Spotify can refuse to delete your data in certain circumstances, including if it believes it needs the data to protect itself from fraud or to defend legal claims.
Even if you request deletion of your Spotify data, Spotify may retain it if it determines there is an 'overriding interest' in keeping it — including fraud protection and legal defense — meaning your deletion right is not absolute and is subject to Spotify's discretionary judgment.
How other platforms handle this
When you connect to us or log in through a Third-Party Account like Facebook or Google, we receive information from that third party identifying your account. Information we collect in this context includes third-party account details such as username or email address. We collect and store this info...
We generally retain the related personal info as long as your account is active or as is otherwise necessary to provide the Riot Services, operate our business (including for legitimate purposes like complying with our legal obligations, managing internal books and records, preventing fraud, resolvi...
We keep your personal information to enable your continued use of Amazon services, for as long as it is required in order to fulfill the relevant purposes described in this Privacy Notice, as may be required by law such as for tax and accounting purposes, or as otherwise communicated to you.
The exceptions to deletion requests are broadly worded and include self-serving justifications like fraud protection and legal defense that Spotify can invoke unilaterally, potentially limiting your right to delete your data.
1) REGULATORY FRAMEWORK: Deletion right exceptions implicate CCPA §1798.105(d) which enumerates specific, limited exceptions to the right to delete; CPRA amendments thereto; Virginia VCDPA §59.1-581 (exceptions to deletion right); Colorado CPA §6-1-1306; and Connecticut CTDPA §42-523. The use of 'overriding interest' language is characteristic of GDPR balancing tests (GDPR Art. 17(3)) but CCPA's exceptions framework is more prescriptive and narrower. CPPA and state AGs are enforcement authorities. 4)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.