The pitch is appealing. Pull a prospect's name, photo, job title and company straight from their LinkedIn profile, drop it into a branded image, and send outreach that looks individually made.
Plenty of tools will sell you this. Fewer will mention that the most common way of doing it breaches LinkedIn's terms, and that there is a version which works better and carries none of the risk.
Worth reading before you build a workflow on the wrong foundation.
The part the tools skip
Automated scraping of LinkedIn profiles breaches LinkedIn's User Agreement. That is not a grey area in the terms themselves - they prohibit using bots or automated methods to access the service or copy data from it. LinkedIn enforces this, primarily by restricting or banning accounts.
The legal picture beyond the terms is genuinely contested and often misrepresented. The hiQ Labs v LinkedIn litigation is regularly cited as having established that scraping public data is legal. What the Ninth Circuit actually found was that scraping publicly accessible data likely did not violate the Computer Fraud and Abuse Act - a specific criminal statute. hiQ subsequently lost on LinkedIn's breach-of-contract claim. So "not a federal computer crime" and "permitted" are not the same finding, and the second does not follow from the first.
Separately, and often overlooked: if you are handling personal data about people in the UK or EU, UK GDPR and GDPR apply regardless of where the data came from. Scraped profile data is still personal data. You need a lawful basis for processing it, and the transparency obligations do not disappear because the information was publicly visible.
I am not a lawyer and this is not legal advice. If you are planning to do this at any scale, it is worth an hour with someone who is - the exposure is not primarily technical, and a banned sales team's LinkedIn accounts are expensive in a way that is easy to underestimate.
What is legitimate
Quite a lot, as it happens.
Data the person gave you. Form submissions, sign-ups, event registrations, a reply to a previous email. This is the cleanest source there is and it is usually richer than a profile scrape.
Data already in your CRM from a legitimate source. If your team recorded a job title after a call, that is yours to use.
LinkedIn's own official routes. Sales Navigator for research, and their partner APIs for approved integrations. Slower and more restricted than the scraping tools, which is precisely why they are not the ones being recommended to you.
Enrichment providers. Third parties who license or compile business contact data and assert a compliant basis for it. Reasonable to use, but do check what they claim about sourcing - you inherit some of the risk, and "we got it from a provider" is a weaker position than it sounds if the provider's own basis is thin.
Public company information. Firmographic data about an organization is a different category from personal profile data about an individual, and it is far less fraught. This is the important one, and it is where the better answer lives.
The version that works better anyway
Here is the thing most people miss while chasing profile data: company-level personalization is easier, safer, and usually more effective than personal personalization.
You almost always have someone's email address. From [email protected] you have acmelogistics.com, and from a domain you can legitimately obtain:
- Their company logo
- A screenshot of their website
- Their company name, sector and rough size, from ordinary business sources
Which means you can build an image containing their logo next to yours, or their actual homepage rendered inside your mockup - without touching a single personal profile.
In OKZest, layers can be flagged as a logo or a screenshot, so passing the domain produces the image automatically rather than requiring you to source and upload assets per prospect. One template, a domain per recipient, done.
Why this outperforms profile data in practice:
It is not unsettling. An email showing someone's job title and profile photo signals that you have been researching them individually, and the common reaction is wariness rather than flattery. Their company logo reads as "we know who you work for," which is a normal thing for a salesperson to know.
It survives being wrong. Job titles go stale constantly. Company domains do not.
It is visually stronger. A recipient's homepage rendered inside your image is a more arresting thing than their name in a font, and it demonstrates specific effort without implying surveillance.
It scales cleanly. One field - the domain - which you already have and which you can derive from the email address you were going to send to anyway.
The creepiness threshold
Worth naming directly, because it is the thing that decides whether personalization helps or backfires.
Personalization works when it signals relevance. It fails when it signals surveillance.
The line sits roughly where the recipient starts wondering how you got something. Their company, their industry, their public product launch - all normal knowledge for someone in your position. Their photograph, their recent job change, where they went to university - these prompt a different question, and once someone is asking how you know that, they have stopped reading your offer.
A useful test: could you explain how you got this in one sentence, in a way that sounds ordinary? "You're at Acme, so I looked at your site" is fine. "I pulled your profile" is not, even when technically true.
Building the image once you have the data
The mechanics are the same regardless of source, and they are not the hard part.
Build one design with placeholders where the variable elements sit. The image is then a URL with your data as parameters:
https://media.okzest.com/img?c=YOUR-COMPANY-ID&i=YOUR-DESIGN-ID&company=Acme%20Logistics&domain=acmelogistics.com
Your outreach tool substitutes each prospect's values as it sends. Whether the data came from a form, your CRM, or an enrichment provider makes no difference to this step - the sourcing question is entirely upstream.
Three practical notes:
URL-encode the values. Company names contain spaces, ampersands and apostrophes. Smith & Sons becomes Smith%20%26%20Sons. Most tools handle this, but check.
Set fallbacks. Some domains will not resolve to a usable logo. Decide what appears instead and make sure it looks deliberate rather than broken.
Test with your longest company name. Acme and International Logistics and Freight Solutions Group need the same layout to work.
Frequently asked questions
Can I automatically pull LinkedIn profile data into personalized images? Automated scraping breaches LinkedIn's User Agreement and risks account restriction, and if the people are in the UK or EU, data protection law applies to the scraped data regardless of its public visibility. Legitimate routes are data the person gave you, data already held in your CRM, LinkedIn's official products, or a compliant enrichment provider.
Isn't scraping public LinkedIn data legal? I read about a court case. The hiQ v LinkedIn ruling concerned the Computer Fraud and Abuse Act specifically, finding that scraping public data likely was not a violation of that statute. hiQ later lost on LinkedIn's breach-of-contract claim. "Not a federal computer crime" is not the same as "permitted," and neither addresses data protection obligations.
What data can I safely personalize outreach images with? Company-level information is the safest and usually the most effective: their logo, a screenshot of their website, their company name and sector. All of it is derivable from the email domain you already have.
How do I get a prospect's company logo automatically? From their email domain. In OKZest, flagging a layer as a logo or a screenshot means passing the domain produces the image without sourcing assets manually per prospect.
Is personal or company personalization more effective? Company personalization generally performs better in cold outreach, because it signals relevance without implying you have researched the individual. Personal details often trigger wariness rather than warmth.
What about people who gave me their details? Then use them. Data someone provided directly is the cleanest source available and typically better than anything a profile would give you.
Do I need legal advice for this? If you are doing it at scale, or handling data about people in the UK or EU, it is worth an hour with someone qualified. The risk is mostly contractual and regulatory rather than technical.
A better starting point
If you were about to build a LinkedIn scraping workflow, the shortcut is this: use the email domain you already have, put their logo or their homepage in the image, and skip the entire problem.
OKZest generates images from a URL, with logo and screenshot layers that resolve from a domain - so a personalized outreach image needs one field you already possess, and no profile data at all.
Create a free account, no credit card required.
Related reading: using images in cold email, adding logos and screenshots to email images, generating images from a CSV via the API.