10 Total
1 High severity
6 Medium severity
3 Low severity
Summary

This is Spotify's privacy policy — a document explaining what personal information Spotify collects about you, how they use it, who they share it with, and what rights you have over your data. Spotify collects a wide range of data including your listening history, location, device details, voice recordings, payment information, and even inferences about your age and interests. You have rights to access, correct, or delete your data, and you can opt out of targeted advertising through your Account Privacy page.

Technical Summary

Spotify's Privacy Policy (effective 27 August 2025), published by Spotify USA Inc., governs the collection, processing, storage, and disclosure of personal data for U.S. residents using Spotify's streaming services, websites, customer service, and community platforms. The policy delineates extensive data collection categories including User Data, Usage Data, Voice Data, Payment Data, Age Check Data, and inferred interest/preference data, and specifies processing purposes including service delivery, personalization, tailored advertising, fraud prevention, and regulatory compliance. Key rights extended to all U.S. residents include access, correction, deletion, data portability, opt-out of tailored advertising, and withdrawal of consent, with an explicit non-discrimination commitment. The policy references compliance with the California Consumer Privacy Act (CCPA) and cross-context behavioral advertising ('sharing') frameworks, and discloses data transfers to third parties including advertising partners, service providers, and affiliated entities.

Institutional Analysis

This policy engages primarily with the California Consumer Privacy Act (CCPA/CPRA), including cross-context behavioral advertising ('sharing') obligations and a California Notice at Collection, as we…

This policy engages primarily with the California Consumer Privacy Act (CCPA/CPRA), including cross-context behavioral advertising ('sharing') obligations and a California Notice at Collection, as well as broader U.S. state privacy laws, with Spotify extending CCPA-equivalent rights to all U.S. res…

🔒

Compliance intelligence locked

Regulatory exposure, material risk, and due diligence action items.

Evidence Provenance
Captured March 6, 2026 18:27 UTC
Document ID CA-D-000036
Version ID CA-V-000031
Wayback Machine View archived versions →
SHA-256 acdf80d97e510307f5441abe1c0404a56c275953626bfca6778645218fcb126f
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Change Timeline
High Severity — 1 provision
Medium Severity — 6 provisions
Low Severity — 3 provisions