing history),
    • The profile owner (a list of who interacted with their data),
    • Or both simultaneously.
  • Several comments cite GDPR’s broad definition: any info relating to an identifiable person, noting that one data item can pertain to multiple people (e.g., messages, audit logs).
  • Some argue data “pertains” to you from the moment the interaction occurs, not only after you pay for access.

Noyb’s argument and the LinkedIn “logic trap”

  • Core claim: LinkedIn can’t both:
    • Sell visitor lists as a Premium feature, and
    • Refuse them under GDPR Article 15 by invoking privacy protection.
  • Either visitor lists are too sensitive to share at all, or they are shareable and thus must be provided on request, not paywalled.
  • One suggestion: LinkedIn could give static exports for free (to satisfy Article 15) and still charge for real-time, UX-rich features.

Analogies: CCTV, websites, analytics, and blogs

  • Multiple comparisons:
    • CCTV footage in the EU: some report successfully requesting clips of themselves; others note blurring of third parties.
    • Website analytics: questions raised whether site owners could demand user identities from tools like Google Analytics; consensus leans “no,” because sites aren’t persons and identities often aren’t part of the data.
    • Audit logs case law is cited as analogous: logs can be personal data for both actor and target.

Privacy vs. monetization and broader platforms

  • Critics emphasize the hypocrisy of citing privacy to deny free access while monetizing the same data.
  • Some worry making all viewing highly visible will push users to private or fake accounts.
  • Discussion extends to dating apps and other social networks, where visitor/liker lists are also monetized; potential spillover effects of a LinkedIn ruling are noted but details remain unclear.

Cultural and regulatory tensions

  • Strong back-and-forth on EU-style regulation:
    • Supporters frame it as protecting rights and countering exploitative platforms.
    • Detractors see excessive bureaucracy and burdens on businesses.