Additional California Privacy Disclosures

Effective as of January 1, 2020

If you are a California resident, the processing of certain personal data about you may be subject to the California Consumer Privacy Act (“CCPA”) and other applicable California state privacy laws. Beginning January 1, 2020, the CCPA gives you certain rights with respect to the processing of your personal data (known as “personal information”, as described in under the CCPA).

This supplement provides additional privacy disclosures and informs you of your additional rights as a California resident, and should be read in conjunction with our Privacy Policy.

Personal Information Collected and Processed

Section 4 of our Privacy Policy sets forth the categories of personal information that Spotify collects and processes about you, a description of each category, and the sources from which we obtain each category.

Requests to Exercise Your Rights

RIGHT TO KNOW REQUEST - Under the CCPA, you have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months, and ask that we provide you with the following information:

  1. Categories of and specific pieces of personal information we have collected about you.
  2. Categories of sources from which we collect personal information.
  3. Purposes for collecting, using, or selling personal information.
  4. Categories of third parties with which we share personal information.
  5. Categories of personal information disclosed about you for a business purpose.
  6. If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold.

To make a verifiable request for information about the personal information we have collected about you, please access your Privacy Settings in your account profile to make a request by using the ‘Contact Us’ form on the Privacy Center and select the option “I want to download a copy of my data” or emailing us at privacy@spotify.com.

RIGHT TO DELETE REQUEST - You also have a right to request that we delete personal information, subject to certain exceptions. You may exercise your right to delete by using the ‘Contact Us’ form on the Privacy Center and selecting “I want to permanently delete my data” or emailing us at privacy@spotify.com.

HOUSEHOLD REQUESTS - We currently do not collect household data. If all the members of a household makes a Right to Know or Right to Delete request, we will respond as if the requests are individual requests.

REQUESTS, GENERALLY - Please note, if you do not have a Spotify account we will not have enough information about you to verify your Right to Know and Right to Delete requests, as we do not keep sufficient information necessary to reidentify and link you to a prior visit to the Spotify Service where data may have been collected. As such, we will be unable to verify and honor your requests. You may make a verifiable consumer request related to your personal information twice per 12-month period. We will not discriminate against you for exercising any of your rights under the CCPA.

REQUESTS MADE THROUGH AGENTS - You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Disclosures of Personal Information for a Business Purpose

In the preceding 12 months, Spotify has disclosed certain data from the following categories of personal information to the categories of recipients listed in Section 6 of our Privacy Policy for one or more business purposes:

Sale of Personal Information

Under the CCPA, a “sale” means providing to a third party personal information for valuable consideration. It does not necessarily mean money was exchanged for the transfer of personal information. We have taken substantial steps to identify whether any of our data sharing arrangements would constitute a “sale” under the CCPA. Due to the complexities and ambiguities in the CCPA, we will continue to evaluate some of our third party relationships as we wait for final implementing regulations and guidance. For example, it is currently unclear whether the use of certain types of advertising partners would be considered a sale under CCPA. We provide Usage Data to advertising partners, which enables us to provide you with interest-based advertising. If you prefer not to receive interest-based advertising, please opt out by going to your account privacy settings and using the tailored ads opt out toggle. For more information on interest-based advertising, please see our Privacy Policy and Cookie Policy. We will continue to update our business practices as regulatory guidance becomes available and provides clarity on what constitutes a sale transaction, particularly in the advertising ecosystem.

Contact Us

You may contact us by emailing us at privacy@spotify.com or using the ‘Contact Us’ form on the Privacy Center.