LinkedIn hit with €310 million fine for privacy violations in the EU

In a significant setback for Microsoft-owned LinkedIn, the social network has been fined €310 million (approximately $356 million) by the Irish Data Protection Commission (DPC) for violating European privacy laws. The penalties come in response to LinkedIn’s practices surrounding tracking ads, where the company was found to have breached several core principles of the European Union’s General Data Protection Regulation (GDPR). These breaches included failing to uphold the lawfulness, fairness, and transparency required in processing personal data for targeted advertising.

The DPC’s investigation revealed that LinkedIn’s use of personal data for tracking ads was based on flawed legal justifications. LinkedIn claimed various legal bases, such as “consent,” “legitimate interests,” and “contractual necessity,” to process user data both directly and through third-party sources. However, the regulator determined that none of these bases were valid under GDPR. In addition, LinkedIn failed to clearly inform users about how their data was being used for behavioral advertising, further violating GDPR’s transparency and fairness principles. The ruling places LinkedIn among the top companies hit with the largest fines for GDPR breaches and serves as a reminder of the critical importance of data protection laws.

The investigation into LinkedIn began after a 2018 complaint from French digital rights organization La Quadrature Du Net. The case was later passed to the Irish DPC, which oversees GDPR compliance for Microsoft in the EU. Following a lengthy review process that spanned six years, the decision was finalized in July 2024 and has now been made public. In addition to the financial penalty, LinkedIn has been given a three-month deadline to ensure its European operations fully comply with GDPR requirements, marking one of the company’s most significant legal challenges in the region to date.