Key Takeaways
- Under GDPR, the LinkedIn Insight Tag needs explicit opt-in consent before it fires, the same ePrivacy/GDPR standard every advertising pixel has to clear, not a lighter one because the data is "professional" rather than consumer.
- The li_gc cookie only records LinkedIn's own internal consent choice for linkedin.com itself; it has no bearing on whether your site obtained valid consent from its own visitors.
- Embedding the Insight Tag makes you and LinkedIn joint controllers for the data it collects and sends, under the same CJEU precedent (Fashion ID, C-40/17) that established this for embedded social plugins generally.
- Unlike Meta or TikTok, LinkedIn has no publisher-facing "Limited Data Use" flag for CCPA/CPRA opt-outs. The only reliable fix for an opted-out visitor is blocking the tag entirely, not toggling a downstream restriction.
- Using Matched Audiences on data you didn't have valid consent to collect breaches LinkedIn's own Ads Agreement, which requires advertisers to warrant they obtained consent for any Audience Data used.
The LinkedIn Insight Tag needs a visitor's opt-in consent before it can fire under GDPR, and sending their data to LinkedIn for retargeting counts as a "sale" or "share" under CCPA whether the visitor works in your industry or not. Most sites treat this as a lighter compliance lift than Meta or TikTok pixels because the audience is professional, not consumer, but GDPR draws no such distinction. Below: what the tag actually collects, why the li_gc cookie isn't the consent signal some guides claim it is, and how to gate both the browser tag and LinkedIn's server-side Conversions API correctly.
Secure Privacy is a cookie and consent management platform that blocks tracking scripts, including ad pixels like LinkedIn's Insight Tag, until a visitor actually consents. It also generates the GDPR- and CCPA-compliant banners that make that consent decision legally valid in the first place.
Does LinkedIn Insight Tag Need Consent Under GDPR?
Yes. The Insight Tag is a non-essential advertising and analytics script, so it falls outside the "strictly necessary" exemption in the ePrivacy Directive, and the only valid legal basis for loading it is consent obtained under GDPR Article 6(1)(a) before it fires, not implied consent or legitimate interest.
LinkedIn's own default installation snippet doesn't wait for anything. It loads on page load like any other tag, which means an unmodified install fires for every visitor, consented or not, until someone deliberately wires a consent trigger into it. That's the same failure mode that trips up Meta Pixel and TikTok Pixel installs: the gap isn't a bad banner, it's a script that was never told the banner exists.
There's a common assumption worth correcting directly: professional, B2B-context data doesn't get a lighter compliance standard. GDPR applies to any personal data tied to an identifiable person, and a LinkedIn member's job title and company are personal data the same way a consumer's purchase history is. Treating a B2B audience as lower-risk is a real, avoidable gap, not a defensible reading of the law.
Regulators are watching LinkedIn's data practices closely right now. Ireland's Data Protection Commission fined LinkedIn EUR310 million in October 2024 for how it processes members' own behavioral data for ad targeting on LinkedIn itself, a first-party matter distinct from the Insight Tag your site installs, but a clear signal that LinkedIn's advertising data pipeline as a whole is under sustained regulatory scrutiny. Attorneys tracking pixel litigation describe demand-letter activity spreading across tools rather than settling on one: "we've seen lawsuits and demand letters...focusing on a wide variety, Google Analytics, TikTok, I mean, you name it," says Alysa Hutnik, Chair of the Privacy and Information Security practice at Kelley Drye & Warren LLP. An Insight Tag that fires without consent sits in exactly that exposure category.
What Data Does the Insight Tag Collect, and What Cookies Does It Set?
The Insight Tag collects the visitor's IP address, browser and device characteristics, page URL, referrer, and a timestamp for every page load, plus a first-party pseudonymous identifier called a LinkedIn Ads ID. If the visitor is logged into LinkedIn, that identifier can link their visit back to their LinkedIn profile.
LinkedIn does put a retention clock on the identifying part of this: data that directly identifies a member is removed within 7 days, and the remaining pseudonymized data is deleted within 180 days. That's a real limit, but it applies after collection, not instead of it, so it doesn't change whether consent was required before the tag fired in the first place.
