LinkedIn prospecting and GDPR: the 2026 rules

This is an editorial walkthrough, not legal advice, and it rests on three sources: the text of the GDPR as published by the Swedish authority IMY, LinkedIn's user agreement in the version in force since 3 November 2025, and the EDPB's draft guidelines on web scraping, version 1.0 from July 2026, which were open for consultation until 30 October 2026; the final version may differ, so check the EDPB's page. We have covered the general balancing of interests for B2B prospecting separately; this piece is about what is specific to LinkedIn.

Rule 1: reading is free, saving is processing

IMY defines personal data as any information that can be linked, directly or indirectly, to a living person. Name, title, employer and profile photo on LinkedIn are personal data, whether or not the person has made them public. Reading a profile before a call is one thing. Typing the name, the title and a note into your CRM is processing you are responsible for, with a purpose, a legal basis and a retention period. The fact that the data is public does not change that; it only affects the balancing of interests, where the person's reasonable expectations count. A sales director who lists their role on LinkedIn can reasonably expect to be contacted about things that concern that role. The same person does not expect to end up on a list that gets sold on.

Rule 2: do not scrape, and do not buy what was scraped

LinkedIn's user agreement expressly prohibits developing, supporting or using software, scripts, robots or any other means, browser plugins included, to scrape or copy the service, profiles and other data included, and it prohibits bypassing access controls or usage limits such as search caps. That makes scraping a breach of contract before it is even a data protection question. The American case hiQ Labs v. LinkedIn ended in December 2022 with a consent judgment under which hiQ was ordered to pay 500,000 dollars and was permanently barred from scraping LinkedIn using methods that violate the user agreement. That case turned on US computer fraud law, not the GDPR, but the lesson is the same: the scraper lost.

The EDPB's draft guidelines on web scraping, adopted for consultation in July 2026 with IMY as lead rapporteur, deal with scraping to train generative AI, not prospecting. Two things in the draft are still instructive by analogy, with the caveat that the final text may change. The guidelines apply both to organisations that do their own scraping and to organisations that obtain pre-collected data from another company; whoever buys a ready-made list takes on the responsibility. And sensitive data may be scraped only if the controller takes measures before, during and after the scraping. Anyone buying a 'LinkedIn list' from a vendor should therefore ask how the list was built, and expect the answer to be that it was scraped.

Rule 3: inform within a month, or at the first contact

When personal data has not been collected from the person themselves, Article 14 of the GDPR applies. The information must be given within one month at the latest, or at the first communication if the data will be used to contact the person; what it has to contain is covered in our article on legal basis. The LinkedIn-specific point is what the deadline means in practice: a contact who has sat in the CRM for six weeks without being contacted is already past it. So enter the contact when you are about to call, not when you find the profile.

Rule 4: a sole trader is a person

Many Swedish prospects on LinkedIn run sole proprietorships: consultants, tradespeople, accountants, photographers. According to the government business portal verksamt.se there is no clear boundary between the owner and the business, and the owner is personally liable for its debts without limit. That means the firm's name, phone number and address are fully personal data about a living person, not company data, and the GDPR applies to them exactly as it does to any private individual. We covered what the marketing rules say about calling and emailing sole traders in the article on cold email and the law; in short, sole traders are the segment where B2B routines most often go wrong.

Rule 5: a no lasts forever

The right to object to direct marketing under Article 21 is absolute, as we also describe in the article on legal basis. IMY's decision against H&M in October 2023 shows what happens when the routine is missing: the company received an administrative fine of 350,000 kronor for failing to stop, without undue delay, processing complainants' data for direct marketing after they had objected, and for systems that did not make objecting easy enough. For a sales team that means a suppression list that every mailing and call list is washed against, and a flag in the CRM that cannot be removed by accident. Deleting the contact is the wrong fix: six months later nobody remembers the person said no.

Sales Navigator in practice

Sales Navigator is built for searching, saving and following inside the platform, and the route into a CRM runs through the integrations LinkedIn itself offers. Third-party tools that promise to export your lists to a spreadsheet do it through exactly the scraping the user agreement prohibits. The sustainable way of working is duller but cheaper in the long run: work inside Sales Navigator, move contacts into the CRM one at a time when you are actually about to contact them, give the required information in the first message, and delete whatever has led nowhere after a set period.

Checklist for the team

• No scraping and no scraped lists; ask every list vendor how the list was built.
• Contacts go into the CRM when they are about to be contacted, and the first message says who you are, why you are writing and where the data came from.
• Sole traders are treated as private individuals for both data protection and marketing purposes.
• A suppression list for objections that every list is washed against before a mailing or a call block.
• A deletion rule for LinkedIn contacts that never led to a conversation.

The call after LinkedIn

What makes LinkedIn valuable is not the list but the context: you know what the person does and what they wrote recently. That context belongs in the first thirty seconds of the call, and using it well takes practice. In Salesprep you can build an AI counterpart from a description of the role and the industry, with no personal data involved, and practise exactly that call in the Cold call module; it is included in every plan with three free calls. The Follow-up module, available on Pro and up, takes over once the person has replied.