2 Concern2 Mixed0 Positive
C52 / 100
In Plain English
Spotify tracks everything you listen to, infers your interests from your behaviour, and feeds that data into a broad advertising machine — including third-party ad partners who send them data about you too. Controls are better than most, but your listening history is kept for the life of your account with no way to stop it.
Category Breakdown
Known data breaches
No known public data breaches
Spotify does not appear in the Have I Been Pwned database of publicly disclosed data breaches.
How Spotify could earn a higher grade
Recommended changes
- Stop retaining full listening history for the lifetime of the account — provide an automatic rolling deletion option (e.g. delete plays older than 2 years).
- Publish a list of the specific advertising partners who receive behavioural data and what data categories they receive.
- Allow users to opt out of third-party data enrichment (where advertisers send Spotify data about your off-platform behaviour) without losing free tier access.
- Provide a data minimisation mode for free tier users that limits collection to what is technically required to stream music.
- Extend GDPR-equivalent rights (objection to profiling, data portability) to all users globally, not only EU users.
Frequently asked questions
Alternatives to Spotify
C+
Netflix
58/100
Netflix collects detailed viewing behaviour, device fingerprints, and advertising data — including interests inferred by…