it does NOT scan applications on your computer

technically browser extensions are considered applications under EU's GDPR

It DOES scan which browser extensions you have running (if they affect page loading).

as per their report:

Why two detection methods

Method	Technique	What it catches
AED	fetch() against known resource paths	Extensions that are merely installed, even if they inject nothing into the current page
Spectroscopy	Full DOM tree walk	Extensions that actively modify the page, even if they are not in LinkedIn’s hardcoded list

They also scan for thousands of extensions. The only reason it doesn't do this on Firefox is that Firefox randomises the uuid of extensions every time. Chrome doesn't.

I think the argument is that since some of the extensions that are probed can be political in nature, which can reveal political identity, which is potentially unlawful in the EU. However, it really needs to be up to a judge to make a decision on that.

In general what they're doing is legal, and the BrowserGate people are using niggling little details, a handful of extensions out of the 6000 probed, to justify this argument. I couldn't say, especially as someone from outside the EU, whether this is actually illegal or not, but it's definitely in a nebulous area at the moment.

Though I agree it's sensationalized in terms of claiming it's "searching your computer" and doing "corporate espionage."

There is literally a section called Why it's illegal.

LinkedIn’s scan reveals the religious beliefs, political opinions, disabilities, and job search activity of identified individuals. LinkedIn scans for extensions that identify practicing Muslims, extensions that reveal political orientation, extensions built for neurodivergent users, and 509 job search tools that expose who is secretly looking for work on the very platform where their current employer can see their profile.

Under EU law, this category of data is not regulated. It is prohibited. LinkedIn has no consent, no disclosure, and no legal basis. Its privacy policy does not mention any of this.

Fonts, codecs, hardware, OS, extensions are all parts of a computer that never ever need to be transmitted to a website for it to function. Any information about them should be sandboxed, and if the website wants to display differently based on them, it can send static data or code in and get nothing back out.

Yeah but still sick of this shit

Well that was very interesting. I wasn't planning to cover my tracks, but apparently I am.