Pandora is an ad-supported (with paid Plus/Premium tiers) music streaming app operated by Pandora Media, LLC, a wholly owned subsidiary of Sirius XM Holdings Inc. (NASDAQ: SIRI), per Sirius XM's FY2025 Form 10-K. Pandora and SiriusXM share a single combined privacy policy that discloses collection of precise geolocation, listening-preference and demographic data, and sharing of advertising identifiers (IDFA/AAID) and hashed identifiers with third-party ad platforms; the policy states Sirius XM 'does not sell your personal data for profit' but acknowledges some advertising-related disclosures 'could be considered a "sale"' under state privacy laws. Apple's live App Store privacy label confirms Location, Contact Info, Identifiers, and Usage Data are used to track users across apps and websites owned by other companies. No specific privacy enforcement action, breach, or settlement against Pandora/Sirius XM was found within this research's budget; Sirius XM's 10-K discloses only generic cybersecurity/privacy legal-liability risk language, not a named incident.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
[2026-03-18] · COLLECTION
The Sirius XM/Pandora combined privacy policy (effective March 18, 2026) lists twelve categories of personal data collected across the Services, including Precise Geolocation Data of device, Other Demographic Data, Listening Preferences, Account Information and Settings, Device Data, Audio and Visual Data, and Non-Precise/Coarse Geolocation Data.
Sirius XM Holdings Inc.'s Form 10-K for fiscal year ended December 31, 2025 (filed with the SEC, CIK 0000908937), Exhibit 21.1 (Subsidiaries of Sirius XM Holdings Inc.), lists 'Pandora Media, LLC' among the company's subsidiaries.
Pandora's own privacy policy states it is issued jointly on behalf of Sirius XM Radio LLC and its subsidiaries, expressly naming Pandora Media, LLC as one of those subsidiaries, tying the Pandora brand directly to its corporate parent in the operator's own disclosure.
The privacy policy states that Sirius XM 'does not sell your personal data for profit' but acknowledges it engages in disclosures of personal data for advertising/marketing purposes 'that could be considered a "sale" under the broad definitions of state privacy laws,' the same self-declared-sale pattern used by other ad-supported streaming peers under CCPA.
Sirius XM's FY2025 Form 10-K discloses only generic forward-looking risk language that a compromise of personal or confidential information could subject the company to legal liability or regulatory action under evolving privacy laws; it does not name any specific enforcement action, settlement, or breach involving Pandora or Sirius XM.
The Pandora iOS app's Apple App Store privacy label (fetched live) discloses that Location, Contact Info, Identifiers, and Usage Data may be used to track the user across apps and websites owned by other companies, in addition to separate categories collected and linked to identity for third-party advertising, developer advertising/marketing, and analytics.
The privacy policy states that to serve targeted/personalized advertising, Sirius XM may provide identifiers such as a device's IDFA/AAID advertising ID, or pseudonymized IDs derived from personal information, to third-party ad platforms including social media networks, ad servers, and DSP/SSPs.