LinkedIn violated data protection by using 18M email addresses of non-members
techcrunch.com
techcrunch.com
I was sharing my wifi for a brief period with my neighbors on the second floor. My neighbor had a new room mate. The guy was from another country. He didn't work in the same industry I do. I didn't have any of his contact information anywhere on any of my devices, and afaik, vice versa. We had no formal contact in any fashion, monetary or electronic communication or any other kind of contact other than passing each other in the hall. I didn't even know his name. He's just one of millions of people who live in my region.
Yet they suggested him as a possible contact.
If they weren't using IP address, they were using black magic.
edit: to clarify, i forgot to mention that i had no linkedin connection to my neighbor, afaik he didn't have a linkedin account, he definitely doesn't have one currently. He was sort of a luddite, barely used his computer, and i don't believe we ever emailed each other, or even had each other's email, I just searched my mail and have record of any.
And I very much doubt my neighbor had any obviously traceable connection with the roomate anyway, at most a phone number and received rent through cash or check.
Well, one such source of email addresses was me.
When I joined it more than 10 years ago, I was not as privacy aware as I am today. So, upon joining, I uploaded my address book to connect to people who already had a LinkedIn account.
I shortly after realized that they abused it. They sent an invite email to every person that was not on their platform.
I only got to know about it becasue one of my university professors sent me an email saying that she was not interested in joining yet another network. I had to apologize, because I did not expect that to happen.
To this day, LinkedIn still uses that information to suggest new connections to me and to prompt me to invite people that are still not on their platform.
In retrospect, it was a stupid move to upload my address book, but I'm sure I am not the only one that made that mistake, and probably many people still do nowadays.
After a couple of months, our "leader" grabs me and his lieutenant for a special project. We had done a few of those before, I was up for it. We all went for a ride in one of the company vans. Which have only two seats. My job? Make sure the empty rack in the back of the van didn't fall over.
Dude didn't bother to slow down for a number of speedbumps. He let me go that same Friday.
In retrospect, it is always a stupid idea to extend too much trust, when any trust has not first been earned.
A quick google suggests linkedin was sued and reached a class action settlement in exchange for the practice.
Silicon Valley has a phrase for such flagrantly unethical practice, it is called "growth hacking".
"It was my job to apply The Formula™. [...] Take the number of vehicles in the field, A. Multiply it by the probable rate of failure, B. Then multiply it by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."
They use any means necessary to get your contact list and abuse it to spam your contacts with dubious marketing ploys and unverifiable claims (someone looked you up! you're missing on new jobs opportunities!).
Liars.
I've resisted creating an account so far but the pressure to conform is there as you basically "don't exist" without a profile that lazy HR managers can look up.
I find this is an effective filter for those trying to avoid working for a red-tape-filled, default big corp. The more bureaucracy visible before getting there, the better. For those that explain it away as a bad HR does not make the company bad, if you're good enough to be picky there are good companies that also have good HR.
The recruitment process was mostly flawless, very friendly and professional. I never felt so welcomed and on the same level as there. That actually made the tipping point for me going from only startup/midsize companies during studies to big corp. In terms of quality it was way above and beyond of the random headhunter companies offers (I get a few per week, 99% crap).
On the other hand that big corp is not publicly listed, so that might heavily influence their culture.
It takes time to go through all user stories in such a big application. Imagine rewriting all unit tests.
When you take over a big operation, you usually don't want to rock the boat more than you are already doing.
I have no idea, but the cynic in me says "because Facebook forms a bigger threat to media organizations".
People put personal stuff on Facebook, and are more guarded about what they put professionally on LinkedIn. People approach LinkedIn as more of more of a two way selling relationship. They have a better feeling they know what they're in for.
The world knows who Zuck is.
Nobody knows who Weiner is, except in tech.
Even if there were some coverage, it might not get widely picked up, editorial rooms would just think it too narrow.
Also - there needs to be an 'obvious scandal' with legs - like the the Cambridge Scandal literally had that pink-haired guy with many photo ops making a name for himself, it gives a 'face' to the issue.
Maybe this one breaks though, it could get picked up.
- Fewer users => smaller impact
- Fewer ads => smaller abuse potential
- Users spend less time on LinkedIn
- Users share less personal information
- LinkedIn has other revenue sources than ads, making them less risk-taking in the ads business
- More savvy users
- People don't feel as sorry for professionals as they do for other people
- Fewer/less impactful breaches
- More likeable founders
Is there a way to request they remove this data? I sure don’t know how.
There you will find an an option to "remove all."
Not from no-reply@linkedin... But from your email.
If that person had a persistent inbox like gmail, and ever been in email contact with the both of you, it probably inferred a connection that way. Or maybe it saw an incoming email where both of you were in the recipient or CC list.
It’s really creepy what they do, and it enables them to learn all kinds of information about somebody. That person doesn’t even need to have ever visited LinkedIn; it can be provided entirely by other people.
LinkedIn should be burned to the ground, frankly.
What's the difference?
That said, all calls I've had were from actual, honest recruiters who offered me actual jobs that exist and may fit my profile. I'm assuming that asking for phone numbers is how they filter candidates who are not really interested and make them waste their time.
