LinkedIn Insight Tag: The Third-Country Transfer Most DPOs Overlook

Every DPO knows Google Analytics. The debate around GA4, Schrems II, and the EU-US Data Privacy Framework made it a staple of every privacy training. But there's a tracker running on more B2B websites than GA4 — and it's either missing from most privacy policies or incorrectly described: the LinkedIn Insight Tag.

What the Insight Tag Actually Does

The LinkedIn Insight Tag (snap.licdn.com) is a JavaScript pixel that on every page load:

• Sets cookies: li_sugr (user matching, 90 days), bcookie (browser ID, 1 year), lidc (datacenter routing), bscookie (secure browser ID), AnalyticsSyncHistory (analytics sync)
• Activates first-party tracking: Since 2023, LinkedIn sets the li_fat_id parameter as a first-party cookie via link decoration — the click ID survives ITP and cookie blocking
• Sends data to US servers: Every pageview goes to px.ads.linkedin.com (Microsoft Azure, US data centers)
• Enables cross-site tracking: Via li_sugr, LinkedIn can match website visitors to their LinkedIn profiles — even when not logged in

Why LinkedIn Is Riskier Than GA4

1. No Consent Mode Equivalent

Google offers Consent Mode v2: when denied, cookieless pings are sent. LinkedIn has no comparable system. The Insight Tag knows only two states: on or off. When it loads, it sets cookies and sends personal data. There is no "lite" mode.

2. First-Party Tracking via Link Decoration

The li_fat_id parameter is appended to URLs when a user clicks a LinkedIn ad. This ID is stored as a first-party cookie and sent back to LinkedIn on every subsequent page view. This bypasses ITP, third-party cookie blocking, and most CMPs that only block third-party cookies.

3. Under-documented Data Processing

In our audits, 73% of B2B websites have at least one of these problems:

Compliance Steps

1. Block pre-consent: The Insight Tag must only load after explicit consent for "Marketing". GTM: set trigger to consent_update with ad_storage = granted
2. Capture li_fat_id in your CMP: Most CMPs don't automatically detect li_fat_id because it's a first-party cookie. Add it manually as a marketing cookie
3. Update your privacy policy: Name LinkedIn Corporation as a recipient, specify consent as the legal basis, document DPF + SCCs as transfer mechanism
4. Conduct a TIA: Create a Transfer Impact Assessment for the LinkedIn data transfer. Focus: US surveillance laws (FISA 702, EO 12333), Microsoft-specific safeguards
5. Document retention periods: LinkedIn stores Insight Tag data for 180 days. This must be stated in your privacy policy

GTM Configuration: Correct Insight Tag Setup

<!-- GTM: LinkedIn Insight Tag ONLY after consent -->
<script>
  // Trigger: Custom Event "consent_update"
  // Firing Condition: {{ad_storage}} equals "granted"
  _linkedin_partner_id = "YOUR_PARTNER_ID";
  (function(l) {
    var s = document.getElementsByTagName("script")[0];
    var b = document.createElement("script");
    b.type = "text/javascript"; b.async = true;
    b.src = "https://snap.licdn.com/li.lms-analytics/insight.min.js";
    s.parentNode.insertBefore(b, s);
  })();
</script>

Important: Additionally strip the li_fat_id URL parameter via JavaScript before it gets stored as a cookie — otherwise first-party tracking continues even after CMP rejection.

What Happens If Someone Complains?

LinkedIn tracking complaints are increasingly reaching supervisory authorities. The Irish DPC (responsible for LinkedIn in the EU) opened an investigation into LinkedIn's Insight Tag data processing in 2025. The outcome will set precedent for all B2B websites using the tag.

Our Forensic Reports automatically detect the LinkedIn Insight Tag, associated cookies, and the li_fat_id parameter, mapping them to applicable legal provisions. Details on the methodology page.