How to find someone's email on LinkedIn without breaking LinkedIn's rules

This guide is for sellers, recruiters and founders who've found the right person on LinkedIn and need their email address. It sets out which methods LinkedIn allows and which break its User Agreement, then walks through each allowed route, with a worked example. The rules quoted are from LinkedIn's User Agreement (effective 3 November 2025) and its help center, read on 30 October 2026. This is general information, not legal advice.

What's allowed and what isn't

The line is simple. Reading a profile as a member and using what you learn to contact the person is what LinkedIn is for. Software that copies LinkedIn data out, or changes how LinkedIn's pages look, is not.

Method 1: Check Contact info

1. Open the person's profile and click Contact info in the introduction section.
2. If an email address is listed, you can see it because their settings allow you to.

By default, the primary email a member registered with is visible only to their 1st-degree connections. Members can change that to "Only visible to me", 1st and 2nd-degree connections, or anyone on LinkedIn. So for most people outside your network, Contact info shows no email. LinkedIn also tells members not to put email addresses anywhere else on their profile, so the About section rarely has one.

Method 2: Connect, then use your data export

If you're connected, LinkedIn will give you your connections' emails, but only those who allow it.

1. Click Me, then Settings & Privacy, then Data privacy.
2. Under "How LinkedIn uses your data", choose Get a copy of your data.
3. Select the larger data archive, which includes connections, and click Request archive.
4. LinkedIn emails you a download link, within 24 hours for the larger archive, and the file stays available for 72 hours.

The connections file lists each 1st-degree connection's name, profile URL, email address, company, position and connection date. LinkedIn includes an email only when the connection has allowed connections to download it, so expect gaps. You can't export anyone who isn't a 1st-degree connection.

Method 3: Ask

Asking is the most reliable route, and the only one that also gets you permission. Connect with a short note that gives a reason, or send an InMail, then ask for the best address once they reply. LinkedIn InMail explains when a paid message is worth its credit.

Hi [first name], I saw [company] [the fact]. I work with [type of company] on [area] and have a short note on [topic] that may help. Happy to connect.

Thanks, [first name]. Rather than send it here, could I email you the [one-page estimate / short note]? What's the best address for you?

Method 4: Read the Sales Navigator lead page

If you have Sales Navigator, a lead page shows contact details from the person's profile (where their settings let you see them), from your CRM, and any details you or your colleagues have added by hand. Details your team adds are visible to everyone on your Sales Navigator contract. Sales Navigator doesn't find new email addresses for you and, as its help center says, has no option to export leads to a spreadsheet. The Sales Navigator guide covers what it does do well.

Method 5: Find the address off LinkedIn

LinkedIn gives you the person's name, role and employer. The address itself usually lives elsewhere:

1. Get the company's domain from the website link on its LinkedIn Page or from a search, then confirm it receives mail with an MX lookup.
2. Look for the address where it's published: the company's team or press pages, a press release that names the person as a contact, a conference speaker page, a published report.
3. Work out the company's email format from two or more published addresses at that domain. The company email format guide shows the common patterns and how to settle between them.
4. Build the address and verify it with an email verification tool, treating an accept-all result as unconfirmed.

How to find a business email address covers each step in detail, including what each verification result means.

Method 6: Use an email finder tool, the right way

An email finder that takes a name and a company domain on the vendor's own website or API doesn't touch LinkedIn, so using it isn't a LinkedIn question. Two checks still matter:

• Where the data comes from. Ask the vendor whether any of its records were collected from LinkedIn. If they were, using them is the conduct section 8.2 describes, whoever did the collecting.
• How the address was produced. A guessed or permuted address that the tool calls "likely" isn't confirmed. Verify before you send.

Compare tools on accuracy and price in the best email finder comparison.

