Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Strictly necessary cookies and first-party functional cookies are designated as always active and cannot be disabled through the consent interface; the document states that blocking these cookies via browser settings may result in parts of the service not functioning.
This analysis describes what Spotify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The designation of functional cookies as 'always active' alongside strictly necessary cookies may require evaluation under GDPR and ePrivacy Directive guidance, which generally permits exemption from consent only for cookies that are strictly necessary for a service explicitly requested by the user. Whether personalization-enabling functional cookies qualify for this exemption is a matter of regulatory interpretation.
Interpretive note: Whether functional personalization cookies qualify for the strictly necessary exemption under ePrivacy Directive and GDPR guidance is subject to regulatory interpretation and may vary across EU/EEA jurisdictions.
Under these terms, strictly necessary and first-party functional cookies cannot be disabled through the Spotify consent interface. Users who wish to block these cookies must do so through browser-level settings, with the document stating that some parts of the service may not function as a result.
Cross-platform context
See how other platforms handle Strictly Necessary and Functional Cookies: Always Active and similar clauses.
Compare across platforms →Monitoring
Spotify has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"These cookies are necessary for the service to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the service will not then work. First Party Functional Cookies Always Active. These cookies enable us to provide enhanced functionality and personalisation. If you do not allow these cookies then some or all of these services may not function properly.Excerpt from Spotify's Platform Rules
1) REGULATORY LANDSCAPE: This provision engages ePrivacy Directive Article 5(3) exemptions for strictly necessary cookies, and GDPR consent requirements. EU/EEA data protection authorities have issued guidance indicating that the strictly necessary exemption applies narrowly to cookies required for transmission of communications or explicitly requested services. The grouping of functional personalization cookies with strictly necessary cookies as 'always active' may require evaluation against this guidance. Enforcement authority rests with EU/EEA data protection authorities. 2) GOVERNANCE EXPOSURE: Medium. Regulatory guidance from several EU/EEA data protection authorities has indicated that functional or personalization cookies do not automatically qualify for the strictly necessary exemption and may require consent. The document's designation of first-party functional cookies as 'always active' may present compliance exposure in the EU/EEA. 3) JURISDICTION FLAGS: Heightened exposure exists for EU/EEA users given the narrow scope of the ePrivacy Directive strictly necessary exemption as interpreted by data protection authorities including those in France (CNIL), Germany, and the UK (ICO). Outside the EU/EEA, the practical impact of this designation is less defined. 4) CONTRACT AND VENDOR IMPLICATIONS: If functional cookies are set by or share data with third parties, those relationships require contractual coverage under GDPR. The always-active designation does not exempt these cookies from data processing agreement requirements. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should review whether first-party functional cookies qualify for the strictly necessary exemption under applicable EU/EEA guidance, and whether their inclusion as 'always active' in the consent interface is consistent with current regulatory expectations. Documentation of the necessity assessment for each cookie category should be maintained.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
The designation of functional cookies as 'always active' alongside strictly necessary cookies may require evaluation under GDPR and ePrivacy Directive guidance, which generally permits exemption from consent only for cookies that are strictly necessary for a service explicitly requested by the user. Whether personalization-enabling functional cookies qualify for this exemption is a matter of regulatory interpretation.
Under these terms, strictly necessary and first-party functional cookies cannot be disabled through the Spotify consent interface. Users who wish to block these cookies must do so through browser-level settings, with the document stating that some parts of the service may not function as a result.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Spotify.