Six cookies do most of the technical work, and their categories in LinkedIn's own cookie documentation are worth knowing exactly, since three of them are explicitly filed under advertising, not general analytics:
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
| li_fat_id | Member identifier for conversion tracking, retargeting, analytics | 30 days | Personalized Advertising |
| UserMatchHistory | Stores the last identity-sync time to avoid repeating the sync process | 30 days | Personalized Advertising |
| li_sugr | Probabilistic match of a user's identity | 90 days | Personalized Advertising |
| AnalyticsSyncHistory | Records when a sync took place with the analytics cookie | 30 days | Analytics and Research |
| bcookie | Browser identifier used to detect abuse across LinkedIn's platform | 1 year | (unclassified) |
| lidc | Selects which LinkedIn data center handles a request | 24 hours | (unclassified) |
Three of the six (li_fat_id, UserMatchHistory, li_sugr) are LinkedIn's own advertising cookies, meaning your cookie policy needs to list them by name under a marketing or advertising category, not bundle them into a generic "third-party cookies" line that a regulator would read as vague disclosure.
Does the li_gc Cookie Count as Consent?
No, and this is worth stating precisely because it's easy to misread. LinkedIn's own cookie table describes li_gc as storing "consent of guests regarding the use of cookies for non-essential purposes," expiring after 6 months, filed under Preferences/Features/Services, not Personalized Advertising.
That description is specifically about a visitor's cookie choice on linkedin.com itself, the site LinkedIn operates. It says nothing about, and carries no legal weight for, whether your site obtained valid consent from its own visitors before loading the Insight Tag. A site that sees li_gc present in a visitor's browser and assumes consent has already been handled is reading a cookie that answers a completely different question.
Are You and LinkedIn Joint Controllers?
Yes, for the collection and transmission of visitor data to LinkedIn specifically, though not for what LinkedIn does with that data afterward. The CJEU's 2019 Fashion ID ruling (C-40/17) established this for embedded social and advertising plugins generally: a website that embeds a third-party tracking tool is a joint controller with that third party for the step where data leaves the visitor's browser and reaches the third party's servers, even if the site owner never sees the data itself and has no Facebook, or in this case LinkedIn, account of their own.
That distinction matters for what your privacy policy actually needs to say. Joint controllership carries its own disclosure obligations under GDPR Article 26, separate from a standard "we share data with third-party vendors" line: visitors need to know both parties' roles and how to exercise their rights against either one, not just that a vendor exists somewhere in a cookie table.
How Do You Gate LinkedIn Insight Tag and Matched Audiences Under CCPA?
Sending visitor data to LinkedIn for retargeting or Matched Audiences counts as a "sale" or "share" of personal information under CPRA, since it's a disclosure to a third party for cross-context behavioral advertising, and California's guidance treats that as valuable consideration regardless of whether money changes hands. That means the same "Do Not Sell or Share" mechanism your CCPA opt-out flow already provides for other trackers has to actually stop the Insight Tag too, not just list LinkedIn as a recipient in a policy nobody reads.
Here's the part that genuinely differs from Meta and TikTok, and it's worth knowing before you assume the same fix applies: LinkedIn does not offer advertisers a Limited Data Use flag or an equivalent downstream restriction parameter. Meta and TikTok both let you keep their pixel loaded for opted-out visitors while restricting what the platform does with the data afterward. LinkedIn gives you no such middle option on the Insight Tag itself. For a California visitor who has opted out, the only compliant move is blocking the tag from loading at all, the same binary gate GDPR requires, not a lighter CCPA-specific setting.
LinkedIn does say it honors Global Privacy Control signals, but only for its own first-party opt-out on linkedin.com. That's a separate mechanism from your site's own obligation to detect a GPC signal and block the Insight Tag yourself; one doesn't substitute for the other.
Matched Audiences adds a second layer worth checking separately from the tag itself. LinkedIn's own Ads Agreement requires advertisers to warrant they've obtained "sufficiently prominent and clear notice to, and...valid consent" for any Audience Data uploaded or matched through the feature. Building a Matched Audiences list from a customer database that was never screened against actual opt-outs is a contractual breach independent of whatever the Insight Tag itself is doing.
