Chhabria dismisses the BrowserGate suits because neither plaintiff named an extension

An extension that rewrites your LinkedIn feed has to put a script into the page to do the rewriting. The page can then ask what is sitting there. LinkedIn did not deny that it scans browsers to identify extensions ^[13]. A commenter in Ars Technica's thread on the ruling gave the developer's version of the defense: "if you inject scripts in to my web page, my page should be allowed to see what those script are" ^[11].

Chhabria went past the jurisdictional question in one sentence. "Given LinkedIn's further arguments that users voluntarily download browser extensions, which by their nature intentionally expose data to websites, it seems unlikely that the plaintiffs will ever be able to allege a privacy violation, much less prevail at the end of the day," Chhabria wrote ^[3]. That sentence sits in an order that also grants leave to amend ^[2].

Ganan's attorney, J.R. Howell, reads the order narrowly. "The federal court determined that it lacked jurisdiction to hear the LinkedIn users' claims," Howell told Ars ^[8]. "The court did not adjudicate whether LinkedIn's surveillance practices were lawful. The ruling is not a vindication of the mass surveillance program alleged in our complaint," he said ^[9].

One pleading gap disposed of both cases ^[12]. The amendment Chhabria left open has a price for whoever files it: clearing the standing bar means naming, in a public filing, the extension you installed and the private information it conveyed to LinkedIn ^[4].

For a team shipping extension detection, the order separates two behaviors that usually arrive on the same ticket. Detecting that an extension is present is one. Receiving what the extension holds is the other. Two tests decide where a given script sits: whether a user could name an extension of theirs whose contents reached your servers, and whether your policy names add-ons in words a user could match to what your JavaScript does. LinkedIn's privacy policy already disclosed that it uses cookies and similar technologies to collect information about each user's "web browser and add-ons" ^[13].

The report that started the suits came from a party with its own quarrel with LinkedIn. The plaintiffs filed after a report alleged that "LinkedIn Is illegally searching your computer" ^[10]. That report came from Fairlinked, a German entity that describes itself as a trade association and advocacy group for commercial LinkedIn users and appeared to be run by the same people behind Teamfluence, the Estonian software company that sued LinkedIn in Munich after its CEO was banned ^[5]. According to a passage quoted in Ars Technica's discussion thread on the ruling, a German tribunal determined that "[t]he 'Teamfluence' software violates [LinkedIn's User Agreement]," and that LinkedIn's "suspending the Claimants' user accounts is objectively justified overall and not arbitrary" ^[14].