What breaks LinkedIn's User Agreement, plainly

Section 8.2 of the User Agreement lists what members agree not to do. These are the parts that matter here, in LinkedIn's words:

• "Develop, support or use software, devices, scripts, robots or any other means or processes (such as crawlers, browser plugins and add-ons or any other technology) to scrape or copy the Services, including profiles and other data from the Services"
• "Use bots or other unauthorized automated methods to access the Services, add or download contacts, send or redirect messages"
• "Copy, use, display or distribute any information (including content) obtained from the Services, whether directly or through third parties (such as search tools or data aggregators or brokers), without the consent of the content owner"
• "Overlay or otherwise modify the Services or their appearance (such as by inserting elements into the Services...)"

LinkedIn's help page on prohibited software spells out what that means for extensions: it doesn't permit "any third party software, including 'crawlers', bots, browser plug-ins, or browser extensions that scrape, modify the appearance of, or automate activity on LinkedIn's website." Members who use them risk having their accounts restricted or shut down. A "LinkedIn email finder" extension that adds a button to profiles and reads the page to look up an address does both things the policy names: it reads the profile and changes the page. A vendor calling its extension "compliant" doesn't change LinkedIn's terms.

LinkedIn enforces this. Sales Navigator's help center tells users to remove browser extensions that may be scraping profile data, and in December 2022 LinkedIn announced that hiQ Labs had agreed to a permanent injunction barring it from scraping or using fake accounts on LinkedIn.

The email law adds its own risk. Under CAN-SPAM, sending a commercial email that already breaks the Act becomes an aggravated violation if the address was harvested by automated means from a website whose notice says it won't transfer addresses, or was generated by combining names and letters into permutations. In the UK, the ICO says a work address that identifies a person is personal data under UK GDPR. The business email address guide covers the sending rules.

Worked example: two prospects, two routes

Illustrative example. The companies, people and timings are fictional, to show the method.

The seller: Jordan, an account executive at Kestrel Rota (kestrelrota.example), which sells staff scheduling to dental groups. The prospects: the operations directors at two dental groups, both 3rd-degree connections.

Prospect one, Marcus at Harbor Point Dental (harborpoint.example). Contact info shows no email. Jordan sends a connection request with a 181-character note: "Hi Marcus, I saw Harbor Point opened two clinics in August. I work with dental groups on staff scheduling and have a short note on covering sick days across sites. Happy to connect." Marcus accepts two days later. As a 1st-degree connection, Jordan now sees Marcus's email in Contact info, because Marcus kept the default setting. Jordan replies to the acceptance asking whether email is the best place for the note, and Marcus says yes. Time spent: about four minutes, plus the wait.

Prospect two, Elena at Lakeshore Smiles (lakeshoresmiles.example). She doesn't accept. Jordan goes off LinkedIn: the group's press page lists two staff contacts, both first.last@lakeshoresmiles.example, and an MX lookup confirms the domain receives mail. Jordan builds elena.marsh@lakeshoresmiles.example, and the verification tool returns valid. Time spent: about ten minutes.

What Jordan didn't do: install an extension that promised to show Elena's email on her profile. It would have been faster, and it would have put Jordan's LinkedIn account, and the Sales Navigator seat on it, at risk.

At list scale, the finding is the slow part. Bebop finds matching companies and the right contacts at each, with their contact details and a researched first message, so you start from the person rather than a guess. Verify addresses before any large send, whatever the source.

Self-check

• You've checked Contact info before anything else.
• Any tool you use works outside LinkedIn and doesn't read, overlay or export LinkedIn pages.
• You know where your email finder's data comes from.
• Addresses you built from a format are verified, and accept-all results are treated as unconfirmed.
• Your email includes your postal address and a working opt-out.

Common mistakes

• Installing a "LinkedIn email finder" extension. It breaks section 8.2 and puts your account at risk.
• Connecting only to harvest the export. People notice, and many don't allow email downloads anyway. Connect when you have a reason to.
• Assuming the export has every email. It includes only connections who allow it.
• Emailing every permutation of a name. It bounces, damages your sender reputation and, if the email otherwise breaks CAN-SPAM, makes the violation aggravated.
• Forgetting the simplest route. One sentence asking for the best address often works.

Next step: once you have the address, write the email with how to write a cold email.