Spotify's own privacy policy and safety-and-privacy center describe collection of extensive account, usage, and optional data categories (including voice, payment, and sensor data), and disclose that data is shared with advertising, measurement, and analytics partners, with default-public elements of user profiles. Spotify AB has been fined by Sweden's data protection authority for GDPR transparency violations related to data-subject access requests, with an appellate court later restoring the original fine amount. Spotify Technology S.A. is a publicly traded, Luxembourg-registered company whose SEC filings disclose a beneficiary-certificate structure that concentrates voting control in its two founders.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-06-03]
On 3 June 2025, Sweden's Administrative Court of Appeal upheld the SEK 58 million GDPR fine originally imposed on Spotify AB for noncompliance with data subjects' right-of-access provisions, after a lower court had earlier reduced the amount.
Spotify's Korea-specific collection notice discloses that, at the user's choice, it collects data including interactions with the Spotify Service, inferences, user content, URL information, cookie data, and IP addresses, among other categories.
Spotify's Safety and Privacy center states that, in addition to account and usage data, users may provide or permit collection of additional categories such as Voice Data, Payment and Purchase Data, and Survey and Research Data.
Spotify Technology S.A.'s SEC Form 20-F for fiscal year 2020 discloses that founder Daniel Ek exercises voting power over ordinary shares held of record by Tencent-affiliated entities including TME Hong Kong and Tencent Mobility Limited through an irrevocable proxy.
Spotify Technology S.A.'s SEC Form 20-F for fiscal year 2022 discloses that founders Daniel Ek and Martin Lorentzon beneficially owned or controlled ordinary shares and beneficiary certificates representing 31.7% and 42.6% of combined voting power, respectively.
Spotify's Korea third-party data provision notice states that certain personal data, including a user's name/username, profile picture, and who they follow, is always publicly available on the Spotify Service.
Common Sense Media's privacy report on Spotify states that the service's terms indicate information collected from and shared with third-party partners may be used to build advertising profiles to serve targeted ads.
Common Sense Media's privacy evaluation of the Spotify app, based on its published privacy policy and related notices, states that personal information is sold or rented to third parties and that it is unclear whether personal information is shared for third-party marketing.
In December 2020, following a credential-stuffing campaign that used a third-party-held database of stolen login credentials, Spotify reset passwords for affected user accounts even though the exposed data had not originated from a breach of Spotify's own systems.
On 3 June 2025, Sweden's Administrative Court of Appeal upheld the SEK 58 million GDPR fine originally imposed on Spotify AB for noncompliance with data subjects' right-of-access provisions, after a lower court had earlier reduced the amount.
Spotify's Apple App Store privacy label discloses that Contact Info, Identifiers, and Usage Data collected by the app may be used to track users across apps and websites owned by other companies.