LinkedIn Share

LinkedIn sets several cookies when the platform script loads. The bcookie (1 year) is a browser identifier. The lidc cookie (1 day) handles routing between LinkedIn data centres. The li_gc cookie (2 years) stores the visitor consent state for non-essential LinkedIn cookies. The UserMatchHistory and AnalyticsSyncHistory cookies (30 days each) are used for advertising audience matching and analytics. The bscookie (1 year) is a security cookie for verified logins.

Yes. The LinkedIn platform script sets advertising and analytics cookies including UserMatchHistory as soon as it loads, before any sharing action. Under the ePrivacy Directive these are non-essential cookies that require prior consent. You must block the platform script via your consent management platform until the user opts in to the analytics and marketing categories.

The legal basis is consent under Article 6(1)(a) of the GDPR for the advertising and analytics cookies set by the platform script. The li_gc cookie LinkedIn sets reflects LinkedIn's own consent layer, but this does not replace your obligation to obtain consent under your own privacy notice before the script loads. There is no non-consent basis for the advertising cookies.

Yes. LinkedIn Ireland Unlimited Company acts as the EU data controller but transfers data to LinkedIn Corporation and Microsoft Corporation in the United States. The transfers rely on the EU US Data Privacy Framework and standard contractual clauses. Website operators should include LinkedIn and Microsoft as data recipients and reference the transfer mechanism in their privacy notices.

A DPIA is recommended given the high risk classification. The platform script enables LinkedIn and Microsoft to build an advertising profile of every visitor who loads the page, regardless of whether they click the share button. The combination of cross-site tracking cookies, US data transfers and the involvement of Microsoft as a parent company increases the risk to data subjects.

Block the LinkedIn platform script until the user opts in to analytics and marketing cookies. If consent is declined display a static share link that opens LinkedIn without pre-loading the script. Update your cookie policy to list all LinkedIn cookies. Include LinkedIn and Microsoft as data recipients in your privacy notice and reference the US transfer safeguards. Conduct a DPIA given the high risk rating.

Yes. You can replace the LinkedIn platform script with a plain anchor link pointing to the LinkedIn share URL (linkedin.com/sharing/share-offsite/) using the current page URL as a parameter. This opens LinkedIn in a new tab without loading any LinkedIn script or setting cookies on your site. The trade-off is the absence of the styled LinkedIn button, but the share functionality is preserved.

Your cookie policy should list bcookie (1 year, browser identifier), lidc (1 day, data centre routing), li_gc (2 years, consent storage), UserMatchHistory (30 days, advertising audience sync), AnalyticsSyncHistory (30 days, analytics sync) and bscookie (1 year, security). Identify LinkedIn Ireland Unlimited Company and Microsoft Corporation as the data controllers, state the legal basis as consent, and reference the EU US Data Privacy Framework and standard contractual clauses for US transfers.