We all know that Spotify collects our data – some people seem pretty happy about it. At the end of every year, social media is plastered with users posting their 'Spotify Wrapped' results, an ultra-sharable analysis of the music and podcasts users listened to in the past year.
Spotify Wrapped tells users their top artists, genres, how they compare to other listeners globally, and in 2023 it even assigned listeners a personality profile based on their listening habits.
With over 600 million users, the world's most popular music streaming app collects data from, and monetises its customers in number of ways. But apart from our listening habits, what else does Spotify know about us? And besides creating slick graphics so users can publicly share their music taste and habits, what does it do with that data?
What data is collected by Spotify?
Marc Cheong is a senior lecturer in information systems and Xanthe Lowe-Brown is a PhD candidate in human-computer interaction, both at the University of Melbourne. They say Spotify's privacy policy and terms of service took them about one-and-a-half hours to read and understand.
Spotify's privacy policy has a non-exhaustive list of the data it collects. Some of this is basic information collected during the creation of your account like your email address and billing information.
But it also lists a wide range of 'usage data' that it collects. This includes streaming history, search queries, and your entire music library. Importantly the information it collects is not limited to what it mentions in its privacy policy, giving Spotify a broad scope for what data it can gather and keep in its systems.
The information Spotify collects is not limited to what it mentions in its privacy policy
Lowe-Brown says that the streaming platform is collecting more data than people know. This includes your phone's sensor data, which is information about "the way you move or hold your device", voice data (when you use voice controls), information about other devices on your Wi-Fi connection that can connect to Spotify, and data about what music you listen to, which she says can be used to infer your personality traits and emotional state. Cheong says these data points set it apart from other data collection companies like social media platforms.
Spotify's privacy policy mentions that voice data is collected "if voice features are available in your market". According to its voice control policy – or lack thereof – this feature is currently not available in the Australian market.
Collecting more intimate information
In 2021 Spotify received a controversial patent to collect data on users' emotional state, gender, age, accent, and environment based on an audio input. At the time Spotify told Pitchfork, "Spotify has never implemented the technology described in the patent in any of our products and we have no plans to do so".
The patent is still active, but it is unclear if Spotify is currently using it. CHOICE contacted Spotify to ask and the company declined to comment.
How does Spotify use AI?
Not mentioned by Spotify in either its privacy policy or terms of service is its use of AI technology. But the company uses AI in a number of ways. Personalised playlists, Spotify Wrapped, and recommendations are all powered by AI. Spotify says it processes "half a trillion events" like searches, listens or likes, all of which power its machine learning algorithm.
"The fact that Spotify is not transparent or upfront about that type of data collection and how it's used is probably quite problematic from the consumer's point of view, says CHOICE consumer data advocate, Kate Bower.
Spotify's privacy information on Apple's App Store mentions that it may collect your health and fitness information.
How is Spotify getting your data?
Experts say that Spotify is not just getting data from its platform. Spotify can also collect data from companies it absorbs, like music data company The Echo Nest which it acquired in 2014.
Fabio Morreale, a senior lecturer in music at the University of Auckland, says The Echo Nest had a music recommendation dataset that it scraped from blogs, websites, and social media like Reddit. That means that Spotify now has data originally collected by The Echo Nest on people who are not Spotify users.
Spotify also receives "inferences from certain advertising or marketing partners". It says this allows it to deliver more relevant ads and marketing.
Third party applications, services, or devices that are connected to your Spotify account can also send information to Spotify. This includes social media, smart watches, cars, and mobile phones. Spotify's privacy information on Apple's App Store mentions that it may collect your health and fitness information.
What does Spotify use your data for?
Spotify lists 16 different ways it processes and uses your personal data. These range from "personalised recommendation algorithms" to "marketing, promotion and advertising purposes" and "to conduct research and surveys".
Spotify's partner organisations may also combine the personal data that it shares, which can be used to build a more complete user profile. Spotify markets this to customers as driving a powerful recommendation algorithm that creates "the best overall user experience".
Third party applications, services, or devices that are connected to your Spotify account can also send information to Spotify. This includes social media, smart watches, cars, and mobile phones
"As you engage with Spotify, actions such as searching, listening, skipping, or saving to your library influence our interpretation of your taste. We call this your 'taste profile'," the streaming platform says.
Spotify also says that recommendations are based on your location, language, age, and who you follow.
Spotify Wrapped helps market Spotify's data collection as a desirable feature of the service. "Wrapped or it didn't happen" was the slogan for 2023's Wrapped campaign. This encourages people to allow Spotify to collect their listening data, and even increase their use of the service, says Lowe-Brown.
