Spotify

Best-in-class privacy controls for a streaming service — GDPR rights table, tailored ad opt-out, private sessions, and a data download tool — but core listening history cannot be limited while you remain a user.

SCC-backed international transfers, pseudonymisation and encryption mentioned, and specific retention timelines for some data — but security is described generically and 'legitimate interest' is used to justify a broad range of advertising activities.