[Enforcement library](/enforcement)

# Kaspr: restricted LinkedIn contact details were not permission for a separate prospecting database

CNIL fined Kaspr EUR 240,000 after examining collection of restricted contact details, retention, transparency and access rights.

## Key facts

- **Regulator or court:** CNIL
- **Jurisdiction:** France
- **Framework:** GDPR Articles 5(1)(e), 6, 12, 14 and 15
- **Record date:** 2024-12-05
- **Procedural status:** Administrative fine and compliance order; later appeal status not established

CNIL fined Kaspr EUR 240,000 after examining collection of restricted contact details, retention, transparency and access rights.

CNIL · GDPR Articles 5(1)(e), 6, 12, 14 and 15 · Decision: 5 December 2024

## The problem

The ability to retrieve a contact detail does not establish permission to copy it into a different commercial product.

- The problem
- Case record
- What the authority found
- Outcome and limits
- Checks for your own systems
- How Inth helps
- Sources and limits

## Case record

| Fact | Record |
| --- | --- |
| Authority | CNIL |
| Jurisdiction | France |
| Law | GDPR Articles 5(1)(e), 6, 12, 14 and 15 |
| Decision date | 5 December 2024 |
| Recorded fine | EUR 240,000 |
| Procedural status | Administrative fine and compliance order; later appeal status not established |
| Source review | 19 October 2026 |

Primary record: [CNIL announcement](https://www.cnil.fr/en/data-scraping-kaspr-fined-eu240000).

## What the authority found

CNIL found that Kaspr collected contact details whose visibility people had restricted to first- or second-degree LinkedIn connections. It found that this exceeded what those people could reasonably expect. [CNIL announcement](https://www.cnil.fr/en/data-scraping-kaspr-fined-eu240000).

The decision also addressed repeated renewal of retention, delayed or insufficiently understandable information, and inadequate information about data sources when people exercised access rights. [Authority notice on EDPB](https://www.edpb.europa.eu/news/data-scraping-french-supervisory-authority-fined-kaspr-eu240-000_en).

## Outcome and limits

CNIL imposed EUR 240,000 and ordered changes to collection, deletion, retention, information and access handling. An older EDPB notice gives a conflicting amount; this record uses CNIL's original announcement and counts the decision once. [CNIL announcement](https://www.cnil.fr/en/data-scraping-kaspr-fined-eu240000).

## Checks for your own systems

These are implementation checks suggested by Inth, not additional findings about the company.

- Record the actual source, visibility restrictions and permitted purpose before importing contact information.
- Use retention rules that do not keep extending solely because a profile changes.
- Make access responses capable of explaining available source information rather than using a generic 'public sources' label.

## How Inth helps

Code audit can map reviewed data ingestion and onward-sharing routes.

Inth does not decide the legal basis for scraping, inspect every external source's visibility rules or certify the lawfulness of a prospecting database.

## Sources and limits

- [CNIL announcement](https://www.cnil.fr/en/data-scraping-kaspr-fined-eu240000)
- [Authority notice on EDPB](https://www.edpb.europa.eu/news/data-scraping-french-supervisory-authority-fined-kaspr-eu240-000_en)

Source review: 19 October 2026. This is a dated account of the cited authority decision. A recorded fine is not a confirmed payment. Later procedural developments are stated only where the linked record establishes them. Inth wrote the implementation checks; they do not establish legal compliance or replace legal advice.