Other reasons that Spotify collects data include "to fulfil contractual obligations with third parties", whereby they may provide users' "pseudonymised" listening data. Your data is also used to conduct research, which Spotify justifies as being motivated by a legitimate interest in understanding "more about how users think about and use the Spotify service".
But perhaps Spotify's biggest interest in your data is for advertising.
Spotify ad targeting is shockingly specific
Spotify's ad studio boasts "advanced targeting options" that can reach specific audiences based on a huge array of demographics and categories.
General demographics
To start, advertisers using Spotify can target you based on your age, gender, language, the platform you access Spotify from, and your location. Location targeting can be as broad as your country, or as narrow as your postcode. Currently only advertisers within Australia can target Australia and its regions.
Interests
You can also be targeted based on your interests. For example, if you listen to podcasts about books or literature, you will probably be a part of the "books" interest category. It's not just what you listen to that decides your interest category though. If you listen to Spotify on a gaming console, you'll probably end up in the "gaming" interest category.
Emotions and activities
Spotify also identifies playlists associated with specific activities and emotional states like cooking, working out, or "chill" so that advertisers can reach audiences based on "real-time context targeting".
The value of targeting
Bower says Spotify's ability to segment its audience into groups can be very attractive to advertisers and marketers. "Even though it seems pretty benign it's actually an incredibly valuable asset in terms of the data that they can then sell."
Spotify says it has over 615 million users, 239 million of whom pay for the service. The remaining 376 million are on an ad-supported tier. But just because you pay for Spotify, it doesn't mean the platform can't advertise to you.
Spotify says it has over 615 million users, 239 million of whom pay for the service
Lowe-Brown says that because Spotify shares data that it has collected with its partners, that data might allow you to be targeted on other platforms that Spotify has shared your data with.
You can also still get ads as a paid subscriber when you listen to podcasts. In 2020 Spotify launched "Streaming Ad Insertion" which brings targeted advertising into podcasts for all listeners.
Does Spotify control what you listen to?
Morreale says it is extremely likely that users are getting their music suggestions from Spotify rather than other sources.
He adds that by being exposed to music recommendations from just one provider, people's listening preferences and habits end up being shaped by how streaming services perceive users, "rather than our digital identity being closer to us".
The risk is that users' taste is homogenised by categorising people into predefined listener categories, and Morreale says that Spotify might have a financial interest in doing this because it allows them to help advertisers target users more effectively.
Can you take control of your data on Spotify?
Spotify has settings that allow you to opt out of targeted advertising, and to stop Spotify from processing your Facebook data. You can do this easily using the privacy settings on their website.
You can also access a private mode which hides what you are listening to from your followers. Although it's important to note that this does not hide anything from Spotify – the platform records what you listen to whether you're in private mode or not.
You can also download your Spotify data, including account data, extended streaming history, and technical log information. We did this and received over 150 separate files that detail every aspect of our interactions with Spotify
It's worth remembering that Spotify is not just a music streaming service, but a data and AI product.
Requesting for your Spotify data to be deleted
Spotify's privacy policy says, "to request erasure of your personal data from Spotify, follow the steps on our support page". This has a link that redirects to a page titled "Closing your account and deleting your data". Deleting your account appears to be the only way to truly take control of your data on Spotify.
However, when it comes to wiping your streaming history or listening habits, the privacy policy states that Spotify has the option to de-identify your data rather than delete it. Cheong says previous research has shown that de-identified data can still be used by companies to "build a shadow profile of you" which can be matched with other data.
Users likely don't have any right to deletion, and Spotify can choose to keep whatever data they want
Spotify also does not have to delete your data if its interest overrides your own. It says this could be the case in instances where it needs to protect itself from fraud or if there is a legal obligation to retain your data. Spotify also says it may keep your data if "it's still necessary to process the data for the purpose we collected it for". Bower says this means users likely don't have any right to deletion, and Spotify can choose to keep whatever data they want.
Protecting your data
Bower says it's worth remembering that Spotify is not just a music streaming service, but also a data and AI product. Its data practices are part of its service. "If you are uncomfortable with that, your only option is not to use Spotify or not to use any kind of streaming service."
CHOICE is working towards better privacy laws that put some responsibility back on businesses to do the right thing. Some of the proposed reforms include changing the definition of personal information to include any information that can uniquely identify you, and introducing a fair and reasonable use test for any business that collects personal data on you.
Stock images: Getty, unless otherwise stated.