Implementing Consent-Gated LinkedIn Tracking Without Losing Attribution Data
Dropping the Insight Tag entirely to sidestep this is a real option, but it also means losing LinkedIn campaign attribution outright, which is a heavier cost than gating it correctly. A consent management platform that blocks marketing-category scripts at the network level until consent is granted, rather than just hiding the visible banner, handles the browser-side half of this the moment the Insight Tag is classified correctly.
The server-side half needs separate attention. LinkedIn's Conversions API sends conversion events directly from your backend rather than through the visitor's browser, which is exactly the kind of call that keeps running even after a CMP has correctly blocked the client-side tag. That backend call needs its own consent check, not an assumption that blocking the browser script was enough. Secure Privacy's Universal Consent API lets a backend query a visitor's current consent decision by client ID before firing a server-side event, with every record carrying its own consent type and a timestamp, so the same check that gates the API call also produces the audit trail if a regulator or plaintiff's attorney ever asks for one.
If you're auditing an existing install, the check is the same one worth running on every ad-tech tool a site loads: open the site in an incognito window, watch the network tab before touching the cookie banner, and see whether any request to snap.licdn.com or linkedin.com fires before consent is given. If one does, the same pattern is worth checking across your other marketing tools, not just LinkedIn.
Quick Compliance Checklist
- Open your site in an incognito window and check the network tab for requests to LinkedIn's domains before clicking accept on the banner.
- Block the Insight Tag client-side through your consent management platform, filed under a marketing/advertising category, not a generic "analytics" bucket.
- Gate any server-side LinkedIn Conversions API call with the same consent signal that gates the browser tag.
- Treat opted-out CCPA visitors as a full block, not a restricted-use flag; LinkedIn doesn't offer the latter.
- Confirm any Matched Audiences list was built from data that actually had valid consent behind it before upload.
None of this requires giving up LinkedIn Ads attribution. Secure Privacy exists specifically to close this gap: it logs every visitor's consent choice with a timestamp, so that record, not a marketing team's memory of how the tag was configured, is what answers a regulator's question if one ever comes.
FAQ
Does LinkedIn Insight Tag fire before consent by default?
Yes. LinkedIn's default installation snippet loads on page load like any other tag, with no built-in consent gate. It fires for every visitor until a consent trigger is deliberately added at the tag-management or consent-platform level.
Does the li_gc cookie satisfy GDPR consent for my site?
No. li_gc stores a visitor's cookie consent choice for linkedin.com itself, not for the site that embedded the Insight Tag. Its presence in a browser says nothing about whether your own site obtained valid consent.
Are you and LinkedIn joint controllers when you use the Insight Tag?
Yes, for the collection and transmission of visitor data to LinkedIn, under the same CJEU precedent (Fashion ID, C-40/17) that applies to embedded social and advertising plugins generally. LinkedIn's own subsequent use of that data falls outside that joint-controller scope.
Does enabling a data-restriction setting satisfy CCPA compliance the way it does for Meta or TikTok?
No, because LinkedIn doesn't offer one. Unlike Meta's and TikTok's Limited Data Use flags, LinkedIn gives advertisers no downstream-restriction parameter for the Insight Tag. Compliance for an opted-out visitor means blocking the tag entirely, not toggling a setting.
Do I need to gate the LinkedIn Conversions API separately from the browser tag?
Yes. The Conversions API sends conversion data directly from your server, independent of whatever the browser-side Insight Tag is doing, so blocking the visible tag alone doesn't stop a backend integration from still transmitting data.
Does this apply if my visitors are B2B professionals, not consumers?
Yes. GDPR and CCPA apply based on whether the data identifies a person, not the professional or consumer context it was collected in. A LinkedIn member's job title and company are personal data under the same rules as any consumer's browsing history.
Sources
- LinkedIn Insight Tag FAQ, data collected and retention timelines
- LinkedIn's cookie table, cookie names, purposes, durations, and categories
- LinkedIn California Privacy Disclosure, CCPA/CPRA sale-and-share and GPC handling
- Fashion ID, CJEU Case C-40/17 (2019), joint-controllership ruling for embedded third-party plugins
- Irish Data Protection Commission fines LinkedIn EUR310 million, October 2024, first-party member-data processing
- Alysa Hutnik, Chair of the Privacy and Information Security practice at Kelley Drye & Warren LLP, quoted from a recorded interview on pixel litigation trends
