Spotify GDPR data request–here is what you get | Hacker News Reader

Spotify GDPR data request–here is what you get

13 pointstzs3 comments

Three days ago in the discussion of Spotify making it harder for third party services to transfer playlists from Spotify to other services, the idea of getting that data via GDPR requests came up. I made such a request, and the data arrived today. This submission is a description of that information.

It was a zip file that included a Read_Me_First.pdf and 8 JSON files.

The 6 page long PDF is just some information about your GDPR and California privacy law rights, and contact information to request more information such as technical log information, extended streaming history, or other special data they collect to provide and troubleshoot the service. It's 6 pages because they have that information in 21 languages.

The JSON files are named Follow, Inferences, Payments, Playlist1, SearchQueries, StreamingHistory0, Userdata, and YourLibrary.

Playlist1 appears to contain all of my playlists, and would be sufficient for recreating them on another service.

For the curious, I'll describe the rest in a comment.

Very annoyingly, last time I checked the `YourLibrary` data didn't contain any kind of standardized identifier (e.g. the ISRC, which is available through the Spotify API).

It makes absolute sense in the context of preventing users switching to other services, though.

Here's what else is included:

Follow is a list of artists I follow. There does not appear to be a distinction between artists I purposefully followed and artists Spotify automatically followed on my behalf, but that could just be because I have never purposefully followed anyone.

Inferences is a list of strings such as "2P_Nexcare_IRI > Buyers Of Nexcare Brand Products Within Last 104W > Verified_10July2020_US", "3P_Reality TV Enthusiasts_UK", "Cookie Audience NOT Matched to PPIDs", "3P__Isotonic Beverage Category_Heavy Buyers_US", and a bunch of more like that. Almost certainly something to do with advertising (although I have a paid subscription, not an ad supported...and most of them reference products or even entire product categories that I have never once in my life bought or even showed any interest in).

Payments has my credit card information, with all but the last 4 digits of the card number masked.

SearchQueries has my searches from the last ~3 months, tagged by platform ("DESKTOP", "IPHONE_ARM64"). I don't think the IPHONE_ARM64 is actually my iPhone. I'm pretty sure most or all of those were from my iPad.

StreamingHistory0 appears to be every song I played through Spotify in the last year. For each it lists the end time in "YYYY-MM-DD HH:MM" format, the number of milliseconds the song played, the track name, and the artist name.

Userdata is what you would expect. It has fields named userName, email, country, createdFromFacebook, facebookUid, birthdate, gender, postalCode, mobileNumber,, mobileOperator, mobileBrand, and creationTime. For me createdFromFacebook is set to false, facebookUid set to null, mobileOperator is "None" and the other mobile fields are null. I'm sure they could have probably deduced some of those, but have not, and I've never noticed them asking for that information either, so I'm curious how they ever get populated.

Finally, YourLibrary has information about your library. The JSON object has separate properties for tracks, albums, shows, episodes, bannedTracks, and other.

The album property corresponds to "Albums" in your library, and the tracks corresponds to "Liked Songs". How the rest matches up, I don't know. The library in the GUI has "Made For You", "Recently Played", "Artists", and "Podcosts". I don't have anything in any of those, so don't know how they map to properties in YourLibrary.

I have one album in the album section of my library, and that shows up under albums in the JSON. All the tracks of that album show up under the tracks section of the JSON.

Here are the languages in the Read_Me_First.pdf file, according to Google Translate's "detect language" function:

  English
  Swedish
  Arabic or Persian
  German
  Spanish
  Spanish
  Finnish
  French
  French
  Hebrew
  Hungarian
  Indonesian
  Italian
  Japanese
  Dutch
  Polish
  Portuguese
  Thai
  Turkish
  Vietnamese
  Chinese

I put "Arabic or Persian" because which Google says depends on what parts of that section of the PDF I copy/paste to Google.

My guess as to why there are two Spanish sections is that one is Spain Spanish and one is Latin America Spanish. Those are different enough to some language course, such as Rosetta Stone, offer them as separate courses.

There are also two French sections. I assume one is France French. Has French spoken in any major place outside French changed enough to justify its own section, like the Spain/Latin America thing? Maybe Quebec?

Reply on news.ycombinator.com