Hopefully if enough people do this it will make it clear in their analytics that nobody wants their shitty knockoff browser.
The worst is that it’s using deprecated APIs on iOS that make it several times slower than Safari.
I first made a LinkedIn account a few years ago because I got an email that my sister wanted to connect on LinkedIn. I’m not into social networks at all, but in the interest of family bonds I clicked the link to make an account and “connect” with her.
So I made the account, and the link in the email must’ve been set up to automatically connect our accounts. But a few days later she emails me that she got my LinkedIn request via email, but she hadn’t yet made an account, and as soon as she made one she’d add me. So this was a tricky spamming strategy in which no one started out with an account, but neither party was aware of that.
TL;DR LinkedIn knew my sister’s email address, my email address, and our connection, and basically tricked both of us into thinking that the other person was already on LinkedIn and wanted to connect. That’s a step beyond what people are talking about here, and is IMO seriously sketchy, unprofessional, and messed up. I don’t think they kept up this practice for very long, but it’s so over the top and beyond the pale that I’m surprised it didn’t result in lawsuits and the entire company being tarnished for decades. Obviously they’ve tarnished their name in plenty of other ways, but the fact that no one talks about this particular practice makes me wonder what other awful stuff they do that most people don’t know about.
I do see an issue with part of this complaint: storing hashed emails and uploading those to use for targeted advertisements. The general consensus seems to be that even under the draconian rues of the GDPR, a hash of an email is not personally identifiable and therefore that data would not be subject to the GDPR. It appears that the DPC overstepped their bounds on that specific aspect of the investigation.
That means that your family can see ads targeted at your bad habits that they might not otherwise be aware of.
I have very specific interests on YouTube (old cars, etc) that wouldn’t normally appear in the clickbait bucket aka homepage.
When I opened YouTube on my friend’s computer connected to my WiFi (absolutely no way she’d get my YouTube cookies, and if anything she should have her own cookies) the front page had some of the stuff that I watch instead of the usual clickbait.
Now I don’t watch anything that could be compromising but I can see this being an issue if someone is watching “sensitive” subjects and anyone can find out by just requesting the homepage from their IP.
I now have the habit to register a new email address every few months on Linkedin, to track the issue. It's clear and easy to prove that the new email address is used by spammers after a short time. One of the main reasons is probably because once you are connected to someone, he/she can access your profile contact details including email and phone number. My guess is there are bots scraping the contacts to populate their spam databases.
I'm sure most, if not all users of Linkedin don't realize this issue, as they generally register using a non-dedicated email address, preventing them to check the origin of the spam leak.
I'd expect this is the case; I have a LinkedIn account with a dedicated email for name reservations purposes, but do not accept any connections, and have yet to receive any spam.
I only get a handful of legitimate recruiter messages a month but nothing else.
And no, you did not match me to my second cousin "based on my profile." Unless you mean "based on your email address, which is already included in the massive social graph of all address book connections we've harvested from people who know you."
If you have to mislead your users about how you're finding potential connections, maybe you shouldn't be doing that thing in the background, or maybe you shouldn't be so focused on aggressively pushing those connections.
Litigation could be a possible avenue. Cut off the serpant's head and all that.
I'm getting these without having a LinkedIn account, where X is someone I had emailed with earlier.
You just need to make sure your privacy settings are bulletproof and don’t give out more information than they need to.
You can also not install their app and use their website in a browser with an ad blocker and in private browsing mode.
And what about members? It's utterly horrifying that a professional has to sell themselves on glorified social media and all its nefarious practices just to give themselves a change on the job market.
Presumably, they agreed to this.
> It's utterly horrifying that a professional has to sell themselves on glorified social media and all its nefarious practices just to give themselves a change on the job market.
I would say that's a gravely mistaken belief.
> I would say that's a gravely mistaken belief.
Plenty of companies appear to use third-party recruitment services, which entails you giving your personal, identifiable information to a third-party instead of going directly to said company. LinkedIn being one of such third-parties, indirectly or otherwise. The observation that trends like LinkedIn are a imposed reality is in no way a mistake.
Missing out on what? What good opportunity comes through LinkedIn? By my account, nobody actually likes LinkedIn and nobody takes it serious. Nobody will hold not using it against you.
> Plenty of companies appear to use third-party recruitment services, which entails you giving your personal, identifiable information to a third-party instead of going directly to said company. LinkedIn being one of such third-parties, indirectly or otherwise. The observation that trends like LinkedIn are a imposed reality is in no way a mistake.
That's not what I replied to. You said "It's utterly horrifying that a professional has to sell themselves on glorified social media". You don't have to do that. Believing that is a mistake and only helps LinkedIn achieve more dominance.
This is directly out of the marketing playbook of most social media sites. If you really believe this, then they got you! They spend a fortune trying to convince people they can’t have a social life or find a job without their services, and people are starting to believe it!
Please rest assured: you can get a job without LinkedIn and you can keep up with friends, family, and events without Facebook. We did it long before these services ever existed.