Spotify

Spotify Technology S.A., a Luxembourg société anonyme (RCS Luxembourg B 123052), is the group parent and the entity listed on the NYSE under ticker SPOT since 3 April 2018. Day-to-day operations run from Spotify AB in Stockholm (Bolagsverket org-nr 556703-7485, VAT SE556703748501). For EEA and UK users the named data controller is Spotify AB; for US users it is Spotify USA Inc. (4 World Trade Center, 150 Greenwich Street, New York, NY 10007, Delaware-incorporated). Regional subsidiaries handle local sales and marketing in Germany, France, the United Kingdom, Spain, Italy and beyond.

Spotify states in its FY2025 20-F that Google Cloud Platform hosts 'the vast majority of our primary data storage (including personal data of users and audio data licensed from rights holders) and computing.' The edge layer is served by Fastly with European points of presence (e.g. Munich for DACH traffic). Spotify does not publish a specific GCP region for EU users and does not offer an EU-only residency plan; international transfers rely on Standard Contractual Clauses (SCCs) with technical protections such as encryption and pseudonymisation.

Yes, in three ways. (1) The Luxembourg parent Spotify Technology S.A. files annual 20-F reports with the SEC as a foreign private issuer and is subject to US securities laws. (2) Spotify USA Inc. (Delaware) is the named data controller for US users and is a direct subject of the CLOUD Act, FISA 702 and other US national-security process. (3) Spotify's primary cloud provider (Google LLC) and several named operational subprocessors (Okta Inc., Fastly Inc., OneTrust) are US-incorporated. For EEA users the immediate controller is Spotify AB in Sweden, but the underlying storage and compute run on US-operated infrastructure.

Founders Daniel Ek and Martin Lorentzon held combined 69.3% of voting power as of 31 December 2025 (28.8% and 40.5% respectively) via the dual-class beneficiary-certificate structure. Tencent Holdings owns approximately 9% of economic equity through several Hong Kong holding entities (Tencent Music Entertainment Hong Kong, Image Frame Investment, Tencent Mobility, Distribution Pool), but those shares are subject to an irrevocable proxy in favour of Daniel Ek's D.G.E. Investments and therefore carry no voting power. The remaining free float is held by US and global institutional investors.

Only Spotify for Backstage, the developer-portal SaaS, publicly maintains an annual SOC 2 examination by a third-party auditor (report available under NDA via backstage-support@spotify.com). For the main consumer streaming service Spotify does not publish a certification page; third-party aggregator claims of ISO 27001, SOC 2, PCI DSS, HIPAA or FedRAMP coverage for the streaming product are not corroborated by any Spotify-published URL. Spotify's public commitments for the consumer service are framed in terms of GDPR compliance and the EU Digital Services Act rather than vendor-neutral security certifications.

Yes. The Spotify Privacy Settings page offers three GDPR data-export packages -- account data, extended streaming history and technical logs -- delivered within 30 days. Account deletion is self-service via the same flow. The privacy policy describes retention criteria categorically rather than naming a specific post-deletion retention window; the data-protection contact is privacy@spotify.com and the EEA controller is Spotify AB (no separate GDPR Article 27 representative is named, since Spotify AB sits inside the EEA).