What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://support.spotify.com/us/contact-spotify-privacy/', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': "Submit a deletion request through Spotify's privacy contact at support.spotify.com/us/contact-spotify-privacy/ or via the Account Privacy page; if your request is denied, request a written explanation of the specific exception being invoked and follow the appeals process described in the policy.", 'deadline_days': None, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'State_AG', 'reason': 'State AGs enforce consumer deletion rights under CCPA/CPRA and analogous statutes, including challenges to overly broad retention exceptions.', 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this Data Deletion Limitations and Exceptions clause as medium severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Data Deletion Limitations and Exceptions — Spotify

Share 𝕏 Share in Share 🔒 PDF

What it is

Even if you ask Spotify to delete your data, they may refuse if they believe they need it for fraud protection, legal claims, legal obligations, or the original purpose it was collected for.

Consumer impact (what this means for users)

Requesting deletion of your Spotify data may not result in full deletion — Spotify can retain your data for fraud protection, legal claims, or other unspecified business purposes, potentially for extended periods.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data

Submit a deletion request through Spotify's privacy contact at support.spotify.com/us/contact-spotify-privacy/ or via the Account Privacy page; if your request is denied, request a written explanation of the specific exception being invoked and follow the appeals process described in the policy.

How other platforms handle this

Pinterest Medium

We keep your personal information for as long as we need it to provide you with our services and for legitimate and essential business purposes, such as maintaining the performance of our services, making data-driven business decisions about new features and offerings, complying with our legal oblig...

Coinbase Medium

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. We may retain certain personal information even after you close your account to comply with appl...

Google Medium

We keep the data we collect for different amounts of time depending on what it is, your Google Account settings, and your product settings. Some data you can delete whenever you like, some data is deleted automatically, and some data we retain for longer periods when necessary. When you delete data ...

See all platforms with this clause type →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

These exceptions to deletion are broad enough that Spotify can decline many deletion requests, and the 'overriding interest' language in particular is vague and potentially inconsistent with deletion rights under state privacy statutes.

View original clause language

Please note there are situations where Spotify is unable to delete your data, for example when: it's still necessary to process the data for the purpose we collected it for; we have an overriding interest in continuing to process the data, for example where we need the data to protect our services from fraud; Spotify has a legal obligation to keep the data, or; Spotify needs the data to establish, exercise or defend legal claims. For example, if there's an unresolved issue relating to your account.

Institutional analysis (Compliance & legal intelligence)

(1) REGULATORY FRAMEWORK: CCPA/CPRA (Cal. Civ. Code §1798.105) permits limited exceptions to deletion rights including legal obligations and certain business purposes, but requires that exceptions be narrowly construed and that Spotify inform the consumer of what data cannot be deleted and why. Virginia VCDPA and other state statutes have similar but not identical exception frameworks. The breadth of the 'overriding interest' exception language in this policy may exceed what state statutes permit as a deletion exemption. (2)

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

State AG

State AGs enforce consumer deletion rights under CCPA/CPRA and analogous statutes, including challenges to overly broad retention exceptions.
File a complaint →

Applicable regulations

CCPA/CPRA

California, USA

FCRA

United States Federal

GDPR

European Union

GLBA

United States Federal

HIPAA

United States Federal

UK GDPR

United Kingdom

Provision details

Document information

Document

Spotify Privacy Policy

Entity

Spotify

Document last updated

April 29, 2026

Tracking information

First tracked

April 28, 2026

Last verified

April 28, 2026

Record ID

CA-P-002178

Document ID

CA-D-00036

Evidence Provenance

Source URL

https://www.spotify.com/us/legal/privacy-policy/

Wayback Machine

View archived versions →

SHA-256

62bfd0910e1d9815b6915626d36d1058b28aa407638be86ce562523eaf99f811

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Spotify | Document: Spotify Privacy Policy | Record: CA-P-002178
Captured: 2026-04-28 08:47:36 UTC | SHA-256: 62bfd0910e1d9815…
URL: https://conductatlas.com/platform/spotify/spotify-privacy-policy/data-deletion-limitations-and-exceptions/
Accessed: May 2, 2026

Classification

Severity

Medium

Data Deletion Limitations and Exceptions

What it is

Consumer impact (what this means for users)

What you can do

Why it matters (compliance & risk perspective)

Institutional analysis (Compliance & legal intelligence)

Applicable agencies

Applicable regulations

Provision details

Other provisions in this document