Kaspr: restricted LinkedIn contact details were not permission for a separate prospecting database

CNIL found that Kaspr collected contact details whose visibility people had restricted to first- or second-degree LinkedIn connections. It found that this exceeded what those people could reasonably expect. CNIL announcement.

The decision also addressed repeated renewal of retention, delayed or insufficiently understandable information, and inadequate information about data sources when people exercised access rights. Authority notice on EDPB.

CNIL imposed EUR 240,000 and ordered changes to collection, deletion, retention, information and access handling. An older EDPB notice gives a conflicting amount; this record uses CNIL’s original announcement and counts the decision once. CNIL announcement.

These are implementation checks suggested by Inth, not additional findings about the company.

• Record the actual source, visibility restrictions and permitted purpose before importing contact information.
• Use retention rules that do not keep extending solely because a profile changes.
• Make access responses capable of explaining available source information rather than using a generic 'public sources' label.

Code audit can map reviewed data ingestion and onward-sharing routes.

Inth does not decide the legal basis for scraping, inspect every external source’s visibility rules or certify the lawfulness of a prospecting database.

• CNIL announcement
• Authority notice on EDPB

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.