On August 14, 2017, the U.S. District Court for the Northern District of California issued a preliminary injunction that prohibits LinkedIn from implementing legal or technological restrictions on hiQ's access, copying, and use of public profiles on LinkedIn's website. In hiQ Labs, Inc. v LinkedIn Corporation,1hiQ asserted its affirmative rights to scrape public LinkedIn profile data. This is the latest in a long line of cases addressing the scraping of content from publicly accessible sources.2
hiQ offers two primary products to its enterprise customers: one provides predictive analytics that evaluate which of a company's employees are at greater risk of being recruited by other companies; the other summarizes employees' skillsets. Both products depend on aggregating and analyzing information available on LinkedIn users' public profiles, as well as changes to that information over time.
LinkedIn is a business- and employment-oriented social networking service with service offerings targeted to both individual end users and enterprise customers. In May 2017, LinkedIn sent a cease-and-desist letter to hiQ alleging that its access and use of LinkedIn public profile data violated LinkedIn's terms and, among other things, constituted unauthorized access of LinkedIn systems under the Computer Fraud and Abuse Act (CFAA) and violated Digital Millennium Copyright Act (DMCA) restrictions on the circumvention of technological mechanisms designed to protect copyrighted content. LinkedIn also instituted various blocking techniques designed to prevent hiQ's continued automated access and collection of LinkedIn profile data. In response, hiQ filed suit in the Northern District of California, alleging that LinkedIn's actions, among other things, violate free speech rights protected under the California Constitution and constitute unfair business practices under California's Unfair Competition Law (UCL),3and seeking declaratory relief and a preliminary injunction protecting its affirmative rights to continue scraping from LinkedIn. LinkedIn, in defending against hiQ's motion for preliminary injunction, asserted that hiQ's actions violate the CFAA and that hiQ's state-law claims were preempted by federal law.
In reviewing hiQ's motion for preliminary injunction, the court analyzed: (1) whether hiQ would be irreparably harmed by being denied access to LinkedIn's public profile data; (2) the balance of the harm to hiQ versus the harm to LinkedIn by issuing the injunction; and (3) the merits of hiQ's claims. The court noted that because hiQ is "wholly dependent on LinkedIn's public data," without access to it, hiQ would either go out of business or be required to incur significant costs in redesigning its business model and data-collection methodologies. In response, LinkedIn claimed that its users did not expect their data to be aggregated and reused by third parties and that they would be harmed by an inability to control the access and use of their data. The court found that these claims, while not without merit, did not outweigh the harm to hiQ, since those users had chosen to make the data public and because LinkedIn only showed limited instances of actual user complaints and had reserved the right to make internal use of that data.
In light of its finding that being blocked from accessing LinkedIn data would irreparably harm hiQ, and that the balance of harms favored hiQ, the court went on to assess the merits of the case and applied a standard of whether hiQ had presented "serious questions" going to the merits. The court first analyzed LinkedIn's threshold assertion that hiQ's claims were preempted by the CFAA, which provides civil and criminal penalties for any person who "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer."4Relying on CFAA rulings in the Nosall II5and Power Ventures6cases, the court found that hiQ had raised a significant question about whether accessing public profile data in violation of LinkedIn's terms and in circumvention of LinkedIn's blocking technologies could be considered to be "without authorization" for purposes of the CFAA, and as a result, whether hiQ's claims would be preempted.
The court went on to consider whether hiQ had raised serious questions regarding the merits of the claims on which it asserted an affirmative right to declaratory and injunctive relief. First, the court reviewed hiQ's assertion that the Internet is a public forum, where California's constitutional protections for free speech take precedence over private property owners' right to exclude visitors.7In a lengthy discussion, the court noted the "host of slippery slope problems" and potentially sweeping implications of such a finding, and in the absence of any direct authority, declined to conclude that hiQ had raised serious questions regarding its free speech claim.
The court then analyzed hiQ's claim that LinkedIn's limitation of access to its public profile data was made for anticompetitive purposes impermissible under the UCL. The court accepted, without discussion, hiQ's assertion of LinkedIn's dominance in the professional networking market. In that context, LinkedIn's public statements regarding the development of product features that appear to compete with hiQ's predictive analytics product were sufficient for the court to find significant questions about whether LinkedIn revoked hiQ's access in order to eliminate competition. The court went on to conclude that the public interest favored free access to otherwise publicly available information over LinkedIn's end users' privacy interests in that data. Notwithstanding rejecting hiQ's free speech arguments, the court concluded that in light of its evaluation of hiQ's UCL claims and the public interest, hiQ was entitled to a preliminary injunction.
The injunction protecting scraping conduct granted in hiQ v. LinkedIn is highly unusual and, while it is just one case, may signal the willingness of courts to consider the policy justifications for scraping in light of its prevalence in many Internet-based business models. However, it is important to recognize that the case was unique in its facts and in the issues presented (and those not presented). Additionally, the injunction itself is on appeal and the merits of the case have yet to be tried. As such, it is difficult to predict what, if any, impact the case may ultimately have on the use of automated processes to access, retrieve, and use third-party data.
For more information on web-scraping issues or any related matter, please contact any member of the technology transactions practice at Wilson Sonsini Goodrich & Rosati.
This Wilson Sonsini Alert was prepared by John McGaraghan.