Spotify Privacy Policy

This document is Spotify USA Inc.'s Privacy Policy, effective 13 April 2026, governing the collection, use, and disclosure of personal data of U.S. residents across all Spotify streaming services, websites, customer service, and community platforms, with legal basis grounded in service provision, consent, legitimate interests, and compliance with applicable law. The policy states Spotify collects User Data (name, email, date of birth, gender, phone number, street address), Usage Data (search queries, streaming history, browsing history, AI feature prompts and transcripts, device identifiers, IP addresses, inferred interests), Voice Data, Payment and Purchase Data, and Age Check Data including biometric facial imagery; the terms authorize sharing this data with advertising partners, analytics providers, payment processors, technical service partners, and other Spotify group companies. The policy asserts an opt-out model for tailored advertising (rather than opt-in), extends state-law privacy rights to all U.S. residents regardless of state, and discloses collection of AI interaction transcripts and facial age estimation data processed by third-party providers, with Age Check Data stated to be deleted immediately after use. The policy engages the California Consumer Privacy Act (CCPA) and its amendments under CPRA, with a separate California Notice at Collection referenced, as well as Virginia, Colorado, Connecticut, and other state comprehensive privacy laws applicable to U.S. residents; the extension of state rights to all U.S. users reduces but does not eliminate jurisdiction-specific compliance exposure. Material compliance considerations include the biometric data dimension of facial age estimation under state biometric laws such as Illinois BIPA, the adequacy of consent mechanisms for AI feature data processing, and the scope of third-party advertising data flows relative to CCPA's sale and sharing definitions.