LinkedIn reads a profile before the first click: eight paths

Ordinary tracker blocking judges by domain: an outside counter lives on an outside address, and telling it apart is easy. A request to the network's own site looks to that blocking like a plain feed load.

So the platform counts you with its own requests, and they travel mixed in with the useful ones. Only the address fragment separates them, because the domain is the same for all of it. A domain list lets it through together with the feed.

You will see the eight address fragments below on your own machine, in the request tab of a developer window. Each one means a separate report, and they leave before you press anything at all. They leave in the first seconds after the load.

The last three are bare words: beacon, telemetry and viewedEntity. They turn up in addresses on other sites too, so they mean something only inside the network itself.

Two more requests look ordinary right up until one of the words below appears in the address. With that word an ordinary request turns into a report about you. Without the word it stays a needed part of the work, and must not be touched.

Messaging tells the network that a letter was read and that you are typing a reply right now. Search tells it what you were shown and which of it you looked at.

Besides its own reports the page carries outside counters, and those sit on addresses belonging to other companies. Those are exactly what a domain blocklist catches, and it sorts them like this.

Eleven of the addresses do not belong to the network at all: a search engine, a social network, advertising, a crash collector. The rest sit on its own addresses and on the address of its image store.

One line in the list is a script that other sites install themselves for the sake of advertising on the network. It is called the Insight tag, and it lives on the address of the image store.

It sits not on the network but on somebody else's site, and it reports your visit back there. So the network knows about shops and blogs where you never signed in to your account. It ties those visits to the account by the same small browser details.

The network shows the owner of a page who came to look, and an invitation is seen by a living person. So a daily count means more here than in a feed, where nobody sees you by name.

We did have a separate Work / LinkedIn scenario with four daily ceilings, and it has been merged into the Social media scenario: you can no longer pick it, and Social media holds ten ceilings. A ceiling is not a ban but a guide: the Safe pace bar turns amber at four fifths and never tries to stop you.

One bar per profile rather than per action: it counts opened pages, because those are the only thing a browser sees. Viewing somebody's page is an opened page too, and it goes into the day's count.

The Social media scenario holds ten daily ceilings, and the four in the table above are part of that ten with the same numbers, only Messages is called DMs here. On a profile's first day a fifth of them remains, and the day's figure never drops below one: two account switches become one rather than zero.

The program cannot count these actions for you, so the rows under the bar, in Safe daily ceiling, are numbers without colour, with the «warning at N» threshold on a second line. Only the bar of opened pages is coloured, and the decision on the rest stays yours.

You copy a link to someone else's page together with its tail. In that tail sits a mark saying where you arrived from and who showed you the page.

The app knows forty such marks, among them trk, lipi, trackingId and li_fat_id, and cuts them when you follow a link inside a profile. A link you copy is untouched: what gets cleaned is where you go, not what you copy. The page itself opens unchanged.

The Social media scenario attaches three lists to a profile at once: the general one, this network's own list and the social list. The network's list is the eight address pieces and two query rules discussed above, and it works only on the network's own addresses.

Sixteen of the forty tags the program cuts out of links came from this very network's addresses: trk, trkInfo, lipi, lici, trackingId, refId and the rest. Link cleaning is on in the scenario, and a click from an email lands on the network without the tail.

The bare word beacon stands in addresses across a great many sites, and almost everywhere it is an ordinary file. Blocked everywhere it did break unrelated pages, which is why these rules are locked to the platform’s own hosts.

So on somebody else's site the same request goes through as usual. It is blocked only on the network's own addresses and on the address of its image store.

Everything named above is visible from a developer window, with nothing to install. Open the request tab, go to the network and press nothing at all.

The first seconds are the interesting part: the reports leave ahead of anything you do. After that, compare what you saw with the eight address fragments in the table above. Later you will not find them among hundreds of requests.

1. 1

   Open the request tab first

   Before you go to the network, or the earliest requests are gone.

2. 2

   Filter by an address fragment

   The search line above the list takes a whole fragment of an address.

3. 3

   Look at the timing

   The reports leave earlier than the page finishes drawing itself.

4. 4

   Repeat it inside a profile

   Compare what leaves an ordinary window with what leaves a profile.