Spotify may decline to delete your personal data if it believes the data is still needed for its original purpose, for fraud protection, for legal compliance, or in connection with any unresolved account issue or legal claim.
This analysis describes what Spotify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The exceptions to deletion requests mirror categories recognized under CCPA/CPRA but are stated broadly, particularly the 'overriding interest' and 'unresolved account issue' carve-outs, which could be applied to retain data beyond what applicable law strictly permits.
Interpretive note: The 'overriding interest' exception does not map precisely to enumerated CCPA/CPRA statutory exceptions; the scope of its application in practice is not defined in the policy and may depend on enforcement interpretation.
If you submit a deletion request, Spotify may decline to delete some or all of your personal data if it determines one of the listed exceptions applies; the 'unresolved account issue' and 'overriding interest' exceptions are broadly stated and the scope of their application in practice is not further defined in the policy.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Please note there are situations where Spotify is unable to delete your data, for example when: it's still necessary to process the data for the purpose we collected it for; we have an overriding interest in continuing to process the data, for example where we need the data to protect our services from fraud; Spotify has a legal obligation to keep the data, or; Spotify needs the data to establish, exercise or defend legal claims. For example, if there's an unresolved issue relating to your account.Excerpt from Spotify's Privacy Policy
REGULATORY LANDSCAPE: CCPA/CPRA permits businesses to decline deletion requests under specific enumerated exceptions including legal obligation, security purposes, and legal claims.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The exceptions to deletion requests mirror categories recognized under CCPA/CPRA but are stated broadly, particularly the 'overriding interest' and 'unresolved account issue' carve-outs, which could be applied to retain data beyond what applicable law strictly permits.
If you submit a deletion request, Spotify may decline to delete some or all of your personal data if it determines one of the listed exceptions applies; the 'unresolved account issue' and 'overriding interest' exceptions are broadly stated and the scope of their application in practice is not further defined in the policy.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Spotify.