Spotify’s Privacy Policy is Mostly Fine
Gordon Gottsegen at Wired:
SPOTIFY RELEASED A new privacy policy that is now in effect, and it turns out that the company wants to learn a lot more about you and there’s not much you can do about it.
I’m all for calling out creepy privacy policies, but Spotify’s actually seems fine. Most of the items mentioned are clearly in service of a user-facing feature in Spotify.
Let’s go through them. All further quotes are from Spotify’s privacy policy.
“With your permission, we may collect information stored on your mobile device, such as contacts, photos, or media files. Local law may require that you seek the consent of your contacts to provide their personal information to Spotify, which may use that information for the purposes specified in this Privacy Policy.”
Contacts. Want to be able to check your contacts to find your friends on Spotify? Maybe you don’t personally—and if not, you don’t have to give Spotify permission to access your contacts!—but a lot of people want to be able to do that when signing up for a service with a social component. This would be true of any service with this functionality.
The second sentence sounds weird, but it also sounds like a legalese disclaimer they were forced to put in there. There’s a law requiring this somewhere, so here it is.
Media files. Spotify can play the non-DRMed files on your device. To do so, they need to access them. Possibly to make better recommendations, they collect data about these files. That’s just a theory, but a music service collecting data about your music hardly seems like an overreach.
Photos. This is the one thing that does seem creepy. I can’t think of an explanation for this one.
“Depending on the type of device that you use to interact with the Service and your settings, we may also collect information about your location based on, for example, your phone’s GPS location or other forms of locating mobile devices (e.g., Bluetooth). We may also collect sensor data (e.g., data about the speed of your movements, such as whether you are running, walking, or in transit).”
GPS location. Popular stuff near you. I don’t recall if they have this feature at the moment, but it’s a standard thing to measure and offer.
Sensor data. Spotify Running, which a writer at Wired (UK) found “extremely helpful,” tailors its playback to your workout in real-time. It needs this sensor data to do that.
“You may integrate your Spotify account with Third Party Applications. If you do, we may receive similar information related to your interactions with the Service on the Third Party Application, as well as information about your publicly available activity on the Third Party Application. This includes, for example, your “Like”s and posts on Facebook.”
Spotify wants to know about when people use Spotify to post to Facebook (or Twitter or LiveJournal or whatever). Nothing is weird about this – Spotify is already part of the transaction.
Spotify also wants to possibly do things with your publicly available information, which is a little creepy in that there’s no direct user-facing benefit, but it is public activity. For better or worse, this seems standard these days.
I’m not writing this because I have some affinity for Spotify and think they can do no wrong. I haven’t even been a Spotify Premium subscriber for a while now. I’m writing this because I care about the abuse of privacy policies and EULAs, and a (deliberately?) sensationalized article like this one is a rather unhelpful thing. Misrepresenting and crying wolf over a policy document that’s actually rather reasonable makes it harder for everyone to understand and address the truly bad situations where these policies are disrespectful, overbearing, or hostile.