SoundCloud is an ad-supported audio streaming and creator platform operated by SoundCloud Global Limited & Co. KG in Berlin, with a free tier plus paid Go/Go+ subscriptions. Its own privacy policy discloses collection of extensive account, profile, monetization, and automatically-collected usage/log/location data, and explicitly states that certain data-sharing activities for advertising "may be considered 'sales' or 'sharing'" under U.S. state privacy laws. Its cookie policy and Apple's App Store privacy label confirm third-party advertising cookies (via the IAB Transparency and Consent Framework) and tracking of Location, Identifiers, and Usage Data across apps and websites. SoundCloud's corporate structure is traceable through its own imprint page, which cites its German commercial register entry; Have I Been Pwned's breach catalog lists a December 2025 SoundCloud breach affecting approximately 29.8 million accounts (avatars, email addresses, geographic locations, names, profile statistics, and usernames — no passwords or financial data among the listed classes), while no regulatory enforcement action was found in this research, and the current Terms of Use commit to an opt-in requirement before user content is used to train generative AI models, addressing an earlier controversy over AI-training language.
TRACK RECORD
1 BREACH
[2025-12-15] · BREACH
Have I Been Pwned lists a breach record for SoundCloud: "SoundCloud".
Approximately 29,815,722 accounts affected, per HIBP.
Apple's App Store privacy label for the SoundCloud app, self-reported by SoundCloud Global Limited & Co KG, discloses that Financial Info, Contact Info (Email Address), and User Content (including Photos or Videos, Audio Data, and Search History) may be collected and linked to the user's identity.
SoundCloud's Privacy Policy states that registered users must provide an email address, age/birthdate, postal code, username, and password, and discloses optional profile data (real name, gender, city/country) plus automatically collected Usage Information (interactions, streaming/downloading, searches), Log Data (IP address, device info, browser type), and Location Data tied to Platform features.
The service's policy indicates your personal data may be sold or otherwise transferred as part of a bankruptcy proceeding or other type of financial transaction.
SoundCloud's imprint page discloses that the platform is operated by SoundCloud Global Limited & Co. KG, registered in the German commercial register at Amtsgericht Charlottenburg under registration number HRA 55946 B, with SoundCloud Limited (UK) as general partner, SoundCloud Management GmbH as limited partner, and Eliah Seton named as CEO.
SoundCloud's Privacy Policy discloses categories of personal data (identifiers, internet/network activity, location, inferred characteristics) shared with advertising partners for targeted advertising, and explicitly states these disclosures may legally constitute a "sale" or "sharing" of personal data under certain U.S. state privacy laws; it separately discloses using Decagon AI, Inc., which relies on OpenAI large language models, as a service provider to process customer-support inquiries.
SoundCloud's current Terms of Use state that user content will not be used to train generative AI models that aim to replicate or synthesize a user's voice, music, or likeness without the user's explicit, affirmatively-provided opt-in consent, addressing an earlier public controversy over AI-training language in SoundCloud's terms.
As of 2026-08-17, SoundCloud's own ads.txt file at soundcloud.com authorizes 235 advertising system domain(s) to sell its ad inventory (152 DIRECT and 1268 RESELLER entries), including rubiconproject.com, pubmatic.com, appnexus.com, smartadserver.com, adswizz.com, video.unrulymedia.com, openx.com, sharethrough.com.
SoundCloud's Privacy Policy names a specific Data Protection Officer contact channel (dataprotection@soundcloud.com) for privacy questions or complaints, a basic accountability structure but not a published third-party audit, transparency report, or bug-bounty program. No regulatory fine or enforcement action involving SoundCloud was identified from primary sources as of this review; the December 2025 breach affecting approximately 29.8 million accounts is documented separately in this dossier's Have I Been Pwned claim.
Have I Been Pwned's breach catalog lists the "SoundCloud" incident (soundcloud.com), breach date 2025-12-15, affecting approximately 29,815,722 accounts. Data classes exposed per HIBP: Avatars, Email addresses, Geographic locations, Names, Profile statistics, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
SoundCloud's Cookie Policy discloses "Targeted Cookies (Personalization/Advertising)" that may be set by advertising partners to build a profile of a user's interests for ads on other sites, and describes participation in the IAB Transparency and Consent Framework (TCF), which governs registered third-party advertising vendors and publishers.
Apple's App Store privacy label for the SoundCloud app discloses a "Data Used to Track You" category, stating that Location, Identifiers, and Usage Data may be used to track the user across apps and websites owned by other companies.