Spotify is an online streaming service that provides digital access to listen to music and podcasts. Spotify's terms make clear the terms cover the Spotify service, and not the Spotify Kids service. The terms are also say that children may not use Spotify and should be directed to Spotify Kids. The terms for Spotify say that the service collects personal information from users and that some of the information collected will be visible on a user's public profile. Additionally, the terms say that Spotify uses and discloses the information collected from users to conduct targeted advertising on the platform and other services. Spotify's terms are also say that the service uses reasonable security measures to protect user data including the use of encryption. Lastly, the terms say that social interactions are possible on the service through user profiles and content but that Spotify is not responsible for moderating that content.

Spotify: Music and podcasts can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and Terms of Use used for this evaluation can be found on Spotify’s website. Additionally, other policies used for this evaluation include: Cookie Policy and Supplemental U.S. State Privacy Notice. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Safety

Spotify's terms are clear that users have public profiles that may contain personal information, including listening history. They are also clear that users on the Spotify platform may interact with one another through their profiles. In addition, the terms are clear that information on profiles is visible to all other users of the service with the exception of anyone blocked by that user. Spotify's terms are also clear that users may upload content to the service and that Spotify is not obligated to review and monitor that content, but reserves the right to do so. The terms also make clear that users should be careful with the information and content made available to other users as they may use and share that information with others.

Privacy

Spotify's terms say that the service may collect personal information from users including email address, phone number, date of birth, street address, and gender. Additionally, the terms are clear that Spotify will use tracking technologies to collect usage information about users while on the service. The terms also indicate that Spotify may use the data collected on the service to target advertising to users while on the service and track them on other sites and services for commercial purposes. Spotify's terms also indicate that the service may share the information collected about users with third party marketing partners who may use that information to deliver targeted advertising. The terms say that users may connect their Spotify account with accounts on other platforms, like social media. Connecting a Spotify account with a social media account allows users to share content from Spotify with the social media service, but also enables Spotify to collect personal information from the social media account. Spotify's terms indicate that the information collected from and shared with third party partners may be used to build advertising profiles to better serve targeted ads to users. In addition to the targeted ads delivered by Spotify, users may also be served with contextual ads while interacting with the service. The terms are clear that if a user opts out of having personal information used for targeted advertising, they will still be served contextual ads on Spotify.

Security

Spotify's terms indicate that they take reasonable steps to protect the information collected from users of the service. They indicate that procedures and practices are in place to leverage pseudonymization, encryption, access, and retention policies to protect data. However, the terms are not clear which types personal information are protected by each measure nor when they are used. For example, the terms do not address whether the encryption may be limited to payment information or includes all personal information nor whether the data are encrypted in transit, at rest, or both. Further, the terms do not address how Spotify would respond in the event of a data breach nor how impacted users may be notified.

Compliance

Spotify's terms are clear that users are given the right to access, modify, and request the deletion of their personal information. They clearly state that users may access and modify personal information through account settings and a data download tool on Spotify. They are also clear that Spotify has data retention policies that delete most personal information upon the user deletion of their account. However, Spotify may retain user data for certain purposes including to prevent harm to other users and protecting intellectual rights. The terms are not clear how long Spotify may retain data for these purposes.

The terms are clear that the Spotify service is not directed at children under the age of 13. They clearly indicate that guardians should notify Spotify if a child under 13 has provided personal information to the service. Spotify's terms state that they will take reasonable steps to remove the child's personal information from the service, which may include deleting the child's account. The terms do indicate that teens between the ages of 13 and 17 may use Spotify with the consent of a parent. However, they are not clear whether or how Spotify will obtain verifiable consent for users in that age group.

• Unclear whether personal information is sold or rented to third parties.
• Personal information is shared for third-party marketing.
• Personalised advertising is displayed.
• Data are collected by third-parties for their own purposes.
• User's information is used to track and target advertisements on other third-party websites or services.
• Data profiles are created and used for personalised advertisements.