Spotify has dramatically changed its privacy policy, to the detriment of users. In an update pushed today, and displayed on first launch of the mobile client, the company has declared that it now collecting location information gleaned from GPS, Wi-Fi, or Bluetooth, and other phone sensor data. In addition, “with your permission,” the company wishes to gather pictures and contacts from the mobile device used to connect to the streaming music service.
Furthermore, in the new privacy policy update, the company declares that it “may also receive information about you from our service providers and partners, which we use to personalize your Spotify experience, to measure ad quality and responses to ads, and to display ads that are more likely to be relevant to you.”
The company is collecting data to share to advertising partners, in exchange for information on users it is gleaning from them. The new policy states that “we may share information with advertising partners in order to send you promotional communications about Spotify, or to show you more tailored content, including relevant advertising for products and services that may be of interest to you, and to understand how users interact with advertisements.” The company claims that the information is hashed, so it does not clearly identify a user by name to an advertiser.
The data collection is subscription-agnostic. Regardless of whether or not the user is a paid customer, the data is collected anyhow. It is also unclear how a user either opts-in or opts-out of photo and contact scraping from a mobile device.
The company has responded to Internet complaints saying that the data accessed “simply helps us to tailor improved experiences to our users, and build new and personalised products for the future.” Recent new features include Spotify Running, which matches the BPM of your music to the pace of your run, or the new Discover Weekly feature, which curates a weekly playlist based on your tastes.” It concludes by saying that “throughout, the privacy and security of our customers’ data is — and will remain — Spotify’s highest priority.”
Later the CEO of Spotify Daniel Ek has responded to concerns about the new policies that the company is instituting. In a blog post, the CEO says that “if you don’t want to share this kind of information, you don’t have to. We will ask for your express permission before accessing any of this data — and we will only use it for specific purposes that will allow you to customize your Spotify experience.”
The blog post mentions several times that it won’t collect this data “without explicit permission.” Ek notes that “We are also going to update the new Privacy Policy in the coming weeks to better reflect what we have explained above.”
