LinkedIn Wants the Right to Tell You When the Government Asks for Your Data

Key points

• Microsoft's chief legal officer Jon Palmer published a blog post on Tuesday arguing that government secrecy orders on LinkedIn user-data subpoenas should be the exception, not the rule.
• On August 31, the US House of Representatives passed legislation that would place stricter limits on secret government data requests to technology companies.
• A federal judge this month dismissed a separate privacy lawsuit against LinkedIn but allowed plaintiffs to refile within 14 days.
• Microsoft's push carries a credibility problem: LinkedIn is simultaneously defending itself against its own users' privacy claims.

The US government regularly sends LinkedIn legal demands called subpoenas, formal court-ordered requests for information, that require the company to hand over data about specific users. Sometimes those demands come with a secrecy order that legally bars LinkedIn from telling the affected user anything at all. Microsoft wants that to stop.

Jon Palmer, Microsoft's chief legal officer, laid out the argument in a Tuesday blog post. Secrecy orders need to be tied to demonstrated needs and subject to meaningful court review. "The government must seek only relevant information, justify secrecy with specific evidence and infringe on speech to the least extent possible."

His broader point: the US Constitution's Fourth Amendment, which protects people from unreasonable searches of their papers and belongings, applies to data stored online just as much as to a locked filing cabinet. A First Amendment right, Palmer argued, gives online services the standing to speak to their customers when a government demand arrives.

What did Congress actually do about this?

The House passed a bill on August 31 that would set clearer boundaries on how long and how broadly these secrecy orders can run, and would require the government to justify them more rigorously. The Senate has not voted on it. Palmer called on the Senate to act "promptly."

Whether the Senate moves before the end of the congressional session is genuinely uncertain.

Should LinkedIn users be worried right now?

Practically speaking, if you have a LinkedIn account, the company may have received requests for your data without being allowed to tell you. That isn't new, and it applies to most large online platforms. Threat Vectr covered a related Microsoft privacy move on 9 September in our story on Windows 11's new age-awareness system, which shows the company pushing a consistent line on user-data limits across its products.

The litigation front is also active. A lawsuit accusing LinkedIn of its own privacy violations was dismissed by US District Court Judge Vince Chhabria this month. The judge gave plaintiffs 14 days to refile but was skeptical: "It seems unlikely that the plaintiffs will ever be able to allege a privacy violation, much less prevail."

Three analysts quoted by CSO Online pulled in different directions. Ryan O'Leary of IDC was blunt: "This seems to come down to protecting its own proprietary data sets, not some altruistic privacy crusade." Jeff Valdes of Acceligence saw "definite irony" in a company fighting government overreach while defending itself from its own users' privacy claims. Mike Wilkes, enterprise CISO at Aikido Security, thought the substance still holds: "Microsoft does not need to be a perfect privacy saint to be right about this particular problem."

Wilkes has it right. The legal principle, that a person should be told when the government is sifting through their private records unless a court has reviewed a specific reason for silence, stands on its own. What to watch is whether Senate inaction quietly buries a bill that passed the House cleanly, letting the status quo of open-ended, unchallenged secrecy orders run on indefinitely.