LinkedIn Wins Extension-Scanning Lawsuits, and

LinkedIn won the lawsuits over its scanning of users' Chrome extensions, according to Ars Technica's report on the ruling arstechnica.com. The cases, lumped together under the nickname BrowserGate, accused the company of probing visitors' browsers to detect which extensions they had installed, then using that information in ways users never agreed to. The court disagreed with the plaintiffs. Now everyone gets to find out what that means.

What the Case Was About

Here's the mechanics, because they matter more than the headline. Websites cannot directly read your extension list. They can infer it, though. Many extensions modify the pages you see: they inject elements, block scripts, rewrite links, add buttons to buttons. A site can serve content that behaves differently depending on whether an ad blocker, a price tracker, or a grammar checker is present, and then check the difference. Do this across enough probes and you build a profile of the user's local toolset without ever touching the local machine.

According to Ars Technica, LinkedIn ran exactly this kind of detection, and the plaintiffs argued it crossed a legal line into surveillance of their computing environment. The court's answer: the claims failed. The ruling does not bless every form of scanning, as Ars Technica's own framing points out, but it narrows the routes available to users challenging the practice under existing law.

I've watched enough privacy litigation to know what a win like this does. It doesn't declare the practice good. It declares the practice, as pleaded, not actionable. Those are different outcomes, and companies read them the same way every time: as a green light.

The Grey Zone, Mapped

Extension detection sits in an awkward spot, and both sides have a real argument.

The strongest version of LinkedIn's position: everything the browser reveals is on the visitor's side of the network connection. A server responding differently to different clients is how the web has worked since the 1990s. User-agent strings, screen resolution, font stacks, plugins, extensions: the browser has always been a chatty guest. If a site can adapt to a mobile screen, it can adapt to an ad blocker. Where, exactly, is the line the plaintiffs say was crossed?

The strongest version of the users' position: the comparison to screen size is a false friend. Knowing my viewport lets a site render a layout. Knowing I run Privacy Badger, a corporate DLP agent, and a scrapbooker extension paints a picture of who I am, what I block, and where I work. That inference happens invisibly, with no permission prompt and no disclosure, and the user has no way to inspect or contest it. The browser interface presents a page; underneath, the page is taking a census.

Both things are true at once, and the court ruled on the legal question rather than the philosophical one. That's what courts do. But the gap between "not illegal under this statute as framed" and "acceptable practice" is where the next several years will be fought.

Why This Ruling Echoes

The timing matters. Extension ecosystems have grown into load-bearing infrastructure: password managers, authenticators, ad blockers, accessibility tools, enterprise security agents. Developers build workflows assuming a browser is a private workspace. Fingerprinting extensions converts that assumption into a data source for anyone with a page and some JavaScript.

This is also a very old pattern wearing new clothes. Every telemetry fight of the last two decades followed the same script: a company does something possible and legally unaddressed, users sue under a statute written before the behavior existed, the court shrugs because the statute doesn't fit, and the industry treats the shrug as permission. Cookies, supercookies, canvas fingerprinting, device fingerprinting: each cycle ended in the courts issuing a narrow loss for plaintiffs and the practice continuing until regulators or platform owners stepped in. The courts are where privacy claims go to discover they were drafted for landline telephones.

So the realistic question is not whether extension scanning continues. It's who constrains it next.

The Code Answers Back

Meanwhile, the enforcement mechanism that actually works showed up the same week. A developer under the name Hogwai published forbidd-in, a small JavaScript library on GitHub that blocks the LinkedIn extension-fingerprinting technique by neutralizing the page behavior the probes rely on. It circulated on Hacker News, which is about as fast as a defensive tool travels in this ecosystem.

The pattern is familiar. When litigation fails to constrain a practice, someone ships twenty kilobytes of countermeasures within a news cycle. Ad-blocker lists have been fighting fingerprinting scripts for a decade. The cat-and-mouse dynamic is reliable precisely because it's cheap: the defense costs an afternoon, the offense costs a legal budget.

But user-side fixes have a ceiling. They protect the people who already know what extension fingerprinting is and install things to stop it. Everyone else keeps scrolling through a page that is inventorying their toolkit. Privacy won by individual countermeasure is privacy rationed by technical literacy.

Where the Real Pressure Point Is

The next venue, as the reporting suggests, is platform policy and browser design. Three changes would do more than a decade of follow-on lawsuits:

First, a clearer permission model. Chrome asks before an extension can read your history on every site. No page ever asks before it probes whether your extension will block its script. Making the asymmetry visible is half the fix.

Second, isolation. Browsers have been steadily shrinking the fingerprinting surface, from user-agent reduction to randomizing canvas noise. Extension presence is one of the last loud signals left. Firefox and Safari have pushed harder here than Chrome, which is ironic given that Chrome's extension ecosystem is the densest and therefore the most informative to fingerprint.

Third, disclosure. If a site detects tooling and changes behavior or logging accordingly, saying so should cost the site nothing. Right now it costs everything, which is why nobody does it.

None of this requires a statute. It requires the browser vendors to decide that the extension list is not fair game for remote enumeration. Given that Chrome's owner runs the largest ad business on the planet, that decision has a conflict-of-interest attached, and pretending otherwise would be selling something I don't have in stock.

What to Watch

The court has spoken on the law as written, and the law as written does not reach this. Watch two things instead. Watch whether Chrome's extension-manifest evolution and fingerprint-mitigation work close the detection channel faster than sites can open new ones. And watch whether regulators who treated cookie banners and dark patterns as actionable find extension fingerprinting equally legible.

In the meantime, if you'd rather LinkedIn didn't know which of your extensions are on duty, forbidd-in exists, and the browser you pick matters more than the lawsuit you lost. That has been true of every privacy fight since the first tracking cookie, and nobody has yet made me want to revise it.

Mike Sullivan, Technology Correspondent