Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Targeting cookies collect browsing habits and visit history, share that information with advertisers and other organizations, and are used to build an interest profile for the purpose of delivering relevant advertisements and measuring advertising campaign effectiveness.
This analysis describes what Spotify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that targeting cookies enable cross-site tracking and interest profiling shared with third-party advertisers. Under GDPR and the ePrivacy Directive, processing of this nature generally requires valid prior consent; under CPRA, it may constitute sharing of personal information for cross-context behavioral advertising subject to opt-out rights.
Under this provision, targeting cookies may track browsing activity across websites, build interest profiles, and share visit and interest data with advertisers and other organizations. Users who allow these cookies will have browsing habit data collected and shared for advertising purposes.
Cross-platform context
See how other platforms handle Targeting Cookies: Cross-Site Tracking and Interest Profiling and similar clauses.
Compare across platforms →Monitoring
Spotify has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"These cookies are used to deliver advertisements more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaigns. They remember that you have visited a website and this information may be shared with other organisations such as advertisers. These cookies collect information about your browsing habits in order to make advertising relevant to you and your interests.Excerpt from Spotify's Platform Rules
1) REGULATORY LANDSCAPE: This provision engages the EU ePrivacy Directive regarding prior consent for non-essential cookie placement, GDPR requirements for lawful processing of personal data for profiling and advertising, and CPRA definitions of sharing personal information for cross-context behavioral advertising. Enforcement authorities include EU/EEA data protection authorities and the California Privacy Protection Agency. The reference to sharing with 'other organisations such as advertisers' implicates GDPR data recipient transparency requirements. 2) GOVERNANCE EXPOSURE: Medium. Cross-site tracking and interest profiling disclosed in this provision are among the more closely scrutinized data practices by EU/EEA and California regulators. The generality of 'other organisations such as advertisers' without specific enumeration may present transparency concerns under GDPR Article 13. 3) JURISDICTION FLAGS: EU/EEA users are subject to ePrivacy Directive requirements mandating prior informed consent for targeting cookies, and GDPR requirements for lawful profiling. California residents have CPRA opt-out rights for sharing of personal information for cross-context behavioral advertising. Illinois and other state privacy laws may also be relevant depending on user location. 4) CONTRACT AND VENDOR IMPLICATIONS: The sharing of browsing habit data with advertisers and other organizations implies data controller-to-controller sharing arrangements that may require standard contractual clauses for cross-border transfers under GDPR. Procurement teams should verify that all recipient organizations are identified and that appropriate legal frameworks govern data transfers. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the list of organizations receiving targeting cookie data, verify that consent obtained for these cookies meets GDPR and ePrivacy standards (including pre-checked boxes not being used), and assess whether the opt-out mechanism for targeting cookies is operationally effective and accessible.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision discloses that targeting cookies enable cross-site tracking and interest profiling shared with third-party advertisers. Under GDPR and the ePrivacy Directive, processing of this nature generally requires valid prior consent; under CPRA, it may constitute sharing of personal information for cross-context behavioral advertising subject to opt-out rights.
Under this provision, targeting cookies may track browsing activity across websites, build interest profiles, and share visit and interest data with advertisers and other organizations. Users who allow these cookies will have browsing habit data collected and shared for advertising purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Spotify.